CMS Just Made UDIs a Compliance Requirement. Here's What That Means for Hospitals and Health Systems
For years, the healthcare industry has talked about the promise of Unique Device Identifiers. Now, federal regulators are requiring hospitals to attest to UDI capture as part of the Promoting Interoperability Program, effectively linking device identification to the federal incentive structure that already governs meaningful use of health information technology.
On April 14, 2026, the Centers for Medicare and Medicaid Services published a proposed rule that would add Unique Device Identifiers for implantable medical devices as a measure within the Public Health and Clinical Data Exchange objective of the Promoting Interoperability Program. This marks the first time CMS has proposed requiring UDI attestation as part of this program, and it represents a significant shift in how seriously the U.S. government is treating UDI adoption in electronic health records.
For supply chain and health IT leaders, this is not a distant policy development. It is a preview of where compliance requirements are heading, and the organizations that build their UDI infrastructure now will be far better positioned than those who wait.
Why FDA Created the UDI System in the First Place
The UDI system was not designed as a bureaucratic exercise. FDA built it to solve real, recurring problems in patient safety, device tracking, and post-market surveillance.
Even today, identifying a specific medical device used in a procedure often requires piecing together inconsistent documentation from multiple sources. Device recalls may be difficult to execute because hospitals cannot quickly identify which patients have received an affected implant. Research into device performance over time is hampered by the same inconsistency
The CMS requirement emphasizing the use of the UDI system -assigning every medical device a standardized, globally unique identifier tied to the FDA's Global Unique Device Identification Database (GUDID) - addresses these issues. When a UDI is captured at the point of care and stored in the EHR, it creates an unbroken chain of documentation from manufacturer to patient. That chain supports faster recalls, more accurate adverse event reporting, and richer longitudinal research on device outcomes.
What the Rule Requires and Why It Matters Now
The relevant section of the proposed rule, found on pages 19629 through 19632 of the April 14 Federal Register publication, outlines CMS's intent to add UDI documentation for implantable devices as a measure under the Public Health and Clinical Data Exchange objective.
The practical implication is that hospitals participating in the Promoting Interoperability Program will need to demonstrate that they are capturing and recording UDIs for implantable devices in their EHR systems. That is not something most organizations can do effectively without first ensuring that the underlying product data is accurate, complete, and structured in a way that connects the item master to the EHR.
For many health systems, that is where the challenge lives. It is not a shortage of intent. It is a gap in the foundational data infrastructure that UDI-based workflows depend on.
The Infrastructure Gap: Where Most Health Systems Stand Today
Capturing a UDI at the point of care sounds straightforward. In practice, it requires several things to be working correctly at the same time.
The item in the supply chain system needs to have an accurate GTIN (Global Trade Item Number) associated with it. That GTIN needs to map correctly to the device's UDI in FDA's public version of GUDID - AccessGUDID. The EHR system needs to be configured to accept and store that identifier. And the scanning infrastructure at the point of use needs to be connected to both systems in a way that allows the capture to happen without adding burden to clinical staff.
Most health systems have pieces of this in place. Very few have all of it working reliably across their full catalog of implantable devices. Item masters are often incomplete, with missing or outdated GTINs. Duplicate records fragment product data in ways that make consistent mapping difficult. And the connection between supply chain systems and the EHR, particularly for device documentation, is frequently underdeveloped.
That gap is exactly what needs to close for hospitals to meet the intent of the CMS proposed rule and will help not only improve supply chain efficiency but have a significant impact on patient care and safety
How Symmetric Helps Hospitals Build the Foundation for UDI Compliance
This is where Symmetric's work becomes directly relevant to the compliance pathway hospitals are now navigating.
Symmetric's platform enriches item master data at scale, For implantable devices specifically, that means ensuring that every relevant item in the catalog carries an accurate, current GTIN that can be connected to the FDA's AccessGUDID and used as the basis for UDI capture workflows.
But the work goes beyond GTIN validation. Symmetric also populates and maintains implantable status flags, manufacturer data, catalog numbers, and clinical attributes that support both billing documentation and the kind of device-level traceability the CMS rule is designed to encourage. When those attributes are accurate and complete, the downstream systems that depend on them, including EHR platforms like Epic, can help clinical decision making and reduce medical errors.
That integration is exactly the kind of infrastructure the CMS proposed rule is designed to incentivize. Health systems that have it in place will be able to document UDI capture for implantable devices reliably. Those that do not will face the same challenge they face with other data-dependent compliance requirements: the policy is clear, but the data is not ready.
The Broader Value: Beyond Compliance
It is worth being direct about something. Compliance with the Promoting Interoperability Program is not the only reason to care about UDI infrastructure. It may not even be the most important one.
When UDIs are captured consistently at the point of care and stored accurately in the EHR, health systems gain capabilities that extend well beyond regulatory attestation. Recall response becomes faster and more precise because the organization can identify which patients received a specific device lot. Clinical research into device outcomes becomes more reliable because the data is consistent and traceable. Supply chain visibility improves because consumption data at the point of use reflects actual device-level detail rather than approximations based on order quantities.
For health systems investing in clinical data strategy, accurate UDI capture is foundational infrastructure. The CMS proposed rule creates a compliance reason to build it. The clinical and operational benefits are reason enough on their own.
What to Do Now
The CMS rule is proposed, not final. But the direction is clear, and the infrastructure work required to comply does not happen overnight. Health systems that begin now will have the advantage of time. Those that wait for a final rule will be competing for implementation capacity alongside every other organization in the country facing the same deadline.
One important step health systems can take right now is to make their voice heard in the rulemaking process. Symmetric is joining AHRMM, SMI, and other healthcare supply chain and health IT communities in submitting comments on the proposed rule to CMS. Public comments are one of the primary mechanisms through which hospital operators can ensure that the real-world impact on their workflows, systems, and staffing is reflected in how the final rule is written.
CMS has specifically invited comment on a range of practical questions that matter deeply to health systems:
How should a performance-based measure with a numerator and denominator be designed, and how should the denominator population be defined?
Which categories of implantable devices would present the greatest challenges for consistent UDI capture?
How should the data quality of captured UDIs be validated, including whether EHR systems should verify UDI accuracy against the GUDID?
When multiple implantable devices are used in a single care episode, how should complete documentation requirements be handled?
Should UDI requirements extend beyond eligible hospitals to settings like ambulatory surgery centers, skilled nursing facilities, and office-based practices?
What technical barriers, including barcode scanning infrastructure, EHR limitations, and supply chain integration gaps, currently stand in the way of broader UDI adoption?
These are not abstract policy questions. They are operational questions that supply chain leaders, health IT teams, and clinical staff are best positioned to answer. If your organization has experience with point-of-use scanning, EHR integration for device documentation, or item master data challenges related to implantable devices, that experience is exactly what CMS needs to hear before this rule is finalized. Comments received will directly inform future rulemaking, including how performance thresholds are set and whether phased implementation timelines are considered.
The starting point is understanding the current state of your GTIN and implantable device data. How complete is your item master coverage for implantable products? How many of those items have validated, current GTINs? How are those identifiers currently flowing into your EHR environment?
Symmetric's platform is built to answer those questions and to close the gaps the answers reveal. Whether your priority is preparing for the CMS compliance requirement, supporting a point-of-use scanning initiative in Epic, or building the data foundation for stronger clinical and research outcomes, the work starts with the same thing: accurate, maintained product data that connects supply chain operations to clinical documentation.
The UDI requirement is coming. The data infrastructure to support it is available today.
To learn more about how Symmetric can help your health system prepare, reach out to our team or explore your current GTIN coverage on the platform.
