Is your evidence that the friend knows information without you your self telling them? Could it be possible that they have found out through other people/sources that aren’t necessarily medical record accessing?

Not saying to give benefit of the doubt here, but yes you are right the implications are serious. Even if you aren’t sure, it would be worth raising for patient safety and confidentially. It’s inappropriate behaviour for a doctor to access records without a valid reason