Family says woman violated HIPAA, ‘weaponized’ info
A civil lawsuit filed in West Virginia alleges that a medical administrator named Sarah Gross repeatedly accessed a family's private health records without authorization over several years, then used that information against them in a personal family dispute. The plaintiffs, unnamed in the complaint, are suing Gross and West Virginia University Medical Corporation.
Why this matters: This is what insider access abuse actually looks like. Not a hacker, not a foreign actor — just someone with a login and a personal grudge. Medical records contain some of the most sensitive information people have, and healthcare workers routinely have access to far more than they need. When that access gets used as a weapon in a private dispute, the damage is personal and lasting. The employer here faces real questions too. Years of unauthorized access should not go undetected. If it does, the institution is part of the problem.
Who should care: Lawyers · Privacy officers · Compliance · Healthcare professionals
This summary is AI-assisted and may contain errors. It is an original briefing to help you gauge significance quickly — not a reproduction of the source. Always read the linked original before relying on it. See our methodology.