Trump administration softens demand for hospitals to share emergency room medical records

A small federal agency tasked with protecting Americans from hazardous products is moving forward with a controversial public health project but is taking steps to assuage data privacy concerns raised by top hospital and consumer groups.

“We are now working directly with the American Hospital Association to address those concerns, to allay those questions that have [arisen], to maximize participation,” Peter Feldman, acting chairman of the Consumer Product Safety Commission, exclusively told Nextgov/FCW last week regarding an update to a legacy surveillance system.

In July, the Consumer Product Safety Commission announced it would update a surveillance system used to detect injuries from dangerous products such as lawn mowers, knives and booster seats.

The system, known as NEISS, currently has hospital coordinators and third-party coders at roughly 70 hospitals across 36 states manually review millions of emergency room medical records before they hand off information to the CPSC that could be used to identify rare and emerging health hazards. The labor-intensive system still yields tens of thousands of erroneous data points each year.

But under a new system, known as NEISS-R, the CPSC wants 100 hospitals across all 50 states to first send electronic health records to a contractor. That company, KONZA Health, would “automatically filter and transmit minimum necessary” data to the agency, according to a slide deck provided to hospital officials in late July and obtained by Nextgov/FCW.

CPSC will then use artificial intelligence and approved FedRAMP tools to help analyze injury data more effectively, including through data-quality checks and pattern identification that point to an emerging product hazard, an agency spokesperson told Nextgov/FCW.

The NEISS-R system, which is expected to go into effect in 2027, quickly drew backlash from hospital leaders and privacy experts alike, according to KFF Health reporting. 

Patient privacy concerns

Privacy experts argue KONZA would obtain an excessive and inappropriate amount of data from medical records, including names, addresses, dates of birth and other personally identifiable information, under NEISS-R.

“Good data security and privacy practices don't collect more data than you need,” Richard Trumka, a former Democratic CPSC commissioner, told Nextgov/FCW. “For the vast majority of entries, you're not going to need people's [personally identifiable information], and to have it is a giant liability; you're asking for a data breach, you're asking for misuse.”

The American Hospital Association urged CPSC to limit NEISS-R data collection to only what is the “minimum necessary” for the agency to fulfill its public health mission in an August 12 letter.

But Feldman argued that NEISS-R data collection is appropriate and includes robust privacy safeguards.

Under the NEISS-R system, KONZA will start by screening medical records for a wide array of injuries, such as poisonings, lacerations and fractures, Feldman said. The contractor will then narrow the records into consumer product injury codes, sending CPSC only what the agency needs, he continued. For example, information about fractures caused by motor vehicle injuries wouldn’t end up with CPSC since the agency does not oversee automobiles.

But the medical records KONZA will screen include personally identifiable information, according to KFF Health reporting. 

KONZA will store patient contact information in a “separate, smaller dataset” for up to six months “solely for the purpose of the rare instances where CPSC wants to conduct an in-depth investigation,” Feldman told Nextgov/FCW. 

CPSC currently follows up with injury victims or their families in less than 1% of NEISS cases, according to the 2025 manual for the public health system. In those cases, CPSC requests personally identifiable information like patient names, addresses and phone numbers and destroys the data after an investigation is completed, the manual says.

“Patient-identifying information is excluded from all data provided to CPSC,” according to the slide deck obtained by Nextgov/FCW.

A CPSC spokesperson previously said that KONZA’s contract with the agency bars the company from selling or marketing data it collects. 

CPSC, however, can share NEISS-R information with other agencies “consistent with applicable law and longstanding NEISS practice,” an agency spokesperson told Nextgov/FCW. When CPSC shares “nonpublic information under 15 U.S.C. § 2078, the statute and CPSC procedures impose confidentiality and purpose limitations on the recipient,” they added. 

Beyond Americans’ sensitive information, privacy advocates worry KONZA will screen medical records for injuries that seem outside the agency’s purview, such as vaccines and contact with stingrays.

