Trump Administration Demands Hospitals Share Emergency Room Records: Privacy Concerns

The Consumer Product Safety Commission (CPSC) — the small federal agency best known for recalling faulty toasters and lawn mowers — is now demanding that some of the largest health systems in the United States hand over detailed, personally identifiable medical records of every patient who walks through their emergency room doors. The directive, which targets at least 100 hospitals by the end of 2026, has sparked immediate privacy backlash and raised serious questions about the agency's legal authority and data security practices.

What the CPSC Is Asking For

According to an internal memo obtained by KFF Health News and confirmed by multiple sources, the CPSC began discreetly pressuring hospital executives earlier this year to share identifiable health data with a private contractor named Konza Health. The agency only publicly announced the program on July 21, after KFF Health News inquired about the new system.

The scope of the data request is sweeping. A CPSC official insisted in emails that institutions must provide all ER patients' identifiable information — including names, addresses, diagnoses, and other personal details — to Konza Health for analysis. The agency's stated goal is to obtain millions of Americans' medical records from emergency room visits for most injuries, from a broken bone to a childhood vaccine reaction or even a suicide attempt, according to documents and emails obtained by KFF Health News and interviews with five people involved in or familiar with the discussions.

This marks a stark departure from the CPSC's traditional product-focused mission. The agency is now seeking records for injuries that have nothing to do with consumer products, according to KFF Health News reporting.

Legal and Privacy Questions Mount

Hospital lawyers and industry experts are pushing back, questioning the agency's authority to collect such information, its ability to protect such private data, and the legality of the reconfiguration of the oversight system. The core concern: the CPSC was never designed to be a repository of sensitive medical records, and its infrastructure may not be equipped to handle the security requirements of millions of identifiable patient files.

The privacy implications are significant. The data being demanded includes not just injury details but full patient identities, which could be used to track individuals across multiple visits. The ACLU has previously blocked Trump administration attempts to seize private medical records, including a case involving trans youth from New York hospitals. That precedent underscores the legal vulnerability of such broad data collection efforts.

For hospitals, the directive creates a compliance dilemma. They must weigh the risk of defying a federal agency against the potential liability of exposing patient data to a third-party contractor with unclear security protocols. The CPSC has not publicly detailed what safeguards Konza Health has in place, nor has it explained how the data will be stored, shared, or eventually disposed of.

Why This Matters for Patient Data Security

This case is a reminder that the boundaries of government data collection are not always clear — and that agencies can expand their reach quietly, without public debate. The CPSC's move to collect ER records for injuries unrelated to consumer products suggests a mission creep that could set a precedent for other agencies.

For patients, the takeaway is unsettling: your emergency room visit for a fall, an allergic reaction, or a mental health crisis could end up in a federal database linked to your name and address, with no clear opt-out or notification process. The Health Insurance Portability and Accountability Act (HIPAA) generally protects medical records, but it does allow disclosures required by law — and a federal directive could qualify.

The broader context here involves the tension between government oversight and individual privacy. While the CPSC argues that better injury data helps it identify product hazards more quickly, the method — demanding identifiable records from a private contractor rather than using anonymized, aggregated data — raises red flags. The agency could have pursued a less invasive approach, such as working with public health agencies that already collect de-identified injury data, but it chose a direct path that bypasses traditional privacy safeguards.

What Happens Next

The CPSC has given hospitals until the end of 2026 to comply. It remains to be seen whether the agency will face legal challenges from hospital associations, patient advocacy groups, or civil liberties organizations. The ACLU's past success in blocking similar data seizures suggests that litigation is a real possibility.

For now, hospital executives are caught between a federal demand and their own legal and ethical obligations to protect patient privacy. The coming months will test whether the CPSC's authority holds up under scrutiny — and whether the Trump administration's push for broader surveillance of medical data will survive the inevitable backlash.

As this story develops, it's worth watching how other federal agencies interpret their data collection powers. If the CPSC can demand ER records for injuries unrelated to its mission, what stops other agencies from making similar requests? The answer may depend on how loudly patients, hospitals, and privacy advocates push back.