The Consumer Product Safety Commission is pressing emergency rooms nationwide to surrender detailed, personally identifiable medical records through an automated extraction system, and hospitals that refuse are being told compliance is "mandatory."
The federal agency, historically tasked with keeping dangerous toasters and cribs off store shelves, has begun instructing hospitals to open their electronic health record systems to Konza Health, a private contractor building an automated pipeline that would vacuum up patient data covering more than 10,000 diagnostic conditions. The effort, USA Today reported, replaces a decades-old voluntary reporting program with something far broader, and far less transparent.
CPSC and Konza officials have told hospital executives that participation is not optional, hinting at regulatory penalties for any system that declines. Several major health systems have already pushed back or refused outright. The agency's goal: bring 100 facilities into the network by the end of the year.
For years, CPSC tracked product-related injuries through the National Electronic Injury Surveillance System, known as NEISS. Under that program, hospital staff reviewed emergency room records and submitted data tied specifically to consumer product safety, a defective high chair, a malfunctioning space heater, a recalled toy. The network covered roughly 100 emergency departments selected by the agency. Staff chose which records to flag. The process was manual, limited in scope, and voluntary in practice.
The new system works differently. Konza Health's automated platform would extract electronic health records directly, without the human filter that kept the old program tethered to product-safety cases. The scope now stretches across more than 10,000 diagnostic conditions, a category so broad it could encompass virtually any reason a patient walks into an ER.
That shift raises an obvious question: why does an agency built to regulate consumer products need access to records covering conditions that have nothing to do with a defective blender or a faulty car seat?
The initiative's reach extends nationwide, but Washington, D.C., offers a sharp illustration of the stakes. MedStar Washington Hospital Center, George Washington University Hospital, Howard University Hospital, and Children's National all operate high-volume emergency departments in the District. A single D.C. emergency room can handle upwards of 70,000 patient visits a year. Multiply that across four major facilities, and the volume of identifiable records potentially flowing to a federal contractor becomes staggering.
Whether any of those four hospitals currently belong to the NEISS network, or have been contacted about the new system, remains unclear. The agency has not publicly identified which facilities received its instructions. KFF Health News, which conducted the original investigation, reported that CPSC's outreach has included "some of the nation's largest urban and rural health systems."
For patients in the capital and across the country, the practical concern is straightforward. A trip to the ER for a broken arm, a panic attack, or a child's allergic reaction could generate a record that ends up in a federal contractor's database, with the patient's name attached.
CPSC and Konza officials reportedly told health executives that participation is "mandatory" and suggested that hospitals refusing to cooperate could face regulatory consequences. But the agency has not publicly identified which statute or regulation gives it the authority to compel hospitals to hand over patient records wholesale through an automated third-party system.
The reporting references federal laws requiring public notice before the government collects data on this scale. Whether CPSC followed those requirements, or bypassed them, is an open question the agency has not answered. No legal challenge has been reported so far, but the gap between what the agency is demanding and what it has publicly justified is wide enough to draw scrutiny from both privacy advocates and hospital administrators.
The Trump administration has faced persistent media focus on health-related matters, from the president's recent Walter Reed physical to broader questions about federal health policy. But the CPSC initiative raises a different kind of concern, not about any one person's medical records, but about whether a small federal agency can quietly build a pipeline to millions of them.
Several major health systems have pushed back. Their specific objections have not been made public, and the names of the resisting systems remain unreported. That silence itself is telling. Hospitals weighing whether to fight a federal agency's demands rarely advertise the dispute while it is still unfolding.
Basic facts about the arrangement remain missing from the public record. When did CPSC sign its contract with Konza Health? What are the terms? How long will patient records be retained, and who at Konza will have access? None of these questions have been answered publicly.
No named CPSC official has stepped forward to defend the initiative on the record. No Konza Health executive has been identified by name in connection with the program. The agency appears to be operating behind closed doors, pressing hospitals to comply while avoiding the kind of public accounting that a data-collection effort of this magnitude would normally require.
The pattern is familiar in Washington. An agency expands its reach, a contractor gets a lucrative deal, and the people whose data is at stake, in this case, millions of emergency room patients, learn about it last, if they learn about it at all. The same dynamic has played out in debates over politicians' own health disclosures, where transparency is demanded of individuals but rarely imposed on the bureaucracies collecting the data.
Health systems now confront an uncomfortable decision. Comply, and they hand over identifiable patient records to a federal contractor under terms the public has not seen, potentially violating the trust patients place in their hospitals. Refuse, and they risk whatever penalties CPSC has hinted at, penalties the agency has not spelled out.
The stakes are especially acute for children's hospitals. Children's National in Washington treats some of the most vulnerable patients in the region. Parents who bring a child to the ER for a fall off a bicycle or a reaction to a medication did not consent to having that visit logged in a federal database accessible to a private company.
Lawmakers who have spent years demanding health transparency from political figures have been notably quiet about whether ordinary Americans deserve the same protections when a federal agency comes for their records. That silence deserves attention.
The CPSC's stated mission is consumer product safety. Monitoring whether a space heater causes burns or a crib rail collapses is a legitimate function. But an automated system that sweeps up records across more than 10,000 diagnostic conditions, from chest pain to mental health crises to substance abuse, goes well beyond that mission. It looks less like product-safety monitoring and more like a federal health surveillance apparatus assembled without public debate.
Congress has oversight authority over CPSC. Lawmakers can demand the contract with Konza Health, the legal basis for the "mandatory" participation claim, the data-retention policies, and the privacy safeguards, or lack thereof, built into the system. So far, no congressional inquiry has been reported.
Hospital associations, state attorneys general, and patient-privacy organizations all have standing to ask hard questions. Whether they will remains to be seen. The fact that media attention to health-related controversies tends to focus on political figures rather than systemic policy changes means initiatives like this one can advance quietly for months before the public catches on.
The CPSC has not explained why it needs identifiable records rather than anonymized data. It has not explained why automated extraction replaced a voluntary system that functioned for decades. It has not named the officials who approved the shift or the legal authority they relied on. And it has not told the American public that their next trip to the emergency room could feed a federal database they never agreed to join.
When a government agency operates in the dark, collects personal data without public notice, and tells the institutions holding that data they have no choice but to comply, the burden of proof falls on the agency, not the patients whose records are at stake.