I was always under the impression that only "licensed" persons had the authority to do this
Is this in the United States? Medical records are protected under HIPPA, failure to comply with the law can lead to all sorts of trouble. Each and every person who has medical information in those files must have given them written consent to share that information with each and every person or organization they share it with. So each individual has to have signed a consent form to allow the secretary to handle the information. They must also have signed a consent form for whoever he's going to turn the files over to when needed. They also have to have signed a consent form for each and every individual or organization they intend to give the information to.
This could easily lead to massive lawsuits.