“The agency has no authority over vaccines. That is out of jurisdiction, and so it's odd,” Trumka said.

Feldman told Nextgov/FCW that CPSC will not be collecting information about contact with stingrays and defended screening medical records for information about vaccines and intentional self-harm cases.

“CPSC regulates drug packaging under the Poison Prevention Packaging Act. So it is absolutely relevant to us to the extent that we're seeing poisonings associated with medications that may be a direct result of medication, pharmaceutical packaging that doesn't meet specific child-resistant special packaging requirements,” he said of vaccines.

It’s “certainly relevant” for CPSC to want to know the proportion of product-related injuries, such as carbon monoxide poisonings, that are connected to intentional self-harm, he added.

CPSC plans to publish a full diagnosis code list of what KONZA will screen for, Feldman said, though he did not offer a specific timeline.

Ending mandatory participation claims

Hospital leaders were told participation in NEISS-R is mandatory, according to the late July slide deck obtained by Nextgov/FCW, even though some legal experts questioned the agency’s authority to require it. 

“Hospitals are required to participate,” the slide deck said, with the word “required” bolded and underlined.

Feldman walked back that message in his recent discussion with Nextgov/FCW.

“We are not putting a new mandate in place, a new CPSC mandate, to participate in NEISS-R,” Feldman said. “This historically has been and will remain a voluntary program.” 

CPSC is reviewing the slide deck — which included “several basic factual and substantive errors” — with KONZA to “ensure future outreach accurately describes the program, the information being exchanged, and the applicable legal framework,” the agency spokesperson said.

A KONZA spokesperson declined to comment on the CPSC’s stance on NEISS-R participation, stating that comments on such matters are “outside of the scope” of the contractor’s responsibilities. 

CPSC’s NEISS website does not describe participation as mandatory. However, it continues to detail the legal rationale for why participation would be required that was cited in the erroneous slide deck.

The website and the slide deck both explain that CPSC is a public health authority, which means HIPAA allows hospitals to send data to it without patient authorization. Not sending the data to CPSC could violate federal “information blocking” laws, the website and slide deck suggest. 

Information blocking claims could have merit if hospitals do not share “minimum necessary” data with a public health authority like CPSC, though what exactly constitutes “minimum necessary” data is currently up for debate, said Deven McGraw, chief privacy and regulatory officer for Citizen Health.

Even so, Feldman told Nextgov/FCW that CPSC has no plans to allege hospitals are violating information blocking laws through a federal web portal if they decline to participate in NEISS-R. CPSC has no ability to enforce those laws, either, as enforcement is conducted by the Department of Health and Human Services.

It’s unclear if CPSC will succeed in assuaging hospital concerns. 

Feldman said he has heard “overwhelmingly positive responses” from hospitals, but did not say how many hospitals have agreed to participate in NEISS-R. The agency spokesperson did not offer a number either, instead stating “hospital onboarding remains underway with hospitals at different stages of contracting and technical implementation, so the count changes frequently.”

“Only a small number have declined to date,” they added.

Going forward, NEISS-R plans to only work with hospitals connected to the federal health data sharing superhighway known as TEFCA because of the benefits for privacy, security and administrative simplicity, they said. 

The American Hospital Association “has had productive conversations with the CPSC leadership and look[s] forward to continuing to work towards efforts that achieve increased safety for patients,” a spokesperson for the hospital trade group told Nextgov/FCW.

CPSC has not followed through on the group’s Aug. 12 recommendation for the agency to open up NEISS-R to a formal notice and comment period.

“If the agency wants to change the NEISS program, it should issue a complete proposal for public comment, make its contract with Konza Health public, and uphold basic tenets of individual privacy and government transparency,” William Wallace, the director of safety advocacy for Consumer Reports, told Nextgov/FCW.

Feldman did not commit to a notice-and-comment period in an interview. But should CPSC seek to increase the number of hospitals participating in NEISS-R beyond historical figures, it would likely open up a public comment period through a Paperwork Reduction Act announcement, he added.