CPSC emergency-room data push sparks privacy alarm over millions of identifiable records

The United States Consumer Product Safety Commission is pressing hospitals to provide detailed emergency-room records, including names, addresses, diagnoses and other identifying information, as part of an overhaul of the federal system used to detect dangerous consumer products. The records would initially be collected and analyzed by KONZA Health, a Kansas-based health information exchange that received a five-year federal contract worth up to $15.9 million. The Consumer Product Safety Commission says the redesigned system will identify emerging hazards faster, expand injury surveillance across all 50 states and remove unnecessary identifiers before information reaches the agency. Hospital executives, health-law specialists and former agency officials are nevertheless questioning whether the requested data are broader than necessary, whether participation can legally be described as mandatory and whether patients have received adequate protection against misuse or exposure.

The dispute concerns the National Electronic Injury Surveillance System, which has helped regulators identify patterns involving products such as toys, furniture, power tools and household appliances for more than five decades. The existing program relies on trained workers reviewing emergency-department records and coding injuries associated with consumer products, generally without routinely transmitting direct patient identifiers. The Consumer Product Safety Commission says that paper-era structure is slow, labor-intensive and geographically incomplete, with roughly 70 of more than 5,000 hospital emergency departments represented in the current sample.

Under the replacement system, known as National Electronic Injury Surveillance System Remodel, KONZA Health would connect electronically with participating hospitals and process substantially larger volumes of medical information. An internal agency memo reviewed by KFF Health News indicated that the government wanted at least 100 hospitals sending records by the end of 2026, while the agency’s July 22 announcement said the modernized network was expected to become fully effective at the beginning of 2027.

How the new federal injury-surveillance system would transform hospital reporting

The original National Electronic Injury Surveillance System was designed in 1972, when medical records were predominantly maintained on paper. Participating hospitals employ staff members or approved contractors to review selected emergency-department cases, identify possible consumer-product involvement and enter coded information into a secure federal system. The approach gives regulators a statistically representative sample but requires extensive manual work and can delay recognition of uncommon or rapidly emerging hazards.

The Consumer Product Safety Commission argues that electronic health-record connections would improve geographic representation, accelerate data analysis and reduce the burden on hospital workers. The agency says the new platform will transmit information through a federally designated Qualified Health Information Network, use standardized security safeguards and support de-identification before records reach the commission itself.

KONZA Health would occupy a critical position between hospitals and the federal regulator. The organization operates health-data exchange services and has been designated to facilitate nationwide medical-information sharing. Under the commission’s plan, KONZA would receive identifiable records, apply filters and remove names, addresses and medical details considered unnecessary before transmitting information to the government. The federal contract reportedly prohibits KONZA from selling the records or using them for marketing.

Automation could help regulators recognize patterns that manual reporting misses. A cluster of burns linked to a new appliance, falls involving a particular piece of furniture or injuries connected with an imported toy could appear across several hospitals before any one institution recognizes a national problem. Faster aggregation could therefore support earlier warnings, investigations and recalls.

The scale of the proposed collection creates the central controversy. KFF Health News reported that hospital correspondence contemplated pulling records connected with more than 10,000 diagnostic conditions, including many visits that may have no meaningful relationship to a consumer product. The reported list included injuries involving vaccine exposure and contact with stingrays, even though vaccines and wild animals generally fall outside the Consumer Product Safety Commission’s core jurisdiction.

KONZA Health said it would not use artificial intelligence to process the records, describing its approach as advanced parsing and filtering. That statement sits beside earlier comments from acting Consumer Product Safety Commission Chairman Peter Feldman, who said the agency was investing in artificial-intelligence-enabled workflows and infrastructure capable of processing a much larger volume of electronic health records. The distinction may reflect different components of the system, but greater technical transparency would help hospitals understand exactly how records will be selected, classified and discarded.

Why identifiable emergency-room records have triggered a hospital privacy backlash

The existing surveillance program has generally limited direct patient identifiers because the commission’s primary need is to understand how an injury occurred and which product may have been involved. According to the agency manual reviewed by KFF Health News, hospitals were instructed not to include information such as names, birth dates or addresses in ordinary reports. Identifying information was typically requested only for follow-up investigations, which reportedly represented fewer than 1% of cases.

The new model reverses that sequence. Instead of hospitals removing identifiers before reporting relevant cases, KONZA Health would initially receive broader medical records and decide which information should be removed before data reach the commission. Privacy concerns therefore exist even when the federal agency ultimately receives a de-identified record, because the contractor would have temporary access to identifiable health information during collection and processing.

The Department of Health and Human Services says hospitals and their business associates must limit health-information disclosures to the minimum necessary for the intended purpose and maintain safeguards against improper access or use. Contractors handling protected medical information must also comply with contractual restrictions and applicable provisions of the Health Insurance Portability and Accountability Act’s Privacy and Security Rules.

A larger dataset creates a larger consequence if access controls fail. Emergency-room records can contain information about mental-health crises, suicide attempts, domestic violence, substance use, reproductive care, childhood injuries and other highly sensitive circumstances. Even when a record is retained for only 30 days, a breach, unauthorized download or incorrectly configured connection could expose information that cannot be made private again.

The commission has previously faced a serious health-data incident. KFF Health News reported that the agency improperly disclosed personal health information involving approximately 30,000 people between 2017 and 2019. That history does not prove that the redesigned platform will be insecure, but it strengthens demands for independent security testing, detailed retention limits and clear responsibility if a contractor or federal system exposes patient information.

Several major health systems have resisted or questioned the initiative. Mass General Brigham declined to participate, citing patient privacy, while Harborview Medical Center said its longstanding reporting had been voluntary and based on de-identified information. Mary Greeley Medical Center in Iowa signed an agreement but was reportedly reassessing its participation after learning that previous federal support for the work was no longer available.

