Photo: sshepard / iStock / Getty Images
The Trump administration is requiring some of the nation’s largest hospitals to share detailed emergency room records, including personally identifiable information, with the Consumer Product Safety Commission (CPSC) and its private contractor, Konza Health. The federal agency, typically tasked with tracking and recalling dangerous consumer products, began pressuring hospital executives earlier this year to hand over medical records from all ER visits for various injuries, ranging from broken bones to vaccine reactions—even covering suicide attempts, according to documents, emails, and interviews reported by KFF Health News.
Hospital attorneys and industry experts have raised significant concerns about the CPSC’s legal authority to demand such data, its ability to protect patient privacy, and whether it has complied with federal requirements for public notice and comment before expanding its surveillance system. The CPSC formally announced the new program on July 21, but did not address the extent of the data being requested or the widespread alarm among hospital leaders.
A CPSC spokesperson stated the agency is “modernizing” its injury surveillance system and confirmed that, although participation in the previous National Electronic Injury Surveillance System (NEISS) was voluntary, the new initiative requires at least 100 hospitals to send unredacted patient records to Konza Health by the end of the year. In communications, both the CPSC and Konza described participation as “mandatory,” asking hospitals to provide names, addresses, diagnoses, and other sensitive details.
Several health systems—including Mass General Brigham in Boston, Henry Ford Health in Detroit, and Harborview Medical Center in Seattle—have declined or questioned participation, citing patient privacy and legal obligations.
The CPSC has not provided a public comment period as required by law before collecting private information from multiple hospitals. Federal public health authorities cannot legally mandate private hospitals to share this type of data, and the agency’s own manual previously instructed hospitals not to report personally identifiable information except in rare cases.
The move comes after President Donald Trump dismissed the CPSC’s three Democratic board members, leaving the agency without a governing board and during a period of significant staff turnover. The administration has also sought broader access to Americans’ health data through other agencies, raising further concerns among privacy advocates.