A tiny, historically niche federal agency—the Consumer Product Safety Commission (CPSC)—is currently at the center of a brewing national controversy. Tasked with protecting the public from everyday hazards like malfunctioning coffeemakers and faulty lawnmowers, the agency has initiated a clandestine, aggressive push to secure the personally identifiable medical records of millions of Americans who visit hospital emergency rooms.
This move, which critics describe as an unprecedented overreach, has sparked intense alarm among hospital legal teams, privacy advocates, and industry experts. The program, which demands that medical institutions surrender detailed patient data—including names, addresses, and specific diagnostic codes—to a private contractor, has raised fundamental questions about patient privacy, the legal authority of the CPSC, and the potential weaponization of sensitive health information.
The Scope of the Data Grab
The CPSC’s new surveillance strategy represents a radical departure from its traditional, product-focused mission. Historically, the agency has relied on the National Electronic Injury Surveillance System (NEISS), a voluntary, de-identified reporting network that helps identify patterns in consumer product-related injuries.
Under the new directive, the agency is not merely seeking information on product-related mishaps. Documents and emails obtained by KFF Health News reveal an intent to collect records on nearly all emergency room visits, regardless of the cause. The data requested includes sensitive details on childhood vaccine reactions, psychiatric crises, and even suicide attempts.
According to an internal agency memo, the CPSC is demanding that at least 100 of the nation’s largest health systems begin transmitting these detailed records by the end of this year. To facilitate this massive data harvest, the CPSC has contracted with Konza Health, a Kansas-based organization that manages health data exchanges.
A Chronology of the Surveillance Shift
The shift toward this aggressive data collection began in the shadow of broader administrative changes. Following the firing of the CPSC’s three Democratic board members by the Trump administration, the agency entered a period of internal upheaval. During the first 16 months of this administration, nearly one in five career staffers departed, leaving the agency’s leadership in a state of flux.
- Fall 2024: The CPSC awarded a five-year contract worth approximately $15.9 million to Konza Health.
- Early 2025: Agency officials, including Chief Data Officer Elizabeth Puchek, began discreetly pressuring hospital executives to join the new surveillance program.
- February 2025: Acting CPSC Chairman Peter Feldman publicly signaled a pivot toward "AI-enabled workflows" and the expansion of digital infrastructure to handle a massive influx of electronic health records.
- March 2025: Konza representatives began sending "onboarding" letters to hospitals, explicitly labeling participation as "mandatory" or "required."
- July 2025: After being contacted by journalists regarding the program, the CPSC officially announced the existence of the surveillance system, while omitting the extent of the mandatory data demands and the growing resistance from hospital systems.
The Role of Private Contractors and AI
Central to the program is the CPSC’s reliance on Konza Health. While the agency has described this as a "modernization" of their surveillance capabilities, the move effectively outsources the handling of the nation’s most sensitive medical data to a private entity.
Konza Health has stated it will use "advanced analytic parsing and filtering" to process these records. However, the lack of transparency regarding the use of Artificial Intelligence (AI) has drawn sharp criticism. While agency spokespeople have acknowledged the move toward automation to reduce costs and human labor, former CPSC leadership has expressed concern that removing the "human element"—trained staff who understand the nuance of clinical injury reporting—will dilute the quality and reliability of the data collected.
Furthermore, the contractual nature of this arrangement is problematic. Unlike previous, voluntary iterations of injury reporting, the contract offered to hospitals contains no clear boundaries on what constitutes a reportable event. Whereas the CPSC’s own operating manual explicitly excludes injuries related to medical devices, illegal drugs, or natural occurrences like stingray contact, the contract with Konza appears to ignore these constraints, casting a wide net that captures thousands of diagnostic categories.
Official Responses and the "Information Blocking" Threat
The CPSC’s official stance, articulated by spokesperson Steve Roney, is that the agency is simply "modernizing" its surveillance to capture a more representative sample of injuries. Roney admitted that the previous voluntary system limited the "usefulness of the data," implying that mandatory participation is necessary for the agency’s objectives.
However, the agency’s methods of enforcement have been characterized as coercive. While federal public health authorities lack the statutory power to mandate that private hospitals report general patient data, CPSC officials have hinted that hospitals failing to comply could face scrutiny under "information blocking" regulations—a federal standard designed to prevent the withholding of interoperable health data.
This has placed hospital administrators in a precarious legal position. They are being pressured to comply with a federal agency’s demands while simultaneously facing potential violations of the Health Insurance Portability and Accountability Act (HIPAA), which governs the protection of patient privacy.
Legal and Ethical Implications
The legal foundation for this program is remarkably thin. Federal law mandates that the CPSC provide a public notice and comment period before collecting information from 10 or more entities. To date, the agency has failed to follow this procedure, even as it has approached dozens of hospitals.
Sharona Hoffman, a professor of health law at Case Western Reserve University, has labeled the initiative "troubling." The primary concern, according to Hoffman, is that the involvement of a private contractor introduces significant risks. When identifiable information—names, addresses, and detailed diagnoses—leaves the secure environment of a hospital, the potential for data breaches or misuse for commercial purposes increases exponentially.
The CPSC has a documented history of privacy lapses. Between 2017 and 2019, the agency improperly released the personal health information of approximately 30,000 individuals. Critics argue that expanding this collection to a massive, nationwide scale while relying on third-party contractors creates a high-stakes liability that the agency is ill-equipped to manage.
The Broader Context of Data Surveillance
This program is not occurring in a vacuum. It is part of a broader pattern within the current administration to gain unprecedented access to the medical records of American citizens. The Office of Personnel Management (OPM) has recently sought to acquire the health data of federal workers, and Health and Human Services Secretary Robert F. Kennedy Jr. has utilized private organizations to aggregate medical records for research into vaccine-related injuries and autism.
For many hospitals, the risk is simply too high. Institutions such as Mass General Brigham in Boston have formally declined to participate, citing their primary duty to protect patient privacy. Others, like the Mayo Clinic and the Cleveland Clinic, have remained tight-lipped, likely weighing the risks of federal pressure against the potential for public and legal backlash.
Conclusion: A Question of Trust
The CPSC’s pivot from regulating lawnmowers to monitoring the private medical records of millions of citizens represents a significant shift in the relationship between the federal government and the healthcare industry. By bypassing traditional oversight, ignoring public notice requirements, and pressuring hospitals to provide identifying data, the agency has placed itself in the crosshairs of a national debate over surveillance.
As hospitals continue to resist or comply, the ultimate question remains: Does the need for more efficient injury surveillance outweigh the fundamental right of a patient to have their most intimate medical history kept private? With no clear answer from the agency and growing skepticism from the medical community, this "modernization" effort is set to remain a focal point of legal and ethical scrutiny for the foreseeable future.
