Forewarning; excuse me if any of this has been brought up already. I didn't have time to read the entire thread, just a few of the latest posts.
@WDWRLD You are correct about the medical privacy laws; however, I think the point that you seem to be missing is that just because the park issues a policy where they do not allow someone to enter the park without wearing a mask, does not mean it needs to be heavily enforced. The goal of the policy is not to strictly enforce people wearing masks, but rather to get most guests to wear them. If people hear that masks are required, they will instinctively wear them.
That said, they don't necessarily have to have their employees ask or demand someone wear them. It can be a 'relaxed' policy. Or they can kindly remind guests they are required when entering the park, and at that point the guest may say they have a medical condition at which point the employee should just let them pass.
It is no different than with service animals. If someone comes to the park with a dog or other animal, they are permitted by law to ask, "Is the animal a service animal?" and "What service does the animal provide?" Those two questions are authorized and permitted by law. However, because of the negative PR that most companies face in these particular situations, they do not ask most of the time and just let anything through. They only ever deal with this kind of issue when the animal appears to be uncontrollable and/or aggressive and/or disruptive to other guests.
I can visualize the same thing happening with the masks. They would likely only ever approach anyone unless a complaint was made, and even then they may do nothing or as I said previously, simply remind the guest masks are required and if the person mentions anything in regards to a medical exception the employee backs off.
Also in regards to self-service drinks, plenty of locations are not allowing them. Wawa is a prime example.