The Consumer Product Safety Commission Shouldn't Need Our Personal Information. Especially Not Our Health Records.
Injury statistics are important, and so is modernizing record-keeping and accessibility. Vacuuming up personal and health data is something else.
Here at RideApart, you've probably noticed by now that among other things we regularly cover, powersports recalls are definitely in the mix. Why? Because we want everyone who reads this site to know if something has an active recall, so they can hopefully get it remedied.
Obviously, powersports isn't an area that's risk-free. But if there are product defects that affect safety, we want to amplify the message to make sure as many people see it as possible.
Knowledge, as they say, is power.
Our two most primary sources of recall information come from the US National Highway Traffic Safety Administration (more commonly referred to as NHTSA) for on-road vehicle recalls, and the US Consumer Product Safety Commission (CPSC) for off-road vehicle and other product recalls. Occasionally, we will also talk about Transport Canada, which performs a similar function to both of the aforementioned US agencies for our neighbors to the North, especially in a case where a recall affects vehicles sold in both countries.
As such, we spend a lot of time looking at the official websites of these agencies. If you look at the US CPSC's website, at the time of writing, you'll find six separate categories under the heading "What We Do." I'll screencap it for you, and also write it out here. According to the US CPSC, it covers: Recalls and Product Warnings, Safety Education, Consumer Assistance, Small Business Assistance, Public Calendar, and NEISS Injury Statistics.
Hang on to that very last item that the CPSC covers, because it's what we're diving into here, and it could potentially affect anyone who lives in the US, or who visits the US and has the bad luck to have to visit an emergency room while they're here.
How About No
But Wait, Aren't Injury Statistics A Good Thing?
Keeping injury statistical data can be of great benefit to a society, for sure. And if you're the CPSC, it can also help to inform the agency on consumer products they may need to keep a close eye on. For example, if you suddenly receive reports that a whole lot of parents of small children have had to bring their kids to their local emergency room because a specific model of dresser fell over and hurt them, statistics there are incredibly helpful.
As we've discussed before, companies exist to make money; once again, that is not a value judgment; that is a statement of fact. And so, asking a company to investigate itself, no matter how well-meaning some individuals within that company might be, is naive at best and disingenuous at worst.
There needs to be a balance between governmental oversight and overreach, of course. But the fact remains that there does need to be some level of oversight in order to compel companies to do the right thing. If that dresser is dangerous because of a product flaw, then that flaw needs to be addressed. If a youth ATV could seriously injure or kill kids, then that needs to be addressed, too.
Humans have biases; that's why it's important to have multiple viewpoints represented instead of stacking the agency entirely with folks representing one point of view or another. Because humans are biased, you need some type of balance to hopefully do well by the consumers you're tasked with protecting.
So What's The Problem?
On July 27, 2026, KFF Health News, a nonprofit US healthcare industry newsroom, published a bombshell investigation that should alarm any American who values their data privacy. I'm not writing this to be dramatic; I'm writing this because it is truly that serious.
The thrust of its investigation is neatly summed up in its opening paragraph,which reads, "A tiny federal agency tasked with protecting the public from injuries caused by lawn mowers and coffeemakers is demanding that some of the nation’s biggest health systems turn over detailed, personally identifiable medical records of all patients who seek help at their emergency rooms."
If it was just that paragraph without any actual investigative reporting to back it up, it could easily be dismissed as some rando venting on the Internet. (There are lots of those; we know!) However, because KFF actually spoke to representatives from multiple hospitals about what the CPSC has been pressuring them to do, and the information they've been asked to hand over, to invertly paraphrase Gertrude Stein, this time, there is a there there.
It's not just reports from individuals at hospitals around the nation who have been approached in this manner by the CPSC, either. KFF Health News also reviewed documents and emails, wherein the CPSC asked that "institutions provide all ER patients' identifiable information ... such as names, addresses, diagnoses, and other personal details ... to the contractor, Konza Health, for analysis." It goes on to state that further review of this correspondence revealed that participation in such data collection would be, in no uncertain terms, "mandatory" and/or "required."
KFF also notes that, in addition to the CPSC governing board kerfuffle that's played out over the past year, the single largest number of career CPSC staffers in the past 10 years actually left the agency in 2025. This data comes from the publicly available Office of Personnel Management, since the CPSC is a government agency.
Injury Statistics Are Important, And So Is Modernizing Record Keeping
Now, the CPSC posted its own press release about its plans to modernize its injury surveillance system on July 22, which KFF says came after it started asking the CPSC questions about this program.
As press releases are wont to do, this one touts the perceived benefits of this program. By the beginning of 2027, the CPSC says that it wants to streamline recordkeeping and data collection for this database, so that the whole country is represented, and so that hazards are detected more quickly.
