Top Four FDA Compliance Issues for Hospitals and Health Systems: What They Are, Why They Matter, and What To Watch

An artificial intelligence (AI) triage model piloted in the emergency department can become a deterioration predictor on med-surg floors and then prioritized on a radiology worklist. A lab‑developed sepsis panel built in the core lab can drive antibiotic choices in the intensive care unit and triage decisions in the emergency department. A drug relabeled with a new National Drug Code (NDC) and barcode can impact pharmacy receiving to bedside scanning to claims.

Because products move between pharmacy, laboratory, IT, and bedside settings, federal applicability is nuanced, and assessments must be continuous and coordinated. This cheat sheet spotlights where that nuance shows up operationally:

1. Drug Supply Chain Security Act (DSCSA) requirements in the pharmacy.
2. Laboratory developed tests (LDTs).
3. AI and machine‑learning (ML) tools used for patient care.
4. The FDA’s proposed shift to a uniform 12‑digit NDC and modernized barcodes.

1. DSCSA: Electronic Drug Data Are Becoming the Pharmacy’s New Normal

The DSCSA is a federal law that, among other things, requires trading partners (manufacturers, repackagers, wholesale distributors, and dispensers, including pharmacies) to exchange standardized information about prescription drug products as they move down the supply chain and bars trading partners from accepting ownership of a product unless they receive the required DSCSA documentation from the selling trading partner.

While the DSCSA and many of its core duties have been in place for years, the final set of enhanced requirements to shift to exchanging fully electronic information that includes serialized package-level data for products is being implemented now, despite a statutory effective date of November 27, 2023. Recognizing the scale and complexity of achieving electronic, interoperable, DSCSA documentation exchange with serialized information, and the risk that large‑volume data discrepancies could disrupt the supply chain, the FDA took several actions in recent years to broadly extend trading partners’ compliance timeline for enhanced requirements.

As a final broad extension, the FDA allowed a phased ramp‑up by trading‑partner type during 2025; enhanced requirements take effect November 27, 2025, for all dispensers except “small dispensers” (i.e., those owned by an entity with 25 or fewer full‑time licensed pharmacists or pharmacy technicians as of November 27, 2024), which have until November 27, 2026. This matters for health system pharmacies regardless of when their deadline falls because, without well-functioning capabilities and processes, including ways to resolve electronic DSCSA data discrepancies, purchases and receipts can stall, delaying product availability and patient care.

2. AI/ML in Care: Software May Be a Device – Help the FDA Shape the Playbook

Software tools that reveal their rules so clinicians can independently verify the recommendation generally are not devices. By contrast, software that helps clinicians diagnose, predict risk, recommend treatments, or triage patients can be a medical device when it is intended for a medical purpose and clinicians cannot independently verify how it reached its output. For example, a transparent software Wells score calculator that shows its equations would not be classified as a device, but an AI‑enabled software application that flags intracranial hemorrhage on CT before radiologist review would be.

Many ML models fall into the device category because their inner workings are not transparent enough for independent review. There is no general exemption just because the software is used only inside a health system. For software deemed to be a device, the FDA expects sound ML practices, robust clinical validation, cybersecurity, and ongoing performance monitoring, supported by a quality system harmonized with international standards. The FDA also allows “predetermined change control plans” in device marketing submissions — such as 510(k)s, De Novos, and pre-market approvals (PMAs) — so certain model updates can occur later without a new filing if they stay within defined guardrails.

However, the agency’s regulatory framework for these devices is continuing to mature, and the FDA is actively engaging stakeholders on how to regulate AI in practice, including through a recent request for public comment on how to measure and evaluate the real‑world performance of AI‑enabled medical devices. This matters because the FDA’s explicit calls for robust collaboration — reflecting AI’s breadth and impact — gives hospitals and health systems and other front‑line stakeholders a uniquely pioneering role, with real influence over the agency’s evolving regulatory approach, even as building or deploying AI tools still triggers existing device obligations.

3. LDTs: Rule Rescinded, But FDA Oversight May Still Show Up

Laboratory developed tests (LDT) are tests that a clinical laboratory designs and runs in‑house, often to address clinical needs where no commercial test exists. Many larger hospitals and health systems routinely develop and use their own LDTs. In 2024, the FDA issued a rule to phase most LDTs into its medical device regulatory framework. However, the rule was vacated by a federal court in March 2025, and the FDA formally rescinded it in September 2025. As a result, the rule is not in effect.

Today, federal oversight of LDTs remains primarily under the Clinical Laboratory Improvement Amendments, overseen by the Centers for Medicare & Medicaid Services, while the FDA exercises targeted oversight in contexts that can trigger device obligations. For example, when a test or its components are distributed outside the originating lab, marketed to third parties, offered directly to consumers, used for donor screening, or packaged like a kit rather than a service.

Although the 2024 rule was vacated, the court’s ruling only addressed one type of LDT: those developed and validated for use in a single laboratory. This matters because rescinding the rule does not mean that the FDA’s position on LDTs is settled; if the agency redoubles efforts to regulate the technologies or modalities that enable, support, or frame an LDT or otherwise differentiate it from the type of LDT addressed in the court ruling, the FDA may yet find a way to flex its authority.

4. 12‑Digit NDC: A Proposed Standard That Will Ripple Across Health Care

NDCs are 10-digit numbers divided into three segments that serve as unique identifiers for commercially distributed human drugs in the United States. Today, there are multiple NDC formats in circulation because the NDC’s three segments have variable length combinations. Additionally, many in the health care industry are obligated to convert NDCs to 11 digits for billing paperwork by padding with zeros. The FDA oversees the NDC system and has issued proposed rulemaking to standardize the NDC to a single, fixed 12‑digit format and, in a companion proposal, to modernize barcode requirements so labels may use either linear or two‑dimensional symbols that meet defined performance standards. The agency currently projects finalizing the rule next year.

While the FDA anticipates an extended transition to the 12-digit NDC, the change will still be a heavy lift. NDCs are woven throughout health system operations — EHR medication files, automated dispensing cabinets, bedside barcode medication administration, materials management, wholesaler interfaces, repackaging, DSCSA documentation, and billing. This matters because factoring the coming 12‑digit and barcode end state into process and system decisions can prevent rework and reduce the risk of scanning failures, inventory mismatches, and claim denials when the transition begins. It also creates space to engage partners early to confirm transition plans and testing windows, and to embed clear roles, responsibilities, and timelines into contracts and service‑level agreements so accountability is defined before labels and data change.