The resistance is significant because the system depends on cooperation from geographically diverse hospitals. If institutions with experienced legal, privacy and cybersecurity departments decline to participate, the resulting network could become less representative than intended. The commission could then gain more data overall while still failing to achieve the balanced national sample it says the modernization requires.

HIPAA and information-blocking rules leave the legal obligation disputed

The Consumer Product Safety Commission identifies itself as a federally recognized public-health authority and argues that the Health Insurance Portability and Accountability Act permits hospitals to disclose protected health information for authorized public-health purposes without individual patient consent. The agency also points to federal information-blocking regulations, saying healthcare organizations must make electronic health information available to public-health authorities upon request unless a documented exception applies.

That position does not automatically resolve whether every requested field is necessary or whether the agency can compel every private hospital to participate. The Health Insurance Portability and Accountability Act permits certain public-health disclosures, but permission to disclose information is not necessarily the same as a blanket federal command requiring the transfer of all emergency-room records. Hospitals must still consider whether the recipient is legally authorized to collect the information and whether the scope satisfies minimum-necessary principles.

The information-blocking argument is equally contested. Those rules were principally designed to prevent healthcare providers and technology companies from unreasonably interfering with access to electronic health information. Hospitals and legal specialists are questioning whether the regulations can be used to transform a historically voluntary surveillance partnership into mandatory disclosure of identifiable records to a federal contractor.

The terminology used in communications has added to the uncertainty. KONZA representatives reportedly described participation as required or mandatory, while Consumer Product Safety Commission officials advised hospitals that they would need to document an exception if they refused. At the same time, an agency spokesperson did not directly say that the commission would file enforcement complaints against institutions that declined.

There is also a procedural question under the Paperwork Reduction Act. The federal government generally must provide public notice and seek comment before imposing certain information collections on 10 or more entities. The commission completed a public-comment process for an extension of the established National Electronic Injury Surveillance System in 2025, describing that program as voluntary. KFF Health News reported that the agency had not completed a comparable public process for the substantially redesigned collection before approaching more than a dozen hospitals.

The commission’s July 22 announcement emphasized privacy protections, nationwide representation and faster hazard detection, but did not directly address the reported hospital objections or clarify whether institutions can decline without penalty. A formal rulemaking or detailed public guidance could reduce the disagreement by stating the legal authority, required data fields, exclusion criteria, retention schedule and appeals process.

CPSC must prove that collecting more medical data will produce safer products

The policy objective behind the modernization is legitimate. Consumer-product regulators need timely information to identify dangerous goods before injuries multiply, and electronic reporting can provide faster and broader evidence than a small manual sample. Delaying recognition of a defective product can leave families exposed and increase the eventual cost of recalls, litigation and medical treatment.

The unresolved issue is proportionality. A program designed to identify injuries caused by toys, appliances or furniture does not obviously require every detail from every emergency-room visit. Collecting broad records first and filtering later may be technically convenient, but convenience alone does not establish that the approach is legally necessary or ethically preferable.

The strongest version of the system would apply product-related filters within the hospital or trusted exchange before identifiable information leaves the clinical environment. Direct identifiers could be withheld by default and released only when the commission opens a specific follow-up investigation supported by a documented safety need. That structure would preserve the speed of electronic reporting while reducing the number of people and systems exposed to complete patient records.

The government should also publish independent security assessments, audit requirements, breach-notification procedures and statistics showing how many records are received, rejected, retained and transmitted to the agency. Hospitals need the ability to verify that KONZA Health is deleting unnecessary information on schedule rather than relying solely on contractual assurances.

Congressional oversight may become necessary if the commission continues treating participation as effectively compulsory. Lawmakers could clarify whether the Consumer Product Safety Commission qualifies for mandatory access under information-blocking rules, define the medical information it may collect and require privacy reporting to Congress and the public.

The controversy does not require choosing between consumer safety and medical privacy. A modern injury-surveillance system can advance both, but only when the government demonstrates that each collected field serves a defined safety purpose and that less intrusive alternatives would not work. Until those questions are answered, the push for identifiable emergency-room records risks weakening hospital cooperation and public trust in the very surveillance system intended to protect patients.

Key takeaways from the federal push for identifiable emergency-room records

• The Consumer Product Safety Commission is replacing its decades-old injury-monitoring program with a nationwide electronic system intended to identify dangerous consumer products faster.
• KONZA Health received a five-year contract worth up to $15.9 million to collect and process hospital emergency-room records before relevant information is sent to the federal agency.
• Hospital correspondence reviewed by KFF Health News indicated that the requested records could include names, addresses, diagnoses and other directly identifying information.
• The commission says the new system will remove unnecessary identifiers before data reach the agency and will use federally recognized health-information networks and security controls.
• The privacy concern remains significant because KONZA Health would initially receive identifiable medical information, even when the commission ultimately receives de-identified records.
• The reported collection may include more than 10,000 diagnostic conditions, some of which appear unrelated to products regulated by the Consumer Product Safety Commission.
• Several hospitals have questioned or rejected participation, including Mass General Brigham and Harborview Medical Center, citing privacy or legal concerns.
• Federal health-privacy rules permit certain disclosures to public-health authorities, but hospitals and legal specialists dispute whether those provisions make the broad new reporting program mandatory.
• The commission has pointed to information-blocking regulations, while critics argue that rules intended to promote health-data access may not authorize unlimited federal collection.
• The modernization could improve consumer safety, but public confidence will depend on strict data minimization, independent security audits, transparent legal authority and meaningful hospital oversight.