AHA Comment Letter on Consumer Product Safety Commission Agenda and Priorities FY 2027 and/or 2028

August 12, 2026

Peter Feldman
Chairman
Consumer Product Safety Commission
4330 East-West Highway
Bethesda, MD 20814

Alberta Mills
Secretary
Consumer Product Safety Commission
4330 East-West Highway
Bethesda, MD 20814

Submitted Electronically

RE: Consumer Product Safety Commission Agenda and Priorities FY 2027 and/or 2028

Dear Chairman Feldman and Secretary Mills:

On behalf of our nearly 5,000 member hospitals, health systems and other healthcare organizations, our clinician partners — including more than 270,000 affiliated physicians, 2 million nurses and other caregivers — and the 43,000 healthcare leaders who belong to our professional membership groups, the American Hospital Association (AHA) appreciates the opportunity to provide comment on the Consumer Product Safety Commission’s (CPSC) agenda and priorities for fiscal years (FYs) 2027 and 2028. 

Hospitals strongly support efforts to mitigate injuries, including those caused by consumer products, and value the work of the CPSC to detect and act to achieve this aim. We recognize that early identification of potential product safety risks is necessary and therefore we support the strategic goal of strengthening data surveillance and analytic capabilities to detect hazards before they reach the public. To advance this strategy, the agency has announced and included in its strategic plan the modernization of the National Electronic Injury Surveillance System (NEISS).¹ Hospitals and health systems have begun receiving outreach from CPSC’s data vendor indicating that they are required to participate in this new effort. 

Modernizing the NEISS has the potential to improve product safety and reduce the administrative burden on participating hospitals. However, our members have expressed confusion and concern about the scope of patient information they may be asked to provide, whether the agency will shift from de-identifiable information requests and whether participation in the modernized NEISS system will be mandatory. As CPSC embarks on this modernization effort, the AHA urges the agency to 1) protect patient privacy by only collecting data that are minimally necessary for NEISS’ injury tracking and surveillance purposes and provide additional guidance on how CPSC will ensure compliance with data privacy and security laws, and 2) minimize added financial costs and administrative burden to the health care system by keeping hospital participation voluntary. We also recommend that the CPSC pursue a notice-and-comment period for the updated NEISS system before changes are finalized.

Below are our detailed comments.

BACKGROUND

Since the 1970s, the NEISS has functioned as a voluntary program that collects hospital emergency department (ED) visit data to identify injuries from a wide range of consumer products. Hospitals have a longstanding history of participation in this framework. 

The current NEISS system relies on manual review and coding of injuries, a labor-intensive process that has been a barrier to participation. The modernized NEISS system would draw ED visit data from hospital electronic health records (EHRs) and exchange it with the CPSC’s data contractor, which is a federally designated Qualified Health Information Network (QHIN). 

The AHA recognizes that if done appropriately, the migration of NEISS to electronic reporting and data exchange holds many potential benefits. Automation could reduce administrative burden for both the CPSC and hospitals, reduce manual entry errors and provide more timely access to data, which could result in quicker product recall alerts. In turn, this approach could encourage more hospitals to participate, providing the NEISS a larger sample size and more useful data to inform the CPSC’s work.

RECOMMEND VOLUNTARY PARTICIPATION

However, the AHA urges the CPSC to retain voluntary participation in the NEISS. Hospitals already contend with a range of mandatory reporting requirements from other federal and state agencies, all of which draw on limited resources. We appreciate that data reporting derived from EHRs can result in lower administrative burden and greater automation over time. However, it still requires the investment of IT resources and personnel to update systems, validate underlying data and ensure data are flowing as intended. In short, getting to automated data reporting can be time- and resource-intensive. We also note that maintaining voluntary participation would support the administration’s broader goal of achieving regulatory relief instead of adding new requirements. 

RECOMMEND LIMITING DATA REQUESTS TO MINIMUM NECESSARY ELEMENTS

The AHA also asks that the CPSC limit the scope of its data requests to only those data necessary for NEISS’ injury tracking/surveillance purpose. The current NEISS process shares only de-identified patient information to protect patient privacy while allowing the government to obtain the information necessary to identify potential injuries from products. Shifting from de-identifiable to personally identifiable data elements would mark a significant shift in the program and has raised concerns about how CPSC will ensure compliance with data privacy and security laws. As such, we also recommend that the agency provide additional guidance on how it will ensure compliance with data privacy and security laws. 

Federal privacy regulations generally require entities such as hospitals to take reasonable steps to limit the use or disclosure of, and requests for, personal health information to the minimum necessary to accomplish the intended purpose. HHS FAQs reiterate that for public health purposes, “For disclosures that are not required by law, covered entities may disclose, without authorization, the information that is reasonably limited to that which is minimally necessary to accomplish the intended purpose of the disclosure.”² In addition, from a cybersecurity perspective, one of the most effective ways to protect health information and mitigate the risk of a data breach is to ensure minimum necessary standards are upheld. For these reasons, we urge the updated NEISS to limit the types of data elements (e.g., personally identifiable information, ED codes, etc.) to only those necessary for injury tracking and surveillance. 

RECOMMEND NOTICE AND COMMENT PERIOD

Lastly, the CPSC’s NEISS modernization effort would benefit from a formal notice and comment process. This would provide an opportunity for hospitals, health systems and other stakeholders to identify gaps in the current process, offer possible solutions, and provide feedback on necessary data elements and technical workflows. Furthermore, this would support CPSC’s strategic priorities of “stakeholder engagement and transparency” and “interagency partnerships” as outlined in the 2026-2030 strategic plan.

Again, we appreciate the opportunity to provide feedback on NEISS modernization as part of the 2026-2030 CPSC strategy and FYs 2027-2028 priorities. Please contact me if you have questions, or feel free to have a member of your team contact Jennifer Holloman, AHA director of health IT policy, at jholloman@aha.org.

Sincerely,

/s/

Stacey Hughes
Executive Vice President
Government Affairs and Public Policy 

__________

¹ https://www.cpsc.gov/Newsroom/News-Releases/2026/CPSC-Modernizes-Decades-Old-Injury-Surveillance-System-to-Protect-More-Americans-Faster
² https://www.federalregister.gov/documents/2025/05/23/2025-09251/agency-information-collection-activities-extension-of-collection-national-electronic-injury