Hospitals Push Back as Consumer Agency Demands Emergency Room Records

Quietly and over several months, the Consumer Product Safety Commission has pressed some of the largest health systems in the United States to hand over identifiable emergency room records covering every patient who seeks care, a demand hospital lawyers say rests on shaky legal ground. Reporting published Monday by KFF Health News, and carried by CNN and U.S. News and World Report, detailed a pressure campaign that began early this year and became public only this week, after journalists started asking the agency questions.

According to an internal memo cited by KFF Health News, the commission wants at least 100 hospitals transmitting detailed patient files to a private contractor by the end of 2026. Records sought include names, addresses, birthdates and diagnoses, spanning more than 10,000 diagnostic codes. Several of those codes describe conditions with no connection to consumer products, including reactions to childhood vaccines and injuries from contact with stingrays, neither of which falls within the commission's regulatory remit.

From Voluntary Sampling to Blanket Collection

For five decades the agency has tracked product injuries through the National Electronic Injury Surveillance System, a voluntary network of roughly 100 emergency departments. Trained hospital staff report injuries tied to consumer products, and the data is almost always stripped of identifying detail before it reaches the government. Commission guidance instructs participating hospitals to withhold identifiable information except in the small share of cases, fewer than 1 percent, that trigger follow-up investigations. That sampling architecture has underpinned decades of recalls and safety standards, from crib design rules to warnings about button batteries, precisely because hospitals trusted that patient identities stayed out of federal hands.

Under the new arrangement, that structure would be inverted. Complete records of all emergency visits would flow automatically to the contractor, regardless of whether any consumer product was involved. Categories the old system deliberately excluded, among them injuries from food, illegal drugs, medical devices and adult suicide attempts, would enter the new pipeline alongside everything else.

Acting Chairman Peter Feldman signaled the direction in February, telling a trade event the agency was, in his words, "investing in AI-enabled workflows" for injury surveillance, KFF Health News reported.

Hospitals Question the Legal Basis

Resistance has been swift and broad. Mass General Brigham in Boston and Harborview Medical Center in Seattle have declined to participate, and Henry Ford Health in Detroit has raised questions rather than sign on, according to the KFF Health News investigation. Institutions approached but uncommitted include the Mayo Clinic, Cleveland Clinic, Yale New Haven Hospital, Nationwide Children's Hospital in Ohio, Baylor Scott and White Health in Texas, St. Luke's in Boise and Sanford Health in Sioux Falls. One confirmed participant has emerged so far: Mary Greeley Medical Center in Ames, Iowa, which signed an agreement in April.

Hospital counsel have flagged potential conflicts with HIPAA, the federal privacy law that tightly restricts disclosure of patient information. They have also questioned whether the commission satisfied the Paperwork Reduction Act, which requires public notice and a comment period before a federal agency collects information from ten or more entities. Agency spokesperson Steve Roney acknowledged to KFF Health News that the required notice has not yet been issued, while describing the effort as a modernization of surveillance.

Alexander Hoehn-Saric, who chaired the commission until President Donald Trump removed him, told the outlet he saw no authority for the demand, saying of the approach to hospitals, "I really don't understand the basis for that."

Elizabeth Puchek, the agency's chief data officer, has taken a firmer line, telling health systems that institutions unwilling to participate must formally seek an exemption, a framing that treats compliance as the default rather than a choice.

Contractor at the Center of the Pipeline

Patient data would flow not to the government directly but to Konza Health, a Kansas-based operator of that state's health information exchange. Konza won a five-year contract worth up to $15.9 million in the fall of 2025 to build and run the system. Its chief executive, Laura McCrary, has described hospital participation as required, echoing the agency's own language, per KFF Health News.

Konza says it will strip names, addresses and other unneeded fields before passing records to the commission, and that it will retain the underlying data for a minimum of 30 days. Privacy scholars remain unpersuaded that a private intermediary cures the problem. Sharona Hoffman, a professor of health law at Case Western Reserve University, told KFF Health News, "The whole thing is troubling," warning that organizations holding condition-level data frequently find commercial uses for it.

Track Record Colors the Debate

Skepticism inside hospital compliance offices is informed by history. Between 2017 and 2019, the commission improperly released personal health information belonging to roughly 30,000 people, an episode that involved a far smaller dataset than the one now envisioned. Millions of emergency room records would move through the new system each year if the agency reaches its 100-hospital target, multiplying the potential fallout from any breach or mishandling.

Health systems also face their own exposure. Turning over identifiable records without clear legal authorization could put hospitals in violation of federal privacy rules and state medical confidentiality statutes, several industry experts told KFF Health News, leaving institutions caught between a federal agency's insistence and their own obligations to patients.

Pattern Extends Beyond One Agency

Consumer safety regulators are not acting in isolation. The Office of Personnel Management has sought health data from federal workers, and Health Secretary Robert F. Kennedy Jr. has enlisted a private organization to assemble records related to vaccines and autism, KFF Health News noted, placing the commission's effort within a broader administration push to centralize sensitive medical information.

What happens next will likely be decided in legal memos rather than press conferences. Hospitals that declined are waiting to see whether the agency attempts to compel participation, and any move to enforce the demand without completed notice-and-comment procedures would invite litigation. Congress could also weigh in, since lawmakers of both parties have historically guarded the surveillance system's anonymized design. For now, the standoff leaves one of Washington's smallest regulators asserting one of its largest claims to Americans' private health data, with the country's biggest hospital networks refusing to blink.