A group of Senate and House Democrats is asking the Consumer Product Safety Commission to suspend a program that collects personally identifiable medical records from Americans who visit emergency rooms. They argue the collection exceeds the agency's statutory authority, and, in the part that turns a data policy story into a health story, that people who fear their emergency visit will land in a federal database may delay or skip care they need.
That second claim is about behavior, not an established finding for this program, and it should be read that way. But it is the reason the letter is worth attention from anyone who has been to an emergency department in the past year.
The program in question is a rebuilt version of a long-running federal injury survey. According to reporting by KFF Health News, the agency instructed hospitals to share detailed patient information for more than 10,000 types of injury or condition, many of which have no connection to a consumer product.
From a Voluntary Injury Survey to a Mandatory Data Pull
For decades, the CPSC has run the National Electronic Injury Surveillance System, known as NEISS. Trained staff at about 70 hospitals report injuries involving consumer products, and the data underpins recall decisions and safety standards. Historically, the system requested identifiable patient information in fewer than 1 percent of cases, generally for follow-up.
Early this year, agency staff overhauled the program without public notice and rebranded it NEISS-R. KFF Health News first reported the expanded collection in July. Hospital executives were told participation was mandatory and that they would need to report far more identifiable patient detail, across far more conditions, to a private contractor. That contractor is Konza Health, a Kansas-based company that won a five-year CPSC contract last year worth up to $15.9 million.
In emails and contract language reviewed by KFF Health News, Konza representatives described hospital participation as mandatory or required. Emails from CPSC chief data officer Elizabeth Puchek said hospitals would need to apply for an exemption or face penalties for what federal rules call information blocking, a provision originally written to make sure patients could get their own records.
The Deterrence Concern at the Center of the Letter
The lawmakers, led by Massachusetts Senator Ed Markey, wrote in a letter to CPSC acting Chairman Peter Feldman that the effort is "untethered from the Commission's statutory mission and authority" and is open to misuse. They also argued that people should be able to seek medical care without worrying that their health information will be pulled into a federal database and repurposed for political ends.
That concern has an evidence base, even if this specific program has not been studied. Research on immigration enforcement, on mandatory reporting laws, and on data sharing between health systems and law enforcement has repeatedly found that perceived surveillance reduces care-seeking, particularly among people who already have reason to distrust institutions.
The categories at issue sharpen the point. Because NEISS-R covers thousands of conditions rather than product injuries alone, the records swept in can include vaccine reactions, mental health crises, substance-related emergencies, injuries from domestic violence, and reproductive health emergencies. Those are precisely the visits where a patient's willingness to walk through the door is most fragile.
Other signatories included Senators Richard Blumenthal of Connecticut and Ron Wyden of Oregon and Representative Jan Schakowsky of Illinois. CPSC spokesperson Steve Roney did not answer several questions about the program, saying only that the agency received the letter and "will respond directly, through the appropriate channels."
Hospitals Pushed Back, and the Agency Revised Its Page
Resistance did not begin with Congress. The American Hospital Association asked the commission for modifications in August, citing confusion and concern over the scope of patient information being demanded.
The agency has since softened its position. References to information-blocking penalties were removed from the public NEISS webpage in recent weeks, without a correction or acknowledgment. Feldman, a Trump appointee, told Nextgov/FCW last month that the program would remain a voluntary one.
The lawmakers seized on that reversal, writing that removing the rationale does not undo the pressure hospitals already experienced and raises the question of whether the legal justification was ever more than cover. They also said the commission bypassed regulations and failed to publish a detailed collection plan as required by law, and asked for a response by September 18. Feldman has since defended the agency's authority and said it will publish a full list of the diagnostic codes the contractor screens for, without giving a timeline, according to the commission's response to lawmakers.
The CPSC is not alone. KFF Health News has documented several federal agencies expanding collection of Americans' medical records, including the Office of Personnel Management requesting federal workers' health information and the Department of Health and Human Services deputizing at least one outside organization to gather records for studies on vaccines and autism.
Patient Options Are Limited but Not Nonexistent
The honest answer for individuals is that there is no opt-out button. Public health reporting operates under exceptions to federal privacy rules, and a patient in an emergency department has no practical way to know whether their record will be included.
There are still reasonable steps. Patients can ask a hospital's privacy officer or health information management department what public health reporting the facility participates in and whether identifiable data is shared with outside contractors. Federal privacy rules give patients the right to request an accounting of certain disclosures of their protected health information, and to request restrictions, though hospitals are not always required to agree.
What the lawmakers and the hospital association are both effectively saying is that this is a systems problem rather than a patient problem, and that the fix belongs at the agency. Nothing here should change a decision about whether to seek emergency care. Delaying treatment for chest pain, difficulty breathing, signs of stroke, a serious injury, or a mental health emergency carries a concrete and immediate risk that outweighs a speculative data risk.
Several things remain unknown. It is unclear how many hospitals have already transmitted identifiable records, how many patients are represented, how long the data will be retained, or whether it can be shared with other agencies. Whether the program is now genuinely voluntary in practice, as opposed to on the website, is also unresolved.
The next marker is the September 18 response deadline. Watch also for whether the commission publishes a formal notice describing the program, and whether the American Hospital Association escalates beyond a comment letter.
Key Questions Answered
What is the CPSC collecting? Personally identifiable patient information from emergency room visits across more than 10,000 categories of injury and condition, including many unrelated to consumer products, transmitted to a private contractor.
Was this program always like this? No. The National Electronic Injury Surveillance System has run for decades at about 70 hospitals and historically requested identifiable information in fewer than 1 percent of cases. The expanded version was introduced this year without public notice.
Why do lawmakers say this could harm health? They argue that people worried about federal surveillance of their medical records may avoid seeking emergency care. That is an asserted risk rather than a measured effect of this specific program.
Is participation mandatory for hospitals? The agency initially told hospitals it was, citing information-blocking penalties. It has since removed that language from its website, and the acting chairman has said the program is voluntary.
Can a patient opt out? Not directly. Public health reporting operates under exceptions to federal privacy rules. Patients can ask a hospital's privacy officer what is reported and can request an accounting of certain disclosures.
Should anyone avoid the emergency room because of this? No. Delaying care for chest pain, breathing difficulty, stroke symptoms, serious injury, or a mental health emergency carries immediate risk that far outweighs the data concern.
What happens next? The lawmakers asked the commission to respond by September 18. Watch for a formal public notice describing the program and for further action from hospital groups.
