A federal agency tasked with tracking injuries from lawn mowers and coffeemakers is now demanding the personally identifiable medical records of every person who walks into an emergency room.

"They want to suck in as much data as possible, but I'm not sure how thoughtful they're being about what is collected and what is actually needed by the agency."

: Alexander Hoehn-Saric, former CPSC chairman, one of three Democratic board members fired by Trump last year

The Consumer Product Safety Commission was created to do one thing: find out when a toaster, a baby lounger, or a children's toy is hurting people, and force the manufacturer to fix it. For more than five decades, its main tool has been the National Electronic Injury Surveillance System, or NEISS, a network of roughly 70 hospital emergency departments that manually code and report product-related injuries. The system is imperfect, geographically limited, and designed for a paper-record era. That is why it needs updating.

It does not, however, need to collect the names, addresses, and full diagnoses of millions of Americans who visit emergency rooms for reasons that have nothing to do with consumer products.

That is precisely what the CPSC is now demanding.

According to a July 27 investigation by KFF Health News, the CPSC has been quietly pressuring some of the nation's largest hospital systems to turn over detailed, personally identifiable medical records from every emergency room visit, not just those involving consumer product injuries. The records would be handed to Konza Health, a Kansas-based private company that won a five-year, $15.9 million contract with the CPSC last fall. Konza's president and CEO, Laura McCrary, has described participation to hospital executives as "mandatory" or "required" in email correspondence.

The scope of what Konza will collect is staggering. In emails to hospital technology officials, McCrary outlined more than 10,000 diagnostic codes that would trigger data collection. The list includes injuries from falls on the ground, cuts from rocks, overdose incidents, suicide attempts, and even childhood reactions to vaccines. Vaccines are not regulated by the CPSC. Neither are stingrays, which are also on the list.

The CPSC's own 214-page operating manual instructs hospitals not to include identifying information like names, birthdates, or addresses when reporting cases. The agency is supposed to receive patient identifiers only during follow-up investigations, which the manual says happen in fewer than 1 percent of reported cases. The manual also explicitly excludes injuries from food, medical devices, illegal drugs, alcohol, plants, and anything not involving a consumer product.

Translation: the agency's own rules say this data grab should not exist.

The public learned about the program only after KFF Health News asked the CPSC about it. On July 22, the agency announced the initiative with a press release that described "nationwide coverage," "faster hazard detection," and "privacy protections by design." What the press release did not mention: that hospitals had already been approached, that participation was being framed as mandatory, that personally identifiable information was being collected, and that the agency had skipped the public notice and comment period required by federal law before requesting information from 10 or more entities.

The CPSC's spokesperson, Steve Roney, acknowledged the agency had not yet notified the public when asked about it.

The timing of the announcement matters. The CPSC has been gutted since Trump took office. He fired all three Democratic members of the five-person board, leaving the agency leaderless. Nearly one in five career staff departed in the first 16 months of the administration. The acting chairman, Peter Feldman, spoke at a toy industry event in February about investing in "AI-enabled workflows" and "digital infrastructure to handle a massive new volume of electronic health records."

A former CPSC chairman had to be fired before the agency decided it wanted your medical records. That is not a track record that inspires confidence.

Some hospitals are pushing back. Mass General Brigham in Boston declined entirely, saying it was "unable to provide these medical records" to protect patient privacy. Harborview Medical Center in Seattle said it had "voluntarily submitted de-identified data for many years" but was not obligated to report anything. Several of the busiest hospital systems targeted for the program, including the Mayo Clinic, Yale New Haven Hospital, Nationwide Children's Hospital, the Cleveland Clinic, and Baylor Scott and White Health, declined to comment when asked about their participation.

But the pressure is mounting. CPSC Chief Data Officer Elizabeth Puchek, who previously engineered the data system for USCIS, has told hospitals they must seek a formal exemption if they decline to share records. The CPSC has also hinted publicly and privately that hospitals refusing to participate could face penalties under a data-sharing regulation known as "information blocking."

Mary Greeley Medical Center in Ames, Iowa, initially signed a new contract in April to share its ER records with Konza. The hospital has since begun reevaluating its participation after being told the funds it previously received for NEISS were "no longer available."

The privacy risks are concrete, not hypothetical. From 2017 to 2019, the CPSC improperly released personal health information of approximately 30,000 people in a data breach that a top Republican senator at the time called "concerning." The disclosure went on longer and was wider in scope than the agency initially admitted.

Now the agency wants to be the central hub for millions of Americans' emergency room records, held in part by a private contractor. Sharona Hoffman, a professor of health law at Case Western Reserve University, called the plan "troubling" and warned that giving a private entity access to a sweeping collection of identifiable data "is worrisome for patients." She noted that private health data brokers frequently repurpose information for marketing once they learn what conditions people have.

Roney said the CPSC's contract with Konza prohibits the company from selling or marketing the data. The contract itself has not been made public.

The broader context does not help. This is part of a pattern of the Trump administration seeking unprecedented access to Americans' medical records. The Office of Personnel Management is requesting federal workers' sensitive health information. RFK Jr. is using a private organization to collect medical records for his studies on vaccines and autism. ICE has already proven itself a catastrophically poor steward of private data, illegally sharing IRS taxpayer addresses over 40,000 times and feeding Medicaid data it was never supposed to have to Palantir.

A DOGE employee once put Social Security data on a thumb drive to take to his new private-sector job.

Feeling safer yet?

The CPSC wants at least 100 hospitals to start sending detailed medical records by the end of this year, according to an internal memo. The full system, called NEISS-R, is expected to be operational by early 2027. The old system left 14 states without participating hospitals. The new one promises all 50.

There is legitimate value in modernizing a 1972-era injury tracking system. Electronic health records make manual coding obsolete. Broader geographic coverage improves statistical reliability. None of that requires collecting the personally identifiable information of patients treated for suicide attempts, vaccine reactions, or broken bones from falling on the sidewalk.

The question is whether this is about consumer safety or data accumulation. When an agency responsible for lawn mowers starts demanding vaccine reaction records and suicide attempt data from emergency rooms nationwide, the mismatch between mission and method stops being a detail and starts being the story.

An agency stripped of its leadership, staffed by loyalists, and operating without public notice is now building a pipeline to millions of Americans' most intimate medical information. The people it is supposed to protect are the ones whose data is on the line.