A tiny federal agency tasked with protecting the public from injuries caused by lawn mowers and coffeemakers is demanding that some of the nation\u2019s biggest health systems turn over detailed, personally identifiable medical records of all patients who seek help at their emergency rooms.<\/p>\n
The Consumer Product Safety Commission, responsible for tracking and issuing recalls of dangerous products sold in the U.S., began discreetly pressuring hospital executives this year to share personally identifiable health data with a private contractor. But hospital lawyers and other industry experts have questioned the agency\u2019s authority to collect, its ability to safeguard such a swath of sensitive information, and whether it has followed the legal process to overhaul its surveillance system.<\/p>\n
After KFF Health News asked the CPSC about the new system, the agency announced<\/a> the program on July 21. Left unmentioned, however, is the alarm it has raised among hospital executives, as well as the nature and extent of the agency\u2019s data demands.<\/p>\n In a stark departure from its product-focused mission, the agency\u2019s goal is to obtain millions of Americans\u2019 medical records from emergency room visits for most injuries, from a broken bone to a childhood vaccine reaction or even a suicide attempt, according to documents and emails obtained by KFF Health News, as well as interviews with five people involved or familiar with the discussions.<\/p>\n A CPSC official also insisted in the emails that the institutions provide all ER patients\u2019 identifiable information \u2014 such as names, addresses, diagnoses, and other personal details \u2014 to the contractor, Konza Health, for analysis. In correspondence with hospital executives<\/a>, Konza representatives described participation as \u201cmandatory\u201d or \u201crequired.\u201d<\/p>\n As a condition of viewing the correspondence, KFF Health News agreed not to republish some of the emails it obtained.<\/p>\n The CPSC wants at least 100 hospitals to start sending detailed medical records by the end of this year, according to an internal memo<\/a><\/a><\/a>.<\/p>\n \u201cThe whole thing is troubling,\u201d said Sharona Hoffman, a professor of health law at Case Western Reserve University who noted that giving a private entity access to a sweeping collection of data will introduce risks to patient privacy. \u201cIf this company really is collecting identifiable information, that is worrisome for patients.\u201d<\/p>\n The new project was launched amid upheaval at the traditionally independent agency, which is without a governing board since President Donald Trump fired the CPSC\u2019s three Democratic board members. Nearly 1 in 5 career staffers left the CPSC in the first 16 months of the new administration, according to a KFF Health News analysis of federal workforce data.<\/p>\n The initiative also comes as the Trump administration has sought unprecedented access to millions of Americans\u2019 medical records, with the Office of Personnel Management requesting<\/a> federal workers\u2019 sensitive health information and Health and Human Services Secretary Robert F. Kennedy Jr. using a private organization<\/a> to collect more medical records for his studies on vaccines and autism.<\/p>\n Steve Roney, CPSC spokesperson, said in an emailed statement on July 10 that the CPSC is \u201cmodernizing\u201d its surveillance system. Asked whether the CPSC will file complaints against hospitals that do not participate, he said only that while the previous system \u201coperated as a voluntary program, the ability of hospitals to opt out limited the sample size and usefulness of the data.\u201d<\/p>\n Roney also acknowledged that the agency had not yet notified the public, as \u201crequired by law.\u201d<\/p>\n Federal law requires the agency to provide notice and a public comment period before requesting information from 10 or more entities, a step it has not taken despite plans for 100 hospitals to join the surveillance system. KFF Health News independently confirmed with over a dozen hospitals that they had been approached.<\/p>\n Federal public health authorities cannot legally mandate<\/a> that private health data be reported. But CPSC officials have suggested publicly and privately<\/a> that if hospitals decline to share data with the new surveillance system, they could be subject to strict penalties from a data-sharing regulation known as \u201cinformation blocking.\u201d<\/p>\n Yet some hospital executives say they are reluctant to share patients\u2019 sensitive data because they\u2019re concerned about a different violation \u2014 that of federal privacy law<\/a>.<\/p>\n AI Takes Over<\/strong><\/p>\n Dozens of ERs across the country already participate in the CPSC\u2019s voluntary National Electronic Injury Surveillance System, or NEISS, through which trained hospital workers report injuries involving consumer products, almost always stripped of patients\u2019 identifiable information. The system helps the CPSC identify products, such as baby loungers, toys, and household appliances, with a pattern of injuring consumers.