Chain of IdentityChain of Identity

For autologous therapies, the product made from a patient's cells must go back to that same patient. A mix-up can be fatal. Chain of identity is the system of identifiers, labels, records and checks that prevents that.

It applies across organisations: hospital collection site, couriers, manufacturer, testing laboratories and the treatment centre.

Chain of custody records handoffs: who had the material, where and when, under what conditions. Chain of identity ensures the material is always correctly associated with the patient.

Both are needed. A perfect custody record of the wrong patient's cells is still a failure.

Programmes typically assign a unique identifier at collection that links to the patient without exposing unnecessary personal data. Standards such as ISBT 128 provide coding structures for products of human origin.

Labels should be durable under cryogenic storage and scannable at each step.

Critical points include collection, receipt at manufacturing, each processing step that creates a new container, final labelling, shipment, receipt at the clinic and bedside administration. Two-person or scan-based verification reduces error.

Every verification should be recorded with time and identity.

Many programmes use orchestration platforms to schedule collection slots, manufacturing capacity and logistics while carrying identity data. Integration between systems must preserve identifiers exactly.

Interfaces should be validated and errors made visible.

Identity data includes personal health information. Share only what each party needs and protect it under applicable privacy rules.

Coded identifiers help separate operational use from personal data.

Failure modes include manual transcription, relabelling during processing, look-alike identifiers, label damage at cryogenic temperatures and system interfaces that drop or truncate fields.

Design checks to catch these rather than relying on care alone.

V5 supports barcode-based lot and container tracking, genealogy, chain-of-custody style handoff records and electronic batch records with attributable entries, which can support identity checks in manufacturing.

V5 is not a patient orchestration platform and does not make clinical decisions; programme-level chain of identity design and verification remain with the sponsor and treatment sites.

Draw every point where a patient-specific container is created, labelled, moved or opened, and mark how identity is verified at each.

Any point relying on reading and typing a number is a priority for improvement.

Chain of identity is most discussed for autologous therapies, but allogeneic products matched to recipients and some personalised medicines also need identity links between donor, product and recipient.

The design principle is the same: unique identifiers, verified handoffs and clear accountability.

When a label is damaged, a scan fails or records disagree, the material should be placed on hold until identity is confirmed through a defined procedure. Never guess.

Investigate each exception and trend them; repeated scan failures may indicate label or printer problems.

People at clinics, couriers and manufacturing sites follow different procedures. Clear instructions, consistent label layouts and scan prompts reduce error.

Simulated runs with dummy material can test the whole chain before first patient use.

At receipt, a manufacturing technician scans the incoming cryobag and the accompanying shipment record. The identifiers match the scheduled patient slot, and receipt is recorded with time and user.

During processing, each new container is labelled from the system and scanned against the parent identifier before transfer, so a mislabel would be caught immediately.

Chain of identity is usually lost at handoffs: collection to courier, courier to receiving, receiving to manufacturing, and manufacturing to the treatment site. Each handoff should confirm identity with at least two independent identifiers and leave a record of who checked, when and against what.

• Scan the container label and compare it with the expected order or patient-specific identifier before accepting it.
• Stop and quarantine on any mismatch; never correct an identifier by hand without a documented investigation.
• Keep relabelling to a minimum and reconcile every label printed, applied and destroyed.
• Link chain of identity to chain of custody so location, temperature and identity records can be read together.
• Review the complete identity trail before release, including any exceptions and how they were resolved.

Training matters as much as systems. Operators should know why a two-identifier check exists and feel able to stop the process when something does not match.

1. Confirm the applicable requirement, product scope and decision owner.
2. Map the current method and the records already available.
3. Define terms, responsibilities, evidence and exception handling in the approved procedure.
4. Pilot the method on one representative process and challenge a difficult exception.
5. Train affected roles, approve the change and monitor whether the method works as intended.
6. Review after significant change and retain a transparent history of decisions.

Scale the formality to risk and complexity. A small operation still needs clear responsibilities and reconstructable evidence, while a multi-site operation also needs harmonised definitions, governance and comparison rules.

• Can a reviewer identify the source, owner, method and current approved version?
• Do summaries reconcile to original records and include unfavourable or missing evidence?
• Are exceptions visible, assessed and linked to the affected material, product or process?
• Are actions assigned, overdue items escalated and effectiveness reviewed?
• Have changes in product, supplier, equipment, method or regulation triggered reassessment?
• Does the record distinguish system support from the decision an authorised person made?

• Approved scope, definitions and responsibilities for Chain of Identity.
• Source records and identifiers that let a reviewer reconstruct the work.
• Methods, assumptions, calculations, exclusions and any data-quality limitations.
• Exceptions, investigations, decisions, approvals and resulting actions.
• Version history showing when the approach changed and why.

Records should be proportionate to the decision and usable by someone who was not present. Preserve original evidence and corrections rather than replacing it with an unexplained summary.

• Can users trace every summary value back to its source record and version?
• How are roles, permissions, signatures and corrections recorded?
• Can the workflow reflect our approved procedure without inventing a universal rule?
• What happens during an outage, and how are later entries distinguished?
• Can we test the highest-risk exception with realistic data before committing?
• Which decisions remain explicitly assigned to an authorised person?