Millions of ER Patients' Data at Stake in CPSC Collection Push

For healthcare administrators and clinicians, the CPSC's mandate to funnel identifiable emergency room data to an outside vendor raises urgent questions about HIPAA compliance, patient trust, and the operational burden on already stretched health IT systems. The prospect of intimate health details landing in a federal database without patient consent could have a chilling effect on individuals who fear for their privacy, potentially delaying life-saving treatment.

The Trump administration, through the Consumer Product Safety Commission, has launched an unprecedented drive to collect personally identifiable emergency room records from at least 100 U.S. hospitals by the end of 2026. The initiative, disclosed on July 21 after KFF Health News pressed the agency for details, marks a radical expansion of a small regulator's mission. The CPSC, traditionally focused on product-related injuries like those from lawn mowers and coffeemakers, now seeks full medical records—including names, addresses, diagnoses, and other sensitive data—from every patient walking into participating emergency departments, regardless of whether their visit involves a consumer product. The scope encompasses everything from broken bones to childhood vaccine reactions and even suicide attempts. This sweeping surveillance is to be managed by a private contractor, Konza Health, which has told hospital executives participation is “mandatory” or “required,” triggering immediate legal and privacy alarms.

“

The Trump administration, through the Consumer Product Safety Commission, has launched an unprecedented drive to collect personally identifiable emergency room records from at least 100 U.S.

Hospital lawyers and health industry experts have swiftly questioned the CPSC’s statutory authority to compel such data from medical providers. The agency’s enabling statute, the Consumer Product Safety Act, grants it power to collect information related to the causes and prevention of death, injury, and illness associated with consumer products. But critics argue that demanding all ER records—most of which have no link to a product—far exceeds that mandate. Moreover, the Health Insurance Portability and Accountability Act (HIPAA) strictly protects patient health information, and the Privacy Act of 1974 further restricts federal agencies from amassing personal data without careful rulemaking and public notice. The CPSC appears to have bypassed formal rulemaking, instead quietly pressuring hospitals behind the scenes since early 2026.