This is what I do for a living. He will have to prove it was prescribed, not to his employer but to the Medical Review Officer (doctor who certifies the drug screen results).
Usually you can just give the MRO the name of the pharmacy where it was filled or the prescribing doctor and the MRO will call and verify. If it was given at the ER, it's the same process. Give the MRO the name of the doctor or the name of the ER and they will verify.
If it was a valid prescription, it comes back as negative. Depending on the levels in his system, it may be marked as safety sensitive. If there is no prescription, it's a positive test. If you try to dodge the MRO's calls, after 7 days (varies from place to place) it will be considered a non-contact positive.