Insurance company obtained patient's records without consent

The policyholder submitted a claim. She was shocked to learn that the insurance company asked for her past medical history from medical providers without getting her consent.