"Medicare’s new requirement for hospitals to track unique device identifiers (UDIs) for all implantable medical devices, starting in 2027, marks a significant leap forward in patient safety, ensuring faster and more precise notification during critical device recalls."
The Centers for Medicare and Medicaid Services (CMS) has finalized a pivotal measure within its fiscal year 2027 inpatient payment final rule, mandating the capture and storage of Unique Device Identifiers (UDIs) for implantable medical devices. This initiative, set to commence with the calendar year 2027 electronic health record (EHR) reporting period, integrates UDI data into the Public Health and Clinical Data Exchange objective of the Promoting Interoperability Program. Essentially, hospitals will be required to attest to using certified EHR technology that can capture and retain the complete UDI for every implantable device used in patient care. While framed as a data capture requirement, its profound implication lies in its function as a sophisticated recall notification system, designed to bridge a long-standing gap in patient safety.
The impetus for this regulatory shift stems from the persistent challenges hospitals face when medical devices, ranging from hip implants and pacemakers to surgical mesh and infusion pumps, are recalled after being implanted in patients. Historically, pinpointing precisely which patients received a specific recalled device has been a laborious and often incomplete process. Device information frequently resided in disparate systems—operating room logs, supply chain management software, or even paper-based records—rather than being systematically integrated into a searchable field within a patient’s electronic health record. This fragmentation meant that upon a recall announcement, hospitals might struggle to compile an accurate list of affected individuals, often necessitating manual chart reviews that could take weeks or prove impossible for procedures performed years prior.
The ramifications of this data deficit extend beyond recall management. Clinicians frequently require detailed information about implanted devices to assess patient safety in critical situations, such as determining the compatibility of an implant with MRI scanners. Misinformation or a lack of readily accessible data in these scenarios can lead to serious patient harm. The UDI system, established by the Food and Drug Administration (FDA) in 2013, is designed to rectify this. It comprises two key components: the device identifier, which specifies the device type and manufacturer, and the production identifier, which includes lot numbers, serial numbers, and manufacturing and expiration dates. Together, these identifiers create a unique fingerprint for each individual implant, enabling targeted notifications during recalls that typically affect specific production lots rather than all units ever manufactured.
The UDI is affixed to device packaging and, in many cases, directly to the device itself, in both human-readable and machine-readable formats. This dual presentation is crucial, allowing for efficient data capture through scanning at the point of care, thereby minimizing manual entry errors and streamlining the process. While federal health IT regulations have, for years, mandated that certified EHR systems possess the capability to store UDI information, the gap has been in the consistent and widespread adoption of this capability in clinical practice. The new CMS measure directly addresses this disparity, aiming to move from theoretical capability to practical implementation.
The initial implementation of the UDI capture requirement is designed as an attestation-based measure. Hospitals will be asked to confirm, or "attest," that they are employing certified EHR technology to capture and store the complete UDI for each implantable device subject to UDI requirements. At this stage, hospitals will not be required to report the percentage of implants for which they successfully captured the UDI. Rather, they will respond with a "yes" or "no" or claim an applicable exclusion. This attestation is part of a broader suite of seven measures under the Public Health and Clinical Data Exchange objective within the Promoting Interoperability Program.
However, CMS has indicated its interest in evolving this measure towards a performance-based approach in the future. This would involve hospitals reporting actual UDI capture rates, a more robust metric that would provide a clearer picture of the program’s effectiveness. Stakeholders are advised to monitor future CMS rulemakings for potential shifts to performance reporting. The Promoting Interoperability Program incentivizes the meaningful use of certified EHR technology by tying a portion of hospital payments to compliance. Non-compliance, such as failing to report on required measures, can result in payment reductions, serving as the primary enforcement mechanism for this initiative.
Beyond the UDI mandate, the FY2027 Inpatient Prospective Payment System (IPPS) final rule introduces other significant interoperability enhancements. Electronic prior authorization, for instance, will transition from an optional bonus measure in 2027 to a mandatory requirement in 2028. The mandatory reporting for implant identifiers begins in 2027, coinciding with a nationwide expansion of the joint replacement bundled payment model. CMS has projected that these regulatory changes will collectively increase overall inpatient hospital payments by approximately $2.1 billion in fiscal year 2027.
While Medicare’s mandate represents a significant step forward in systemic data management, patients are empowered to take proactive measures to safeguard their own health information. The most reliable method of protection is to maintain personal records of implanted devices. Patients receiving an implant should request the device’s UDI before leaving the hospital. Many manufacturers provide patient identification cards, and this critical information is typically also documented in the operative report and implant logs. Photographing the patient identification card or the device’s label sticker takes minimal time and creates a durable record that remains accessible regardless of changes in healthcare providers, insurance plans, or geographic location.
The essential information to retain includes the manufacturer’s name, the device’s name and model, the lot or serial number, and the date of implantation. This comprehensive set of data allows patients, and importantly, future clinicians, to cross-reference the implant against recall notices accurately. The FDA offers a public database called AccessGUDID, which enables anyone to look up a UDI and retrieve corresponding product information. Furthermore, the FDA’s medical device recalls page is searchable, allowing individuals to directly check their implanted devices against publicly issued recall alerts.
In instances where a patient suspects a problem with an implanted device, the recommended course of action is to contact their surgeon or the implanting hospital directly, rather than acting solely on a recall notice. Many recalls do not necessitate device removal, and explant surgery carries its own inherent risks. Patients can also report suspected device malfunctions to the FDA through its MedWatch program. Symptoms warranting prompt medical evaluation after any implant include increasing pain, swelling, redness, or drainage at the surgical site, fever, or a sudden loss of function.
In summary, Medicare’s forthcoming requirement for hospitals to capture unique device identifiers for implants, beginning with the 2027 reporting period, is poised to significantly enhance patient safety and streamline recall processes. Initially an attestation-based measure, CMS is considering a future shift to performance reporting. Concurrently, patients are urged to actively request and diligently maintain their own implant device information, ensuring an additional layer of personal health security.
