As routinely applications are received in Medical records department by Insurance company for bed head ticket (BHT) of patient's who have the insurance policy for queries regarding the claim. Are they legally entitled to receive patient's medical records? Can we refuse to give BHT without patients consent?

As there is a prohibition of disclosure of patients privacy to the third party. Is there any exception for insurance companies?