I've worked a bit in this space and while OP's friend has some evidence her data was accessed inappropriately, I've found that in most cases the person thinking their record was leaked actually just told people they should not have trusted about their health and that just got through the rumor mill.