Case Overview: A civil lawsuit alleges a West Virginia medical administrator spent years secretly accessing a family's private health records and using that information as a weapon in a personal dispute.

Consumers Affected: Members of a family whose medical records were allegedly accessed without authorization by a healthcare employee

Court: Kanawha Circuit Court, West Virginia

West Virginia Family Sues Medical Administrator for Allegedly Accessing and 'Weaponizing' Private Health Records

A West Virginia family says a hospital employee spent years secretly viewing their confidential medical records and using the sensitive information against them in a personal dispute, according to a newly filed civil lawsuit.

The plaintiffs, identified in court documents only by their initials, filed the complaint July 23 in Kanawha Circuit Court against Sarah Gross and West Virginia University Medical Corporation. According to reporting from Databreaches.net, the lawsuit alleges Gross used her position as a medical administrator to gain unauthorized access to the family's health records over an extended period of time.

Lawsuit Alleges Years of Unauthorized Record Access

According to the complaint, Gross allegedly exploited her role within the West Virginia University Medical Corporation to repeatedly access the plaintiffs' private medical files. The lawsuit alleges this was not a one-time incident but rather a sustained pattern of unauthorized intrusions into confidential health information.

The filing alleges that Gross then used the private medical details she obtained to "weaponize" that information against the family, reportedly in connection with an ongoing personal dispute. The lawsuit does not describe the nature of that dispute in detail, according to available reporting.

HIPAA and the Right to Medical Privacy

At the heart of the lawsuit are allegations that Gross violated the Health Insurance Portability and Accountability Act, commonly known as HIPAA — the federal law that governs the privacy and security of patients' protected health information.

HIPAA generally prohibits healthcare employees from accessing patient records without a legitimate work-related purpose. According to the U.S. Department of Health and Human Services, individuals who improperly access or disclose protected health information can face both civil and criminal penalties.

The lawsuit alleges that Gross had no legitimate medical or administrative reason to access the plaintiffs' records, and that her access was entirely personal in nature. The complaint also names West Virginia University Medical Corporation as a defendant, which may suggest the plaintiffs are alleging the institution bears some responsibility for the alleged breach, though the specific theories of liability against the organization have not been fully detailed in available reporting.

The Harm of 'Weaponized' Medical Information

Medical records can contain some of the most sensitive personal details in a person's life — diagnoses, mental health history, medications, reproductive health, and more.

When that information is accessed without authorization and allegedly used to harm someone in a private dispute, the consequences can extend well beyond a technical privacy violation.

The lawsuit alleges the family suffered harm as a result of Gross's alleged conduct, though the specific damages being sought were not detailed in the reporting available at the time of publication.

Cases like this one illustrate a broader concern in healthcare privacy: insider threats. While much attention focuses on external data breaches and cyberattacks, the HHS Office for Civil Rights has consistently noted that unauthorized access by employees remains a significant source of HIPAA violations.

Defendant's Response

No public response from Sarah Gross or West Virginia University Medical Corporation was available at the time of publication.

Similar Cases Highlight Insider Access Risks

Lawsuits involving healthcare employees who allegedly accessed patient records for personal reasons have appeared in courts across the country in recent years. These cases often involve employees who looked up records of neighbors, former partners, family members, or others with whom they had personal relationships. Such circumstances, if proven, represent a clear departure from the permitted uses of protected health information under federal law.

Lawsuit: Plaintiffs (identified by initials) v. Sarah Gross and West Virginia University Medical Corporation

Case Number: Not publicly reported at time of publication

Court: Kanawha Circuit Court, West Virginia

Plaintiffs' Attorney(s): Not reported at time of publication