CPSC orders 100 hospitals to send identifiable ER records

The Consumer Product Safety Commission once told hospitals not to include names or birthdates in routine case reports, yet it's now telling at least 100 hospitals to send full, identifiable emergency room records to a private contractor by year end. The shift was announced publicly on July 21 after KFF Health News asked the agency about a new surveillance system that would centralize millions of ER visits. Internal emails and a CPSC memo obtained by KFF show the contractor, Konza Health, told hospital leaders participation was "mandatory" and CPSC officials initially requested names, addresses and diagnoses. Hospitals, privacy experts and lawyers say the demand raises legal and privacy red flags.

What exactly is CPSC asking hospitals to send?

CPSC has asked hospitals to provide full, identifiable ER case records covering a wide array of injuries, from broken bones to vaccine reactions and suicide attempts. Those records are to be sent to Konza Health, a private contractor, for analysis. Internal emails and an agency memo obtained by KFF Health News show Konza told hospital leaders that participation was "mandatory" or "required," and a CPSC official explicitly requested names, addresses, diagnoses and other personal details. Konza's president and CEO, Laura McCrary, told KFF the company would remove names, addresses and medical details "not needed by CPSC" before sharing records with the agency, though the documents show the agency initially insisted on identifiable fields.

The agency's internal memo sets a target of enrolling at least 100 hospitals to begin sharing detailed ER records by the end of this year. That goal, if met, could sweep millions of Americans' medical records from routine emergency department visits into a central database for analysis. The initiative is described inside the agency as a modernization of CPSC's injury surveillance, but the documented scope covers tens of thousands of conditions and would pull records from routine ER care, not only follow-up investigations. The demand was announced publicly on July 21 after KFF Health News raised questions about the new system.

Sharona Hoffman, a professor of health law at Case Western Reserve University, told KFF Health News, "The whole thing is troubling," and warned that giving a private firm access to a wide swath of identifiable medical data creates serious risks for patient privacy. Hospital attorneys have questioned whether the CPSC has the statutory authority to demand such records, whether federal privacy laws are being respected, and whether the agency completed required rulemaking or legal procedures before changing reporting practices. The concern is heightened because CPSC's operating manual previously instructed hospitals to omit identifying information in routine case reports and only collect identifiers for rare follow-up investigations.

The push comes after major leadership changes at CPSC, including the firing of its three Democratic board members and a wave of career staff departures. KFF Health News's analysis showed nearly one in five career employees left the agency in the first 16 months of the current administration. Those personnel shifts accompany wider administration efforts to seek expanded access to medical records elsewhere in government, which adds to legal and policy scrutiny of the program.

Some health systems have declined to participate. Mass General Brigham said it refused to provide the records, with spokesperson Kelly Mitchell stating the system wouldn't share medical records to protect patient privacy. Konza Health's Laura McCrary told KFF Health News the company would strip certain identifying and medical details "not needed by CPSC" before passing records along to the agency. The documents and emails obtained by KFF, however, show CPSC officials initially insisted hospitals include identifiable fields, creating a mismatch between the agency's request and Konza's public assurance.

What procedural milestone should readers watch?

The clearest near-term deadline in the documents is the internal memo target that at least 100 hospitals begin sending detailed ER records by the end of this year. That enrollment goal will be the first concrete test of how many hospitals comply and how many patients' identifiable records enter the centralized system.

Related Articles

• Casely reannounces Power Pods recall after fatal blast

The agency set a concrete deadline: the internal memo aims for at least 100 hospitals to start sending detailed, identifiable ER records by the end of this year. Originally reported by kffhealthnews.org.

This article was created with AI assistance.