CPSC demanded identifiable ER records from 100+ hospitals through contractor Konza Health without required public notice

On July 21, 2026, the Consumer Product Safety Commission — an independent agency whose mandate is tracking injuries from consumer products — publicly announced a program requiring hospitals to turn over identifiable emergency-room records, after having discreetly pressured at least 100 hospitals, including Mayo Clinic, Cleveland Clinic, Yale New Haven, and Mass General Brigham, to participate. A KFF Health News investigation published six days later, on July 27, 2026, revealed the pressure campaign's scope: a CPSC official had told hospital executives in emails that they must provide all ER patients' identifiable information, including names, addresses, and diagnoses, to Konza Health, a Kansas-based data-exchange operator that won a $15.9 million, five-year CPSC contract last fall, covering most patient injuries from broken bones to suicide attempts; Konza representatives separately described hospital participation as "mandatory" or "required." CPSC Chief Data Officer Elizabeth Puchek told hospitals declining to share records that they must formally seek an exemption.

The program marks a sharp departure from CPSC's existing injury-surveillance system, which its own 214-page operating manual instructs hospitals to report without identifying information except in the fewer than 1% of cases needing follow-up. Konza said it would hold identifiable patient data for at least 30 days before filtering it, under a contract CPSC has not made public, and disclosed diagnostic codes covering more than 10,000 conditions — including vaccine reactions and stingray injuries that fall outside CPSC's product-safety jurisdiction. CPSC acknowledged it had not given the public notice and comment period that federal law requires before requesting data from ten or more entities, despite planning to enroll 100 hospitals. The agency previously mishandled the personal health information of roughly 30,000 people in a 2017-2019 breach.

CPSC spokesperson Steve Roney said the agency is "modernizing" its surveillance system and that its contract with Konza bars the company from selling or marketing the data. Case Western Reserve health law professor Sharona Hoffman said turning the data over to a private contractor introduces risks that a company could misuse or fail to safeguard it. Some hospitals, including Harborview Medical Center and Mass General Brigham, have declined to participate, citing their own privacy obligations; others, including Mary Greeley Medical Center in Iowa, signed on after being told participation was mandatory.