It's kind of like what you said, only for your method to work the value would have to be a string, with the number represented in binary. The & operator is kind of like treating an integer field as if it were a binary string, and checking only one character out of it. '&' means 'bitwise and', and 16 is 10000 in binary, so it's checking the 5th bit from the right. When you '&' the values, you'll get either 16 or 0, depending on whether or not that bit is set, so then you just have check for whether or not the result is 0.
I hope that makes some sense. Maybe this is better:
http://en.wikipedia.org/wiki/Mask_%28computing%29