If you think it's one person who could be the source, and you feel like they would be respectful and not malicious, maybe head things off at the pass (so to speak) and talk with them. At this point, there is the possibility of the person who asked you, going back to where she heard it, and the person from your past might be in the position of proving they aren't a liar. Getting to them and telling them to stop discussing your private medical information (using those words puts things into language most people can understand) will enable them to respond to any further questions by blowing it off - "oh, no, I thought it was someone I knew, but I was mistaken."
It's a hella awkward chat to have (believe you me - mine was at a, umm, party), but you will have less of a feeling that stuff is out there. And if the other person refuses, you at least have taken the first step anyone would suggest. After that, take it up with HR as a case of harassment. Good luck.