CPSC Mandates Unredacted ER Data from 100+ Hospitals Without Public Comment, Igniting Legal Battle

For corporate counsel and compliance officers, the CPSC's expansion into compulsory medical data collection without public notice or clear statutory underpinning presents a high-stakes test of agency boundaries and patient privacy law. The failure to provide a mandated public comment period, combined with the mandatory sharing of unredacted patient data, may invite immediate litigation and set new precedents for federal data collection powers.

In an unprecedented expansion of its authority, the Consumer Product Safety Commission (CPSC) is compelling at least 100 U.S. hospitals to turn over unredacted, personally identifiable emergency room records to a private contractor, Konza Health, by the end of 2026. The move, publicly announced on July 21, 2026, marks a radical departure from the long-standing, voluntary National Electronic Injury Surveillance System (NEISS) and has ignited a firestorm of legal and privacy concerns among hospital executives and health law experts. The CPSC, which is statutorily charged with identifying and recalling hazardous consumer goods, contends it is merely “modernizing” its data collection. However, documents and interviews obtained by KFF Health News reveal the agency began pressuring hospital administrators earlier this year to comply, characterizing participation as “mandatory”—a characterization that raises fundamental questions about the agency’s statutory footing.

“

In an unprecedented expansion of its authority, the Consumer Product Safety Commission (CPSC) is compelling at least 100 U.S.

The scope of the data demand is staggering. Hospitals are expected to provide full medical records for all ER visits, including names, addresses, diagnoses, and details of injuries ranging from broken bones to vaccine reactions and even suicide attempts. This far exceeds the aggregated, anonymized data historically collected under NEISS, where a sample of hospitals voluntarily reported product-related injuries without exposing patient identities. The switch to mandatory, identifiable data collection, outsourced to a private entity, immediately triggers multiple federal compliance obligations. The CPSC appears to have sidestepped the public notice and comment process mandated by the Paperwork Reduction Act and other administrative law requirements when collecting personally identifiable information from ten or more persons. The absence of any public comment period is not merely a procedural lapse; it could invalidate the data collection effort and expose the agency to lawsuits under the Administrative Procedure Act.

Major health systems have already mounted direct refusals or expressed profound reservations. Mass General Brigham in Boston, Henry Ford Health in Detroit, and Harborview Medical Center in Seattle are among those that have declined to participate or have challenged the mandate, citing their legal duty to protect patient confidentiality under HIPAA. Their stance is likely to proliferate, as hospital general counsels weigh the risk of violating state and federal privacy laws against the threat of enforcement action by the CPSC. The fact that a private contractor, Konza Health, will process the sensitive data further complicates the compliance equation, introducing third-party data security risks and the potential for unauthorized redisclosure.