<\/p>\n The new injury surveillance program goes much further.<\/p>\n At a toy industry trade event in February, acting CPSC Chairman Peter Feldman said the agency is \u201cinvesting in AI-enabled workflows that improve the quality and quantity of injury surveillance data, while also building up digital infrastructure to handle a massive new volume of electronic health records.\u201d<\/p>\n Konza Health, a Kansas-based organization that runs the state\u2019s health data exchange, will automatically pull and analyze medical records of all patient visits from ERs nationwide. Konza won a five-year contract<\/a> worth up to $15.9 million with the CPSC last fall.<\/p>\n In email correspondence with hospital technology officials, Konza Health President and CEO Laura McCrary also has described ERs\u2019 participation as \u201crequired,\u201d stipulating that they share patients\u2019 records with identifying information.<\/p>\n McCrary told KFF Health News by email that the company is not using AI to process the records it receives, saying instead that Konza will use \u201cadvanced analytic parsing and filtering capabilities.\u201d Roney, the CPSC spokesperson, did not answer questions about the use of AI<\/a>.<\/p>\n For years, agency officials have discussed<\/a> moving away from human contractors and automating NEISS to save time and money.<\/p>\n But without workers on-site, hospital staffers may no longer receive training to determine what clinical information is important to include for the CPSC. In short, the changes could dilute the quality of the product safety data the agency collects.<\/p>\n \u201cThey want to suck in as much data as possible, but I\u2019m not sure how thoughtful they\u2019re being about what is collected and what is actually needed by the agency,\u201d said former CPSC chair Alexander Hoehn-Saric, one of the Democratic appointees Trump fired last year.<\/p>\n Wanted: Injuries From Vaccines and Stingrays<\/strong><\/p>\n The CPSC\u2019s new data collection appears to contradict its own 214-page operating manual<\/a><\/a><\/a><\/a><\/a>, which instructs hospitals not to include identifiable information \u201csuch as names, birthdates, or addresses\u201d when reporting cases.<\/p>\n The agency is supposed to receive patients\u2019 identifying information only when needed for follow-up investigations, which happens in fewer than 1% of reported cases, according to the manual.<\/p>\n The CPSC has also historically limited the records it collects to minimize privacy violations in case of a data breach.<\/p>\n The risk is not hypothetical: From 2017 to 2019, the agency improperly released personal health information of around 30,000 people, a disclosure that a top Republican at the time called \u201cconcerning.\u201d<\/a><\/p>\n Konza, however, will receive even more sensitive information on many more people. McCrary said in a statement that Konza will remove patients\u2019 names, addresses, and medical information \u201cnot needed by CPSC\u201d before sharing records with the agency.<\/p>\n Leaving a private organization to collect sensitive information introduces risks, including that it could be stolen or used for business purposes, said Hoffman, the Case Western professor.<\/p>\n \u201cVery often, they will use information for marketing because now they\u2019re going to know what conditions people have,\u201d she said.<\/p>\n Roney said that its contract with Konza, which has not been made public, prohibits the organization from selling or marketing the data it collects.<\/p>\n The CPSC\u2019s manual also identifies types of ER visits that should not be reported to the CPSC, which has jurisdiction over only certain consumer products. Excluded injuries are those caused by food, illegal drugs, medical devices, alcohol, or plants, as well as injuries that did not involve consumer products \u2014 such as a cut from a rock or broken bones from a fall on the ground \u2014 and suicide attempts by adults.<\/p>\n But in a contract offered<\/a> to one hospital and reviewed by KFF Health News, Konza set no such limits on the information it would gather from ER records and said it would hold on to patient health information for at least 30 days.<\/p>\n In an email sent to hospital technology officials, McCrary wrote that Konza would provide the CPSC with records when a patient is treated in the ER for any of more than 10,000 conditions. The expansive list of diagnostic codes Konza provided in the email includes injuries that do not involve consumer products.<\/p>\n Child injuries resulting from \u201cpoisoning by\u201d vaccines or contact with stingrays, neither of which is regulated by the CPSC, are included in the list.