I'm wondering how all you guys handle this:
Sometimes, I have a secretary/assistant come in to pick up glasses, or check on the status for his/her boss. Or, boyfriend/girlfriend, etc.

Now, my understanding of HIPPA is that I cannot even verify that John Smith has been seen here unless you are John Smith, and I've verified two pieces of personal information (address, phone, etc.).
So, when someone comes in and asks to p/u glasses for John Smith, I ask, "are you his wife?" and they say, "no, I'm his assistant/secretary" I'm not sure what to do.
On one hand, they're just glasses, it's not like I'm dealing with HIV test results, here. I highly doubt that any information I know about their vision is information that they would consider secret.
On the other hand, it's illegal to even say he's a patient of ours! I mean, I don't mind husband/wife or parent/child, but boyfriends and employees? I don't want to be an inconvienence to these folks, but I also want to respect the patient's privacy. (When I worked at LC, I was instructed not to even talk with spouses of the patients about their glasses/prescription etc.)

How do you guys protect patient's rights without being an inconvienence?