You know, the folks at my office took care of emailing everyone and I was fine with that. I work in a college so I asked that the students not be emailed until after surgery, so that they wouldn't worry. I did not see the email that was sent but I was fine with that. I think it's because there is more of a collaborative vibe there. I did ask that one email only state "surgery" and no specifics because I didn't think the students needed to know unless they asked. Some have, some not so much. You know, if you can, look at it this way: The more people that know, the more that send prayers and thoughts your way. That's how I felt about it.
Of course, you have every right to dictate what personal/medical information is given out and if you need HR's advice I would ask for it and then let your manager know what is legal. You can do that in a way that is totally non-confrontational. You have to put your energies elsewhere. You can get mad at him after surgery.
Best,
Marci