This doesn't seem shady, the form the tweet posted explicitly said it authorized state farm to request his medical, employment, and other records on his behalf.

The only "shady" thing might be not sending the authorization form he signed with their HIPPA request to show the source of the signature, but revealing he's seeking a long term disability claim could also be a HIPPA violation itself...

Regardless, the form says he authorized state farm to do exactly what they did: request his medical records without further approval from him (otherwise he might have needed to fill out each additional requests manually, which perhaps was an option if he declined this, we don't know)