State law governs *limits* on disclosure.
Typically there are not many legal limits on disclosure.
Many states have limits on what a prospective employer can consider, typically criminal history, credit score, etc. But rarely do they prevent one company from talking to another.
The practical limits come from liability. Mid+ size companies with professional HR and legal teams will have policies to prevent sharing of almost all employee info. There's no upside to doing that, and only downside.
An angry manager can turn a molehill into a mountain, and cost the company big bucks. Even if the company discloses purely factual info, if they get sued they will then have to PROVE their info was factual and that would be very hard to do with employee matters, where there is almost always some he said/she said going on.
Obvious exception for legally mandated sharing such as PRIA (which comes with strict limitations on most "HR type" employee info).