CPSC Demands Patient ER Records in Broad Product Safety Push

The Consumer Product Safety Commission (CPSC) is demanding that major health systems turn over personally identifiable medical records for patients visiting their emergency rooms. The agency aims to use this granular data to more accurately track injuries caused by consumer products and accelerate the issuance of safety recalls.

According to reports, the CPSC is seeking sensitive information including patient names, addresses, and specific diagnoses. CPSC Chief Data Officer Elizabeth Puchek informed hospitals via email that the data sharing is being framed as a requirement, stating that facilities must seek a formal exemption if they decline to provide the records. To manage this influx of sensitive health information, the agency is utilizing a private contractor, Konza Health.

A Shift in Surveillance

The CPSC is the federal body tasked with protecting the public from hazardous consumer goods, ranging from lawn mowers to coffeemakers. While the agency has a long history of monitoring injuries through the National Electronic Injury Surveillance System (NEISS), that program has historically operated on a voluntary basis. The current demand for comprehensive, personally identifiable ER records represents a significant escalation in the scope and nature of the agency's data collection efforts.

The Privacy Conflict

This aggressive push has created a sharp tension between the goals of public safety and the mandates of patient privacy. Industry experts and hospital lawyers are questioning whether the CPSC possesses the legal authority to mandate such a broad collection of sensitive health data. While some experts note that the HIPAA Privacy Rule permits covered entities to disclose protected health information to government agencies for public health purposes, the scale of this demand is unprecedented.

If the CPSC is found to lack the authority to mandate these disclosures, or if the data is mishandled by the private contractor, the move could trigger massive HIPAA violations. Such a breach would not only result in legal penalties but could create a chilling effect on the trust between patients and providers in emergency medical settings.

Legal and Regulatory Outlook

As hospitals weigh the CPSC's demands against their privacy obligations, the focus shifts to whether the agency can legally enforce these requirements without explicit statutory authority. Observers are watching to see if health systems will collectively challenge the mandate in court or if the CPSC will be forced to return to a voluntary, sampled approach to data collection.