I agree with all that is said, actually. Yes, it is illegal. Yes, you have the right to not divulge personal medical information. And, it is a double-edged sword. So, my opinion is to tell him the truth. Tell him this. "I have to have surgery. If you are curious about it, I will explain. I understand I don't have to do that, but will do that so you know it is needed and recommended by my surgeon. However, I don't want this information shared with others at all, for any reason. HR already knows the situation." This way you put him on notice that you know your rights, but you include him so the tension doesn't build to a point of relationship destruction.
Just a suggestion, of course.