The Consumer Product Safety Commission has confirmed that hospital participation in its updated injury surveillance system will remain voluntary, following concerns from hospital leaders and privacy advocates about patient data security and federal requirements
The Consumer Product Safety Commission (CPSC) has clarified that hospitals will not be required to participate in its upcoming National Electronic Injury Surveillance System-Modernized (NEISS-R), following concerns from hospital leaders and privacy advocates about patient privacy and data security. The agency is moving forward with plans to update its decades-old injury surveillance system but is working to address questions about how patient information will be handled.
In July, CPSC announced it would modernize its injury surveillance program, which tracks emergency room visits related to hazardous consumer products. The current system, NEISS, relies on manual review of medical records at about 70 hospitals in 36 states. The new NEISS-R system aims to expand participation to 100 hospitals across all 50 states and shift to electronic health record transfers, with the goal of improving data quality and identifying emerging product hazards more efficiently.
Privacy and Data Security Concerns
Under NEISS-R, hospitals would send electronic health records to a contractor, KONZA Health, which would filter and transmit only the minimum necessary data to CPSC. Privacy experts and the American Hospital Association have raised concerns that this process could result in the collection of excessive personally identifiable information, such as names, addresses, and dates of birth. CPSC officials have stated that patient-identifying information will be excluded from the data provided to the agency, and that KONZA will store contact information separately for up to six months only in rare cases where in-depth investigations are needed.
CPSC follows up with injury victims or their families in less than 1% of cases, according to the agency's 2025 manual. In those instances, personally identifiable information is requested and destroyed after the investigation is complete. The agency also emphasized that KONZA is contractually barred from selling or marketing any collected data. However, CPSC may share NEISS-R information with other agencies as permitted by law, with confidentiality and purpose limitations in place.
Participation Remains Voluntary
Initial communications from CPSC and KONZA suggested that hospital participation in NEISS-R would be mandatory, citing federal information blocking laws and the agency's status as a public health authority. However, CPSC acting chairman Peter Feldman has since clarified that the program will remain voluntary, consistent with past practice. The agency is reviewing its outreach materials to ensure hospitals receive accurate information about the program and legal framework.
Hospital onboarding for NEISS-R is ongoing, with most hospitals still in the contracting and technical implementation phase. Only a small number have declined to participate so far, according to CPSC. The agency plans to work primarily with hospitals connected to the federal health data sharing network known as TEFCA, citing privacy and administrative benefits.
Ongoing Dialogue and Next Steps
The American Hospital Association has been in discussions with CPSC leadership to address privacy and data minimization concerns. The association has recommended that CPSC open NEISS-R to a formal notice and comment period, but the agency has not yet committed to this step. Should CPSC seek to expand participation beyond historical levels, a public comment period may be required under the Paperwork Reduction Act.
Privacy advocates remain concerned about the scope of data collection and the types of injuries being screened, including those outside CPSC's jurisdiction. CPSC officials have stated that the agency will not collect information unrelated to its mandate and will publish a full list of diagnosis codes to be screened by KONZA. For more on the broader debate over government data sharing and privacy safeguards, see this related coverage on calls for stronger protections in public data systems.
CPSC expects NEISS-R to go into effect in 2027. The agency says it will continue working with hospitals and consumer groups to address concerns and ensure the system supports public health while protecting patient privacy.
The Consumer Product Safety Commission is an independent federal agency responsible for protecting the public from unreasonable risks of injury associated with consumer products. Its injury surveillance system helps identify hazardous products and supports recalls, safety standards, and public health initiatives. The modernization of NEISS is intended to improve the speed and accuracy of injury detection, but the agency faces ongoing scrutiny over data privacy and transparency as it implements the new system.
