CHARLESTON – A medical administrator spent years secretly accessing a family’s medical records and “weaponizing” their private health information for a family dispute, according to a newly filed civil lawsuit.
The plaintiffs, identified only by their initials, filed the complaint July 23 in Kanawha Circuit Court against Sarah Gross, West Virginia University Medical Corporation and Charleston Area Medical Center. The plaintiffs are identified as M.B. and D.B. and their minor child A.B., all from Dublin, Ohio, as well as A.D., who lives in Hurricane.
Salango
“This was an intentional and egregious violation of my clients’ rights and trust,” said Ben Salango, who is representing the plaintiffs. “To have their personal and confidential information disseminated is devastating to them. Those responsible will be held accountable.”
Gross worked for WVU Medical Corporation in an administrative role from 2019 to 2021, according to the complaint, then as an ambulatory services director at CAMC from 2023 through 2025. During those years, the plaintiffs allege, she repeatedly accessed their protected health information in electronic medical record systems “with no work-related reason” and shared it with their elderly relative, identified only as M.F.
“In varying months throughout the calendar years of 2019, 2020, 2021, 2023, 2024 and 2025, defendant Sarah Gross utilized her employment … to improperly access plaintiffs’ private healthcare information (‘PHI’), as was stored and recorded by CAMC and WVU,” the complaint states. “Gross had no work-related reason to access plaintiffs’ PHI.
“Instead, defendant Sarah Gross utilized her employment… to review the private medical records of these Plaintiffs for personal gain.”
The lawsuit describes Gross as being in “a manipulative and emotionally abusive relationship” with M.F. and alleges she “weaponized information she gained from inappropriately accessing plaintiffs’ PHI as part of her efforts to isolate M.F. from her family … and gain full control M.F.’s healthcare and finances.”
Over roughly seven years, Gross allegedly checked when M.B., D.B. and their daughter had appointments and “would routinely provide any and all details that she could about these appointments by improperly accessing these plaintiffs’ medical records during and/or immediately after plaintiffs’ medical appointments.”
The complaint includes several pages of embedded screenshots of text message conversations that the plaintiffs say are between Gross and M.F.
One series of images shows Gross allegedly discussing an upcoming appointment for plaintiff A.D. and pressing M.F. to confront her.
“Anyone can give information if you just cannot receive,” Gross says in one message, also referencing HIPAA in the exchange.
Another screenshot shows a message from Gross that says “51 pounds” followed by a series of texts criticizing A.D.’s pregnancy weight gain. The complaint summarizes the exchange by alleging “Gross used any information she could to disparage plaintiff A.D. to third parties … such as plaintiff A.D.’s weight gain during her pregnancy.”
In another screenshot, Gross reacts to information about minor plaintiff A.B.’s medical care.
“I should call CPS,” Gross writes. “There is NO EXCUSE FOR IT.” She then tells M.F., “Well like I said you will have to assert some authority.”
Another screenshot shows Gross acknowledging she had been disciplined at work for accessing records.
“I got (in) trouble by my boss for accessing your record to get path and the genetic stuff,” the texts say. “I have to tell Bush that he asked me to look it up.”
The plaintiffs say this shows Gross was “open and obvious regarding her improper requests for details regarding plaintiffs’ PHI.”
The plaintiffs say CAMC and WVU maintain audit trails that log every access to a patient’s PHI and are required by federal regulations to review those logs. They say the institutions “failed to recognize that an employee in an administrative position was consistently accessing the medical records of these plaintiffs, among others.”
The suit says plaintiff A.D. raised concerns with a WVU provider and that those concerns were recorded in her chart, but alleges WVU “did nothing” to address the concerns. A.D. felt “compelled to find a new healthcare provider that did not employ Defendant Sarah Gross.”
When the family later requested audit trails, CAMC allegedly provided logs showing Gross’s accesses “with no explanation or discussion of defendant Gross’s improper and illegal behavior,” while WVU sent letters acknowledging “multiple instances over a period of several years where defendant Sarah Gross improperly accessed Plaintiffs’ PHI” and stating it was “unable to verify a work-related reason for these accesses.”
In one exchange described in the complaint, Gross herself allegedly acknowledges that her actions violated federal privacy rules.
“During one of her exchanges with M.F., defendant Sarah Gross acknowledges that her actions have breached the privacy rules set forth in the Health Insurance Portability and Accountability Act (HIPAA),” the filing states.
The plaintiffs accuse the defendants of breach of confidentiality, invasion of privacy, negligence and negligent supervision. They seek economic and noneconomic damages.
They are being represented by Salango and Sarah Hunter of Salango Law in Charleston. The case has been assigned to Circuit Judge Dave Hardy.
Kanawha Circuit Court case number 26-C-875
