You can buy insurance through the cruise line, but most people agree it's safer to buy it through a third party insurer. Not that it will happen with Carnival, but the thought is that insurance through the cruise line will not cover you if that cruise line goes out of business.
In general, you can buy cancellation insurance at any time before the cruise, but if you buy it within 14 days of putting down your first deposit, most insurance will cover you for pre-existing conditions.
Talk to your travel agent, or visit one of the insurance company's web sites. I've heard people talk about http://www.insuremytrip.com
for a comparative analysis.