When a hip implant, pacemaker, or surgical mesh is recalled, hospitals often cannot tell which of their patients received it. Medicare is moving to close that gap.
Under the fiscal year 2027 inpatient payment final rule, the Centers for Medicare and Medicaid Services finalized the measure starting in 2027, adding Unique Device Identifiers for Implantable Medical Devices to the Public Health and Clinical Data Exchange objective within the Promoting Interoperability Program, beginning with the calendar year 2027 electronic health record reporting period.
The measure asks hospitals to attest that they use certified electronic health record technology to capture and store the complete identifier for each implantable device used in patient care. It sounds like a records requirement. It is a recall notification requirement in disguise.
Problem the Measure Addresses
Medical device recalls happen regularly, and some involve devices already inside people. Metal-on-metal hip components, cardiac leads, surgical mesh, and infusion pumps have all been subject to recalls affecting patients who had already received them.
Notifying those patients requires knowing who they are, which requires knowing exactly which device went into which body. That link has historically been weak. Device information frequently lived in operating room logs, supply chain systems, or paper stickers in a chart rather than in a structured, searchable field in the electronic record.
The result is that when a recall is announced, a hospital may be unable to generate a list of affected patients without a manual chart review that can take weeks, or may be unable to generate one at all for procedures performed years earlier.
The consequences are not limited to recalls. Clinicians need device information to answer a question that comes up constantly in emergency departments and imaging suites: whether a patient's implant is safe in an MRI scanner. Getting that wrong can cause serious injury.
Anatomy of a Unique Device Identifier
The identifier system is not new. The FDA established it in 2013, and it has two components that do different jobs.
The device identifier specifies the type of device and its manufacturer. The production identifier carries lot and serial numbers, along with expiration date and date of manufacture. Together they distinguish one particular implant from every other unit of the same product.
That distinction is what makes targeted notification possible. A recall usually covers specific lots rather than every unit ever made, so a hospital that recorded only the device model cannot tell whether a given patient's implant is affected.
Identifiers appear on device labels in both human-readable and machine-readable formats, which is what allows a scanner in an operating room to capture the information without manual entry.
Federal health IT rules have required certified electronic record systems to be capable of storing implant identifiers for years. The gap has been between capability and consistent practice, which is what this measure targets.
Attestation Now, Possibly Performance Later
The measure's design matters for how much it will actually change.
As adopted, it is attestation-based. Hospitals attest to using certified technology to electronically capture and store the complete identifier for each implantable device subject to identifier requirements. They do not, at this stage, report what percentage of implants were successfully captured. Hospitals answer yes or no, or claim an applicable exclusion, and it is one of seven measures under the exchange objective.
CMS has sought feedback on moving to a performance-based approach in future years, which would require hospitals to report actual capture rates. That would be the more meaningful version, and readers following this should watch for it. The proposed rule fact sheet describing the measure lays out the original design.
The measure sits within the Promoting Interoperability Program, which ties a portion of hospital payment to demonstrating meaningful use of certified electronic record technology. Hospitals that do not report face a payment reduction, which is the enforcement mechanism.
The same rule made other interoperability changes. Electronic prior authorization becomes an optional bonus measure in 2027 and mandatory in 2028, and mandatory reporting for implant identifiers begins in 2027 alongside a nationwide expansion of the joint replacement bundled payment model. CMS estimated the rule would increase overall inpatient hospital payments by roughly $2.1 billion in fiscal 2027.
Records Patients Can Request and Keep
Patients do not need to wait for hospitals to solve this, and keeping personal records is the most reliable protection.
Anyone receiving an implant should ask for the device identifier before leaving the hospital. Many manufacturers provide a patient identification card, and the operative report and implant log both typically contain the information. Photographing the card or the label sticker takes seconds and creates a record that survives changing hospitals, insurers or states.
The information worth having is the manufacturer, the device name and model, the lot or serial number, and the implant date. That set is what allows anyone, including a future clinician, to check a device against a recall notice.
The FDA maintains a public database called AccessGUDID that lets anyone look up a device identifier and see the product it corresponds to. FDA recall notices and the agency's medical device recalls page are searchable, and patients can check a device against them directly.
Anyone who suspects a problem with an implanted device should contact their surgeon or the implanting hospital rather than acting on a recall notice alone. Many recalls do not require removal, and explant surgery carries its own risks. Suspected device problems can also be reported to the FDA through MedWatch.
Symptoms that warrant prompt evaluation after any implant include increasing pain, swelling, redness or drainage at the site, fever, or a new loss of function.
The bottom line: Medicare will require hospitals to capture unique device identifiers for implants starting with the 2027 reporting period; the measure is attestation-based for now with a possible shift to performance reporting later, and patients can protect themselves immediately by requesting and keeping their own device information.
Key Questions Answered
What is a unique device identifier? A code the FDA has required on medical devices since 2013. It has two parts: a device identifier naming the type and manufacturer, and a production identifier carrying lot, serial number, expiration and manufacture date.
What did CMS adopt? A measure requiring hospitals to attest that they use certified electronic health record technology to capture and store the complete identifier for each implantable device, beginning with the calendar year 2027 reporting period.
Where does the measure sit? Within the Public Health and Clinical Data Exchange objective of the Medicare Promoting Interoperability Program, as one of seven measures under that objective.
Why does this matter for recalls? Recalls usually cover specific lots. Without the production identifier stored in a searchable record, a hospital cannot determine which patients received an affected unit.
Is the measure performance-based? Not initially. Hospitals answer yes or no, or claim an exclusion. CMS has sought comment on requiring actual capture rates in future years.
What should a patient ask for after receiving an implant? The manufacturer, device name and model, lot or serial number, and implant date, along with any patient identification card the manufacturer provides.
Where can someone look up a device? The FDA's AccessGUDID database allows lookup by device identifier, and the agency's medical device recalls page is searchable.
