I will be using the Tessa as the patient and my point of view as the friend working in the medical field.
I would inform Tessa that she needs to personally update her account. If she can not, it would be better for her to write an authorization letter wherein it will state that she is giving authority to me, her friend, to update her account in her behalf.
Having an authorization letter from the patient is sign that the patient is fully aware that her records will be seen and updated by me, the third person. Patient's authorization letter signifies that her patient privacy is still being protected because I only act in behalf of the patient limited to the actions authorized in the letter.
I can't automatically update my friends patient's account without her written consent or authorization letter because it will be a breach of protecting patient privacy.
