It is important to consult a health care attorney prior to refusing. HIPAA cannot be used as a reason for not providing the records. Under HIPAA, physicians can release PHI to payers for health care operations which include care coordination (eg, offering case management or other supportive services), risk adjustment, quality reporting (eg, HEDIS), fraud and abuse detection, in addition to payment. Filing a claim and receiving payment may give the plan certain rights to medical records. I think that the instructions on the back of the 1500 claim form (and thus the electronic equivalent) indicate that you must comply with requests related to government programs (Medicare, Medicaid, Tricare, etc.).