Of course it's legal; your disability claim relates to your employment, so therefore the insurer may seek to obtain, analyze, and verify this information. It is also NOT personal information in the sense of being protected in any way from disclosure--for example, your employer can and does divulge this information regularly to a variety of parties, internal and external (HR and finance staff; your supervisors; insurers; payroll processors; tax authorities; etc.) for a variety of purposes. You may consider it personal, but that does not make it personal, protected, or confidential.