What is the law pertaining to what information can be given out from a former employer when called for a reference for a new job?

Actually, a former employer may give out *any* information but for the employee's private medical history (if they know it) and the employee's own private identifying information, like social security number, bank account number, etc. But in terms of the job itself, the employer could tell title, duties, performance, ratings or reviews, time worked, disciplinary issues, salary, etc.--anything about the job itself is fair game. What they can't do is defame the employee; if they make any factual statements (not opinions; everyone is entitled to their own opinion) about the employee which cast him or her ina bad light, damage his or her reputation, or make others not want to work with him or her, and if that factual statement is false, that is defamation and they could be liable for it. So, for exemple: if you earned less than you told you new prospective employer, they could correct that by telling your actual salary; they could tell the new employer what your title was, or that you were demoted; they could say you're an awful employee (since that's an opinion)--but they can't say you were chronically late if in fact you were not (since that would be a false fact) and they can't give out your medical information, if they know it.