n email correspondence with hospital technology officials, Konza Health President and CEO Laura McCrary also has described ERs’ participation as “required,” stipulating that they share patients’ records with identifying information.
McCrary told KFF Health News by email that the company is not using AI to process the records it receives, saying instead that Konza will use “advanced analytic parsing and filtering capabilities.” Roney, the CPSC spokesperson, did not answer questions about the use of AI.
For years, agency officials have discussed moving away from human contractors and automating NEISS to save time and money.
But without workers on-site, hospital staffers may no longer receive training to determine what clinical information is important to include for the CPSC. In short, the changes could dilute the quality of the product safety data the agency collects.
“They want to suck in as much data as possible, but I’m not sure how thoughtful they’re being about what is collected and what is actually needed by the agency,” said former CPSC chair Alexander Hoehn-Saric, one of the Democratic appointees Trump fired last year.
Wanted: Injuries from vaccines and stingrays
The CPSC’s new data collection appears to contradict its own 214-page operating manual, which instructs hospitals not to include identifiable information “such as names, birthdates, or addresses” when reporting cases.
The agency is supposed to receive patients’ identifying information only when needed for follow-up investigations, which happens in fewer than 1% of reported cases, according to the manual.
The CPSC has also historically limited the records it collects to minimize privacy violations in case of a data breach.
The risk is not hypothetical: From 2017 to 2019, the agency improperly released personal health information of around 30,000 people, a disclosure that a top Republican at the time called “concerning.”
Konza, however, will receive even more sensitive information on many more people. McCrary said in a statement that Konza will remove patients’ names, addresses, and medical information “not needed by CPSC” before sharing records with the agency.
Leaving a private organization to collect sensitive information introduces risks, including that it could be stolen or used for business purposes, said Hoffman, the Case Western professor.
“Very often, they will use information for marketing because now they’re going to know what conditions people have,” she said.
Roney said that its contract with Konza, which has not been made public, prohibits the organization from selling or marketing the data it collects.
The CPSC’s manual also identifies types of ER visits that should not be reported to the CPSC, which has jurisdiction over only certain consumer products. Excluded injuries are those caused by food, illegal drugs, medical devices, alcohol, or plants, as well as injuries that did not involve consumer products — such as a cut from a rock or broken bones from a fall on the ground — and suicide attempts by adults.
But in a contract offered to one hospital and reviewed by KFF Health News, Konza set no such limits on the information it would gather from ER records and said it would hold onto patient health information for at least 30 days.
In an email sent to hospital technology officials, McCrary wrote that Konza would provide CPSC with records when a patient is treated in the ER for any of more than 10,000 conditions. The expansive list of diagnostic codes Konza provided in the email includes injuries that do not involve consumer products.
Child injuries resulting from “poisoning by” vaccines or contact with stingrays, neither of which is regulated by the CPSC, are included in the list.
A limited number of hospitals once shared deidentified data on all injuries — regardless of product involvement — through the NEISS using the Centers for Disease Control and Prevention’s injury-tracking program. But the CDC halted that data collection, after funding and staffing were cut last year, and has not restarted it.
Pressure on hospitals
CPSC Chief Data Officer Elizabeth Puchek, who joined the agency late last year after engineering U.S. Citizenship and Immigration Services’ data system, has told hospitals in emails that they must seek an exemption from the program if they decline to share patients’ emergency room records with Konza.
The CPSC’s targeted outreach has included some of the nation’s largest urban and rural health systems, as well as small, publicly owned hospitals.
Staff members at Mary Greeley Medical Center in Ames, Iowa, said that Konza and federal officials told them their participation in the new program was mandatory. The hospital, which has long participated in NEISS, signed a new contract in April to share its ER records with Konza.
Yet the hospital is reevaluating its participation after being notified that the funds it received to participate in NEISS were “no longer available,” spokesperson Steve Sullivan said.
Several hospital executives, lawyers, and others have raised doubts about CPSC’s claimed authority.
Harborview Medical Center spokesperson Susan Gregg said the Seattle hospital’s emergency room has “voluntarily submitted de-identified data for many years, but we are not obligated to report this information.”
In Boston, Mass General Brigham has declined to participate in the new program, with spokesperson Kelly Mitchell saying that “to protect patient privacy, we are unable to provide these medical records.”
Henry Ford Health in Detroit; St. Luke’s in Boise, Idaho; and Sanford Health based in Sioux Falls, South Dakota — which together handle over a million ER visits a year — are among the health systems that have been approached but not yet entered into an agreement with Konza, according to representatives. Several of the nation’s busiest hospital systems targeted for the program — including the Mayo Clinic in Minnesota, Yale New Haven Hospital in Connecticut, Nationwide Children’s Hospital and the Cleveland Clinic in Ohio, and Baylor Scott & White Health in Texas — declined to answer questions about whether they’re participating.
Hoehn-Saric, the agency’s former chairman, said he was surprised that the CPSC would insist that hospitals provide identifiable records from all emergency room visits.
“This idea that they can simply demand patient information from a hospital and that the hospital would provide it — I really don’t understand the basis for that,” he said.
KFF Health News is a national newsroom that produces in-depth journalism about health issues and is one of the core operating programs at KFF — the independent source for health policy research, polling, and journalism.
