The Consumer Product Safety Commission is quietly pressing hospitals nationwide to hand over personally identifiable emergency room records through an automated system run by a private contractor, and officials have told health executives that participation is "mandatory."
The federal agency, which has long tracked product-related injuries through a voluntary reporting program, has shifted to a far broader data-collection model under a contract with Konza Health. Instead of hospital staff reviewing individual cases and submitting narrow, product-safety-specific information, the new system would automatically extract electronic health records covering more than 10,000 diagnostic conditions, USA TODAY reported.
That is not a tweak. It is a wholesale transformation of a decades-old injury-surveillance program into something that looks far more like mass medical-data harvesting, and several major health systems have already pushed back or refused to comply.
For years, the CPSC monitored consumer-product injuries through its National Electronic Injury Surveillance System, known as NEISS. The program relied on roughly 100 hospitals across the country. Staff at those facilities reviewed emergency room records, identified cases tied to consumer products, and submitted relevant data to the commission.
The system was voluntary. It was managed by human reviewers. And its scope was limited to product-safety concerns, the kind of information the CPSC was created to collect.
The new model works differently. Under its contract with Konza Health, the CPSC now seeks automated access to electronic health records spanning more than 10,000 diagnostic conditions. That reach extends well beyond anything tied to a defective toaster or a collapsing crib. CPSC officials have quietly instructed hospitals to supply detailed, identifiable health records, and both CPSC and Konza officials have told health executives that participation is "mandatory," with hints at regulatory penalties for hospitals that refuse.
The agency's stated goal is to bring 100 facilities into the network by the end of the year. Outreach has already included some of the nation's largest urban and rural health systems, according to a KFF Health News investigation that first exposed the initiative.
The initiative carries particular weight in Washington, DC, where high-volume emergency departments process enormous patient loads. MedStar Washington Hospital Center, George Washington University Hospital, Howard University Hospital, and Children's National all operate busy ERs in the capital. A single DC emergency department can handle upwards of 70,000 patient visits per year.
Whether any of those specific hospitals are part of the NEISS network, or have been contacted by CPSC or Konza, remains unclear. KFF Health News did not identify the hospitals participating in the program. But the sheer volume of patient data flowing through DC-area ERs means any mandate to share identifiable records would expose an enormous number of people, including federal employees, members of Congress, and their families.
That reality raises questions that go beyond privacy policy and into the realm of institutional power. A federal agency with automated access to millions of identifiable ER records holds leverage that no consumer-product regulator was ever designed to wield. When health information about public figures is already a subject of intense public interest, the stakes of a leaky or poorly governed data pipeline only grow.
Federal law requires public notice before the government begins collecting data on this scale. The USA TODAY report references those requirements but notes that the CPSC appears not to have followed them. The specific statutes at issue are not named in the reporting, and the CPSC has not publicly addressed the criticism.
That silence is itself a problem. An agency that wants to vacuum up identifiable medical records from emergency rooms across the country owes the public more than back-channel instructions to hospital administrators. The fact that the directive was delivered quietly, not through a formal rulemaking, not through a public announcement, but through private conversations with health executives, suggests the commission understood this would face resistance.
And it has. Several major health systems have pushed back or refused to comply. Which systems, and what consequences they may face, remain unanswered questions. So does the precise scope of the data being collected. The reporting describes "personally identifiable" records, but whether that includes names, dates of birth, home addresses, or other sensitive identifiers has not been specified.
Transparency about health-related matters in Washington is already a sore subject. A program that collects identifiable medical data without clear public disclosure only deepens the trust deficit.
The involvement of a private contractor adds another layer of concern. Konza Health holds the contract to operate the automated extraction system, and its officials have been part of the conversations telling hospitals that participation is mandatory. But the terms of that contract, when it was executed, what data-security provisions it includes, what limits govern Konza's access to the records, are not publicly known based on available reporting.
Handing a private company the keys to an automated pipeline of identifiable ER records from 100 hospitals is not a routine procurement decision. It is a policy choice with real consequences for millions of patients who walked into an emergency room expecting their medical information to stay between them and their doctor.
The CPSC has a legitimate mission: tracking injuries caused by consumer products and getting dangerous goods off the market. Nobody disputes that. But a program that started as targeted, voluntary, human-reviewed product-safety reporting has been transformed into something unrecognizable, bulk automated extraction of identifiable records across more than 10,000 conditions, run by a private contractor, with participation described as compulsory.
Even people who trust this administration's intentions should want clear answers about scope, safeguards, and legal authority. Medical emergencies are among the most vulnerable moments in any person's life. The records generated in those moments deserve more protection than a quiet phone call and a vague threat of penalties.
Good government means collecting only the data you need, telling the public you are doing it, and proving you can keep it safe. On all three counts, the CPSC has not yet made its case.
