Be prepared for a bureaucratic process that requires patience and persistence, but both sets of records are obtainable if you work through the right channels.
Start with the unit secretary at the facility where he was housed. That is the administrative hub for the unit and the best starting point for understanding who controls access to which records. The unit secretary can direct you toward the decision-makers for medical record releases and point you to the right department for commissary transaction history.
Medical records are the more complicated of the two. Correctional facilities treat inmate medical records with the same privacy protections as any other healthcare provider, which means you will likely need either written authorization from the former inmate himself or legal standing such as power of attorney or next-of-kin documentation depending on the circumstances. Once the authorization question is resolved, the facility's medical or health services department handles the actual release. Whether it is a state or federal facility affects which specific regulations govern the process, but the starting point is the same either way.
Commissary records are generally more accessible. Every transaction is logged in the facility's inventory and accounting software, and that paper trail is complete and retrievable. The unit secretary or the facility's finance office can tell you the process for requesting a transaction history and what identification or authorization is required.
Put every request in writing and keep copies of everything you submit. A documented paper trail of your requests becomes important if you encounter delays or resistance along the way. Be persistent and follow up regularly.