It also specifically contains a bit about its plans for privacy and security, which I'll quote in full here.
Privacy and security by design.
NEISS-R will exchange data through a federally designated Qualified Health Information Network, supported by contractual privacy requirements and standardized security safeguards. The system is built on privacy-by-design principles: it will limit collection and retention to the minimum data necessary for CPSC's statutory mission, support de-identification before information reaches CPSC, and reduce manual handling of sensitive records. CPSC has also transitioned from an on-premises environment to a modern, cloud-based architecture built on standardized federal security controls—creating a more secure and privacy-centered foundation for injury surveillance.
Reading that paragraph, it would sound like the CPSC agrees that it doesn't need access to your private healthcare and personal data information to keep these injury statistics. Historically, some personal data has been collected in the past, but reportedly only for the 1 percent or so of injury cases where followup was needed. In other words, not for 99 percent of other cases.
If the CPSC really means that, then why do they need to collect that data from healthcare providers in the first place? Isn't the most efficient way to collect and analyze the data that it needs to NOT overcollect? Anyone who's ever recorded video with an action camera knows that it's much more of a pain in the butt to scrub through excessive amounts of footage, rather than simply capturing the things that you really need and want for your project.
Data collection is very similar in that way, only it usually takes up less space on your hard drive. If you truly plan to respect the privacy of the people whose data you're collecting, then isn't the most efficient thing to do to NOT collect our personal and private healthcare data in the first place?
Why would you go to all the trouble of collecting a bunch of data if you don't have any intention of using it? None of this adds up, especially if you're as concerned with efficiency as you say you are.
Database Breaches Are A Really Annoying Fact Of Life In 2026
By now, I'm guessing that you've gotten at least a few letters in the mail from companies you've never heard of, telling you that they regret to inform you that your personal data (maybe even healthcare-related; I know a few of mine have been) has been part of one privacy breach or another. For a few months, it seemed like I was getting at least one of those per month; and that's not counting emails on similar topics, either.
Eagle-eyed readers might have noticed a mention of another company up above, Konza Health. That's an additional healthcare analytics provider that the CPSC has contracted with to reportedly take in and process all this data that it wants from hospital ERs across the nation.
The more companies that have their hands on your personal and private healthcare data, the more potential points of failure there are in terms of hacks, data breaches, and your information ending up where you don't want it to be.
Do any of us want this? I know I don't.
This isn't a hypothetical, either. According to The HIPAA Journal, an analysis of healthcare data breaches reported to the Department of Health and Human Services' Office for Civil Rights showed that since 2022, there have literally been hundreds of healthcare data breaches across this nation each and every year.
To give you an idea of the scope of these breaches in terms of individual human lives impacted, In the 12 months spanning from June 2025 through May 2026, the month of October 2025 particularly stands out. Why? Because that's the month that a staggering 63,883,942 people across the US had their healthcare data breached.
In most of the past 12 months, too, the number of individuals dealing with a data breach was recorded in the millions. That's individual people, not dollars we're talking about. Millions of regular, everyday people, just having their data floating on the breeze for all to see.
Is any of this okay with you? Because again, it is not okay with me, and it should not be okay with any of us. Healthcare providers aren't immune to data breaches, either; in May 2026, the Washington Post reported on a data breach that exposed some Medicare health providers' social security numbers and other information.
Truly Nefarious, Or Just Annoying?
Now, we can't say for sure why the CPSC or the current administration might want to collect all this extra data. Naturally, some have speculated (and not without reason if you pay attention to the daily news) on the reasons why; that's outside the scope of this piece, which is already long enough.
But even if it's just for something comparatively benign, such as selling your data to marketing firms to target you for advertisements about medication or treatment for a condition you might have, it's still not acceptable. Period. Your personal and private healthcare data should be left to you, your healthcare providers, and any people you actively choose to share it with. That's it.
We can, we should, and we must do better. The US CPSC is a federal agency, so probably the best thing you can do is put pressure on your members of Congress if you live in the United States. If you want to contact the US CPSC directly, you can do that here.
RECOMMENDED FOR YOU
It Sure Looks Like Someone's Trying To Stack The Consumer Product Safety Commission. Product Safety Doesn't Care Who You Voted For
Stark Drops Factory Editions of VARG MX and EX Dirt Bikes. Major Suspension Upgrades
Waze Is Rolling Out An AI-Powered 'Motorcycle Mode.' Who Is Asking For This?
Hero’s Ather Investment Is Booming While Its Zero Stake Has Fallen Off A Cliff
Yamaha's Adorable Scooter Is Adventure Ready. Now Bring It To the States
Kawasaki Hid A Naked Superbike Under Its Best Retro Paint Yet
This Company Wants Flock Cameras To Spy On You Even More. Adds Device Tracking