If you know that a crime has been comitted, you can report it to the police. They will conduct an investigation, if warranted. You say, "friend" ?? The doctor should not release PHI to you while you conduct your own private investigation.
We do not have a client/attorney relationship until you make an appointment, we discuss your case face to face, I accept a retainer, and we explictly agree to enter into representation.
It is possible that the physician is obligated, particularly now that you have brought it to her attention.
In addition, if you have cause to believe a crime is occurring, you can also take the report forward to the police. If you have any doubts, seek legal advice from a local attorney.
I am licensed in New Mexico and Pennsylvania, and therefore any discussion of issues related to other states must considered within that context. In addition, my comments are not intended to create a legal representation but merely to respond to the limited facts presented by the question. Any opinion herein is not meant as a precise statement of legal rights or as a recommendation of any particular course of action. A more complete legal review can be obtained through local counsel.