Even if they have to show medical records this can be arranged to go through a 3rd party organization that validates the request without sharing details with the company. This type of stuff already exists for medical claims.