My insurance provider has instructed my business to only give "neutral" information about an employee (when they started, their job title, etc.). I am not allowed to say anything negative about anyone because that may get the business sued for defamation if that negative reference prevents the ex-employee from getting a job. This includes people who were let go because they stole from the company, faked an illness to get disability/paid leave/insurance, threatened physical harm to other employees, stopped coming to work for extended periods, spent all day gambling and not working, etc.
http://employment.findlaw.com/hiring-process/is-a-former-employer-s-bad-reference-illegal-.html
I am not really supposed to say anything nice either (since the inference is that an employee must be shady if I don't say something nice).