Agency’s Push to Gather ER Data Sparks Privacy Clash
What Happened — The U.S. Consumer Products Safety Commission (CPSC) announced a modernization of its National Electronic Injury Surveillance System (NEISS). To automate data collection, CPSC awarded a $15.9 M contract to Konza Health, a qualified health‑information network, which will request electronic health records (EHR) for every emergency‑room visit from at least 100 hospitals nationwide. Several large hospitals have publicly pushed back, citing concerns that the request is overly broad and could expose protected health information (PHI) beyond the narrow product‑injury scope.
Why It Matters for Compliance & Audit Readiness
- The initiative creates a third‑party data‑sharing flow that must be mapped to SOC 2 Privacy and Security principles (CC6.1, CC6.2) and to HIPAA’s “minimum necessary” requirement.
- Organizations need documented consent, data‑minimization, and de‑identification controls to demonstrate that any PHI shared with a contractor is limited, protected, and auditable.
- Continuous evidence of vendor‑risk assessments and privacy‑impact assessments (PIA) will be essential to satisfy auditors and regulators when a government‑mandated data‑collection program expands.
Who Is Affected – Large U.S. hospitals, health systems, and their EHR vendors; downstream impact on any organization that processes emergency‑room data for research or reporting.
Recommended Actions
- Conduct a privacy‑impact assessment of the Konza Health data‑exchange to verify that only the minimum necessary data elements are shared.
- Update SOC 2 privacy and security controls (e.g., CC6.1 – Data Classification, CC6.2 – Data Retention/Destruction) and capture evidence of de‑identification and access‑logging for all outbound PHI.
- Initiate a vendor‑risk review of Konza Health, including its security certifications, breach‑notification procedures, and contractual data‑handling clauses.
Source: DataBreachToday
Technical Notes – The data‑collection model relies on diagnosis‑code filtering, automated extraction, and transmission to CPSC via Konza Health’s secure platform. No specific vulnerability or breach has been reported; the risk stems from the scope of data shared and the third‑party processing environment. Source: same as above