In an autologous therapy, the product is made from one patient and can only be given back to that patient. Everything in gene therapy logistics follows from that fact. There is no second batch on the shelf and no way to make good a mistake after the event.

Chain of identity is the control that keeps the link intact: the unbroken, verified association between an individual patient, the starting material collected from them, every intermediate produced during manufacture, and the finished product returned for infusion. Break it and the product is worthless at best and lethal at worst.

Teams new to cell and gene therapy often treat chain of identity as a synonym for chain of custody. It is not. The two answer different questions and fail in different ways.

Three chains, three questions

Chain of identity answers: whose material is this? It is the verified link from patient to starting material to intermediate to finished product and back to the same patient, carried by identifiers, labels, scans and reconciliation records.

Chain of custody answers: who has held this, and when? It is the documented record of control and accountability for the physical material as it moves and is stored, including every transfer between organisations and every signature.

Chain of condition answers: what has this been exposed to? It is the environmental record of temperature, and where relevant shock, orientation and time out of controlled storage, evidenced by calibrated monitoring.

All three are needed. Only identity has a failure mode that no downstream control can recover.

Why an identity break is unrecoverable

Consider a patient scheduled for an autologous cell therapy. They undergo apheresis, the material is cryopreserved and shipped to a manufacturing site, and in the days before the product returns they receive lymphodepleting chemotherapy to prepare them for infusion. That conditioning is not reversible on demand.

If the wrong product arrives, there is nothing correct to substitute. The patient's own starting material may already have been consumed, and a new apheresis, manufacturing slot and conditioning cycle take weeks the patient may not have. If the wrong product is infused, they receive another individual's genetically modified cells, with an immunological outcome ranging from serious to fatal.

A mislabelled carton of tablets is a recall, an investigation and a replacement batch. Serious, expensive, recoverable. In gene therapy logistics the same class of error ends that patient's treatment. That asymmetry is why identity attracts controls which would look excessive anywhere else in pharmaceutical distribution.

Maintaining chain of identity in gene therapy logistics

The unique identifier and pseudonymisation

Identity control begins at enrolment, before any material exists. The patient is assigned a unique identifier, sometimes called a COI number, which follows every container, record and system entry through the vein-to-vein journey.

That identifier is deliberately not the patient's name. Material crosses organisational and often national borders, and the people handling it in a warehouse or on an aircraft have no need for personal data. Pseudonymisation preserves the link while protecting the individual: the identifier is meaningless outside the systems authorised to resolve it, but sufficient to route the right unit to the right patient. The treatment centre holds the key.

Labelling at collection

Labels are applied at apheresis, before the material leaves the collection centre, and must survive everything that follows. Units destined for cryogenic storage face conditions ordinary pharmaceutical labels are not designed for: adhesives that lose grip at very low temperatures, print that cracks or fades, ink that smears on thaw, and frost that makes a barcode unreadable at the moment it needs scanning.

Label qualification therefore covers adhesion at the storage temperature, print durability through freeze and thaw, legibility under frost, and scannability of barcode and any RFID tag through the packaging. Human-readable text sits alongside the machine-readable code, because the fallback when a scanner fails is a person reading the label.

Scan verification at every handoff

The operating principle is simple: nothing moves without a scan. Each transfer point, collection centre to courier, courier to manufacturing site, manufacturing to storage, storage to treatment centre, requires the identifier to be read and matched against the expected shipment. Mismatches stop the process rather than generating a note for later review. At the highest-risk steps, two trained individuals independently confirm identifier, product and destination, and both records are retained.

The orchestration platform

Most established programmes run a COI and COC platform holding the patient schedule, the manufacturing slot, shipment records, scans and condition data in one place. Its value is not the database. It is seeing a mismatch in real time, before the material moves further, and reconciling apheresis to infusion in a single record set when a regulator asks.

Reconciliation and the bedside check

Identity is verified again on receipt at the treatment centre, against the shipping documentation and the patient record, and once more at the bedside immediately before infusion. The final check is deliberately independent of everything upstream, because it is the last opportunity to catch an error every previous control missed.

The failure modes that matter

Most identity breaks come from a small number of recurring causes.

Manual transcription. Every time an identifier is typed rather than scanned, error is introduced. Transposed digits are hard to spot because the result still looks like a valid identifier.

Label loss or illegibility. Adhesive failure at low temperature, frost, or damage in handling. If the only label is gone, identity depends on inference, and inference is not evidence.

Mixed shipments. Consolidating more than one patient's material into a single shipper saves money and creates the conditions for a swap. Where unavoidable, physical segregation and independent verification of each unit are required.

System outages. Platforms fail. Every programme needs a validated paper fallback with the same verification steps, staff trained to use it, and a route for reconciling the paper record back into the system.

Organisational handoffs. Where responsibility passes between companies is where assumptions live. Technical agreements should state who verifies what, in what sequence, and who is called when a check fails.

Controls, evidence and audit

Regulators expect the identity chain to be demonstrable, not asserted: qualified labelling, validated systems, trained and assessed personnel, deviation management that treats near misses as reportable, and records allowing full reconstruction of the donor to recipient link long after treatment. Traceability retention for ATMPs runs far beyond the periods conventional medicines require, so archive strategy belongs in the design.

Running a mock case end to end, checking that every scan, signature and record lines up, is the practical way to find out whether the system works before an inspector or a patient does.

Key takeaways

• Chain of identity links a patient to their material and back; chain of custody records who held it; chain of condition records what it was exposed to.
• An identity break in an autologous therapy cannot be corrected downstream, because there is no replacement batch and the patient may already be lymphodepleted.
• Pseudonymised identifiers, cryo-qualified labels, scan verification at every handoff and two-person checks at critical steps are the working controls.
• Manual transcription, label failure after freezing, mixed shipments and system outages cause most real-world identity risk.
• Paper fallbacks, clear technical agreements at handoffs and long-term record retention turn the controls into evidence.

Talk to Central Pharma about your ATMP supply chain

Identity controls are only as good as the records behind them, which is where a licensed packer earns its place. Central Pharma has handled regulated pharmaceutical product since 2006 from Bedford, under MHRA MIA and WDA(H), with three Qualified Persons and QP release to more than 60 countries. The site operates ambient, +2°C to +8°C refrigerated and −20°C frozen storage in temperature-monitored warehousing, with cryogenic handling below −150°C arranged through specialist approved partners. For labelling of sterile-filled vials and ampoules, kitting, inspection, pick and pack and dedicated project management, each step scanned, reconciled and documented, get in touch.

To stay informed on our latest thinking and technology developments, follow us on LinkedIn.

Contact Us Today

View all news