Does HIPAA allow use of last names only?

I work in an OR and have to submit a report to my purchasing department when we re-order lens implants which have been implanted into a patient. When I supply the lens info to purchasing I include the patient’s last name only so I will know that patients lens has been re-ordered.
I have now been reported to my compliance department for including information which can identify the patient! I do not include anything more than the last name and so therefore they have no idea exactly who that patient is. I have to go back to my surgery log and compare to that day’s surgery schedule for me to even find their full name!!
I have searched the web for a couple of hours now & have not been able to find any rules to reference in my defense. Please let me know if you know of any.
Thanks!

I have to close this thread because the OP seeks case-specific legal advice.

I suggest asking this question at http://www.lawguru.com or http://forum.freeadvice.com/ or http://attorneypages.com/ or, better yet, consulting an attorney who is licensed in your jurisdiction.

Gfactor
General Questions Moderator