I've used something along the lines of,
"If you'd like to put any questions/ concerns you may have -- that are directly related to the LTFA of our child -- in writing, we would be willing to convey those to our medical care provider in order to provide you with clarity."
and then if/when there is more push back and more strong wording is needed, we've had to go to something as follows:
"Our physician(s) are OUR medical care providers. The relationship is doctor - patient! In the interest of our child's/family's right to medical privacy (HIPAA), we will be the conduit of information sharing. We have the relationship with the medical provider, not the school. . . "
And at some point along the road, in one instance we've had to finally and simply say, without tone or any explanation (and YOU have this right up front):
NO.They have no right to any of the records or to direct Q&A with your physicians.
There is nothing wrong with a polite but direct NO.
If they persist, then request (in writing) that THEY put their request (including the whys) in writing.
A "no" is not impolite in and of itself.