Hello again, and thank you.
Wow! Amazing, his candidness! OK, well, there may very likely be a problem. Presuming that Rx paper had the customer's identifying information on it (see http://www.hhs.gov/ocr/privacy/hipaa/understanding/summary/index.html) - it may not have, I suppose, but often name, address, etc. can be found on many types of paper Rx's, this could be a HIPAA violation.
subject to HIPAA. See http://www.hhs.gov/ocr/privacy/hipaa/understanding/coveredentities/
Now, what can she do about it? Well, it depends upon what she seeks. Legally, she CAN file a complaint
with the Office of Civil Rights, who handles thus complaints. She can use this link to start that course: http://www.hhs.gov/ocr/privacy/hipaa/complaints/index.html
Now, there is the chance that the pharmacy and even the individual that screwed up can get in some major trouble - so if that does not matter to her, then filing that complaint may be her choice. If not, she may prefer to write a letter to the manager of the pharmacy, or corporate, and let them know so that it can look into how such a thing can occur and what needs to be done if this is possibly a reoccuring glitch.
Strangely, HIPAA does not provide for a consumers private cause of action for the violation. It is a law without teeth, as they say, to protect us. However, as such, many whose privacy rights have been violated are using state level privacy rights to take action against what the federal law does not provide for. If that is something she wants, she will want to consult with an attorney in her jurisdiction that is involved in such tort law. To find him, she could actually look for those involved in HIPAA law, beacuse he will also likely be adept at his own state avenues for the private cause of action based on the same facts as the HIPAA violation.
As for asking for ID before handing out the Rx to the individual - I am finding no laws as to how they must ensure it ends up in the right hands (only that not doing so can land them a HIPAA charge and possibly worse) - however, if they know the person by sight, due to past dealings, that is usually the most typical basis. However, it is amazing that one can have a friend pick up the RX, the pharmacy does not know if the friend "really" has your permission to pick up... yet they hand it out all the time. The day will likely come when they get sued for a privacy violation when an ill-meaning "friend" with a vicodin addiction starts getting creative on how to obtain it in this way. But until then...
At the end of the day, if the woman is unhappy with her pharmacy and feels she can't trust its competence, - she may want to change pharmacies. Particularly if her medical/Rx information is very, very sensitive.
I hope this helps! My goal is to provide you with excellent and accurate service
- if you feel you have gotten anything less, please reply back, I am happy to address follow-up questions. Kindly rate me "excellent" when you are done. I look forward to assisting you in the future, should you have legal questions.