your assistant should NEVER be refilling any medications unless it is on your direct order! that person is not qualified to do so. set up AC with different levels of user access, with password protection.
if your assistant is acting as your agent, to refill medications, you still need to document that the rx was done by a qualified person. your statement indicates a breakdown in documentation, security and chain of command in your office.
could your assistant be refilling medications for patients and/or others not known to you?
best if all rx's are done directly by a qualified person, faxed directly to the pharmacy.
additionally, refills should ideally be done at the visit, with enough medication to last until the next scheduled visit.
fix this ASAP or you're asking for trouble!