Under the newly enacted FMLA regulations, a doctor not only must categorize that the leave is necessary, but WHY it is necessary. It MUST provide sufficient information to support the need for leave. It is no longer acceptable simply to state that the leave is needed. The law further goes on to give the employer permission to contact the doctor directly for clarification or confirmation. The direct supervisor may NOT under any circumstances be the one to make that contact but HR or upper management can. AND they do not need to notify you in advance that they are doing so. However, if such contact is made, it can only be to clarify what information is already on the form; not to seek new information. The doctor is still required to adhere to HIPAA regulations; however, if permission for the doctor to provide medical certification is denied by the employee, FMLA can be denied.
I understand your concerns. However, until the new regs went into effect last January, FMLA was (and in the main still is) heavily weighted in favor of the employee, to the point where there was a great deal of abuse that the employers were powerless to deal with. Employees could go to the doctor, get a note that they required leave under FMLA, and get 12 weeks of protected vacation. The changes in law are designed to be sure that the people who are using the protections afforded by FMLA actually need them and are not just looking for some time off where the employer can't fire them.
When a few people abuse a system that is put in place to protect, it hurts everyone.