They then called and mentioned a specific claim, diagnosis, treatment, and personal info for my son.

When I asked for their legal department contact info to discuss the HIPPA violation, they curiously decided the "proof" wasn't needed afterall. I am still in conversation with the TX BCBS clowns that released private medical info without permission. The state ins commissioner has also expressed interest.