<\/p>\n A limited number of hospitals once shared deidentified data on all injuries \u2014 regardless of product involvement \u2014 through the NEISS using the Centers for Disease Control and Prevention\u2019s injury-tracking program. But the CDC halted that data collection, after funding and staffing were cut last year, and has not restarted it.<\/p>\n Pressure on Hospitals<\/strong><\/p>\n CPSC Chief Data Officer Elizabeth Puchek, who joined the agency late last year after engineering U.S. Citizenship and Immigration Services\u2019 data system, has told hospitals in emails that they must seek an exemption from the program if they decline to share patients\u2019 emergency room records with Konza. <\/p>\n The CPSC\u2019s targeted outreach has included some of the nation\u2019s largest urban and rural health systems, as well as small, publicly owned hospitals.<\/p>\n Staff members at Mary Greeley Medical Center in Ames, Iowa, said that Konza and federal officials told them their participation in the new program was mandatory. The hospital, which has long participated in NEISS, signed a new contract in April to share its ER records with Konza.<\/p>\n Yet the hospital is reevaluating its participation after being notified that the funds it received to participate in NEISS were \u201cno longer available,\u201d spokesperson Steve Sullivan said.<\/p>\n Several hospital executives, lawyers, and others have raised doubts about the CPSC\u2019s claimed authority.<\/p>\n Harborview Medical Center spokesperson Susan Gregg said the Seattle hospital\u2019s emergency room has \u201cvoluntarily submitted de-identified data for many years, but we are not obligated to report this information.\u201d<\/p>\n In Boston, Mass General Brigham has declined to participate in the new program, with spokesperson Kelly Mitchell saying that \u201cto protect patient privacy, we are unable to provide these medical records.\u201d<\/p>\n Henry Ford Health in Detroit; St. Luke\u2019s in Boise, Idaho; and Sanford Health based in Sioux Falls, South Dakota \u2014 which together handle over a million ER visits a year \u2014 are among the health systems that have been approached but not yet entered into an agreement with Konza, according to representatives. Several of the nation\u2019s busiest hospital systems targeted for the program \u2014 including the Mayo Clinic in Minnesota, Yale New Haven Hospital in Connecticut, Nationwide Children\u2019s Hospital and the Cleveland Clinic in Ohio, and Baylor Scott & White Health in Texas \u2014 declined to answer questions about whether they\u2019re participating.<\/p>\n Hoehn-Saric, the agency\u2019s former chairman, said he was surprised that the CPSC would insist that hospitals provide identifiable records from all emergency room visits.<\/p>\n \u201cThis idea that they can simply demand patient information from a hospital and that the hospital would provide it \u2014 I really don\u2019t understand the basis for that,\u201d he said.<\/p>\n<\/div>\n KFF Health News<\/a> is a national newsroom that produces in-depth journalism about health issues and is one of the core operating programs at KFF\u2014an independent source of health policy research, polling, and journalism. Learn more about KFF<\/a>.<\/em><\/p>\n This article<\/a> first appeared on KFF Health News<\/a> and is republished here under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License<\/a>.<\/p>","protected":false},"excerpt":{"rendered":" A tiny federal agency tasked with protecting the public from injuries caused by lawn mowers and coffeemakers is demanding that some of the nation\u2019s biggest health systems turn over detailed, personally identifiable medical records of all patients who seek help at their emergency rooms. The Consumer Product Safety Commission, responsible for tracking and issuing recalls…<\/p>\n","protected":false},"author":0,"featured_media":14745,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[],"class_list":["post-14744","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-articles"],"_links":{"self":[{"href":"https:\/\/medical-article.com\/index.php?rest_route=\/wp\/v2\/posts\/14744"}],"collection":[{"href":"https:\/\/medical-article.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/medical-article.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/medical-article.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=14744"}],"version-history":[{"count":0,"href":"https:\/\/medical-article.com\/index.php?rest_route=\/wp\/v2\/posts\/14744\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/medical-article.com\/index.php?rest_route=\/wp\/v2\/media\/14745"}],"wp:attachment":[{"href":"https:\/\/medical-article.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=14744"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/medical-article.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=14744"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/medical-article.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=14744"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}