Cell and Gene Therapy Chain of Identity Software: Why One Patient's Only Dose Cannot Be Managed in a Spreadsheet

Why an autologous therapy is unlike any supply chain you have run before

A patient is enrolled at a treatment centre. An apheresis slot is booked, and it has to line up with a manufacturing slot that was reserved weeks earlier and with the patient's own clinical readiness, which can change on the day. Cells are collected, labelled, packed into a cryoshipper and moved by a specialist courier to a manufacturing site, possibly on another continent. Manufacturing runs for days or weeks. Release testing follows, and sterility results do not come back quickly. The finished product ships back, thaws at the bedside, and is infused into one specific person.

Every conventional supply chain assumption fails here. There is no interchangeable inventory: this bag belongs to this patient and to nobody else. There is no safety stock. There is no reorder if it is lost, because the starting material came out of a patient who may not be well enough to donate again. The constraint that governs the whole schedule, a manufacturing slot tied irrevocably to a named individual, has no equivalent in any enterprise resource planning (ERP) system ever built.

Chain of identity is the discipline that keeps the patient and the product linked at every handoff. Chain of custody is the record of who held it and under what conditions. Break either and you have a product that cannot be administered, which means a patient who does not get treated.

What TrakCel, Title21 and Vineti actually cover, and where they stop

This is a small category with real specialists, which is unusual and worth respecting. TrakCel was built for exactly this problem and handles orchestration across centres, couriers and manufacturing. Title21 brings quality system depth alongside orchestration. Vineti built a platform specifically for personalised therapy supply. If you are early and need to be running before your pivotal trial, buying one of these is very often correct.

Where organisations outgrow them tends to be at three points. The first is the treatment centre experience. Every hospital has its own apheresis scheduling reality, its own cell processing laboratory practice, its own electronic health record and its own tolerance for yet another vendor portal. A coordinator who has to log into three sponsor portals for three therapies will use whichever is least painful and email about the rest. Sponsors that build tend to do it because the centre facing experience is what determines their time to treatment, and time to treatment is what determines whether the therapy reaches the patient.

The second is manufacturing integration. Slot capacity, batch record execution, deviations and release testing live in your manufacturing execution and quality systems. An orchestration layer that cannot see real slot availability is scheduling against a guess, and the guess is maintained by a person in a spreadsheet.

The third is the shape of your specific therapy. Allogeneic products with lot based inventory, therapies with a bridging step, gene therapies with vector supply constraints, and products with in country manufacturing requirements all pull the model in different directions. Configuration only reaches so far, and each change becomes a vendor request with a quotation and a lead time you do not control when a launch date is fixed.

Chain of identity is a labelling and verification problem, not a database field

The identity chain is only as strong as the moment of physical handoff. A bag leaves the apheresis suite with a label. That label has to be verifiable at receipt in manufacturing, at every in process step, at release, at shipment, at receipt in the hospital pharmacy, and at the bedside immediately before infusion. Anywhere a human reads a number and types it, you have introduced a failure point.

ISBT 128 is the international labelling standard used for cellular therapy products, and building to it rather than inventing your own identifier scheme is one of the clearest decisions in this domain. It gives you machine readable identifiers that hospital systems and cell processing laboratories already understand. Alongside it you need a deliberate design for the deidentification boundary: the manufacturing site should not receive patient identifiers, but the identity link must still be reconstructable end to end by the sponsor. That is a permission and key management design, and it has to be settled before anything else is built.

The verification steps themselves belong in software with a scan at every handoff, a hard stop on mismatch, and a record that includes who scanned, when, and at which location. A mismatch at the bedside is a catastrophe averted. A mismatch discovered in a report a week later is an investigation.

Scheduling backwards from a manufacturing slot

The scheduling problem is the operational heart of the system, and it runs backwards. A manufacturing slot exists on a date. From that date you derive the apheresis window, which has to fit the centre's collection capacity and the patient's clinical status, including any washout from prior therapy. The courier has to be booked for a specific pickup with a validated cryoshipper that itself has a charge duration. Release testing takes a known number of days, which sets the earliest infusion date, which the centre needs in order to book a bed and a bridging plan.

Any change ripples in both directions. A patient becomes unwell and the apheresis slips by four days, so the manufacturing slot is either held, released to another patient or lost. Sterility testing flags an out of specification result and the infusion date moves, so the centre's bed booking and the patient's travel arrangements have to change. A system that cannot recalculate the whole chain from any single change is not orchestration, it is a set of forms.

What a good build produces is a single view per patient showing every step, its planned and actual date, who owns the next action and what is at risk, visible to the sponsor and to the treatment centre at the same time. That shared view is worth more than any individual feature, because most delays in this industry are not caused by anyone failing at their job. They are caused by two parties holding different versions of the plan.

What a custom build must include

• Order intake from treatment centres with eligibility and enrolment data, and a portal a coordinator will actually use.
• Backwards scheduling from manufacturing slot to apheresis window, courier booking, release and infusion date, with full recalculation on any change.
• Chain of identity built on ISBT 128 identifiers with scan verification and hard stops at every handoff.
• A deliberate deidentification boundary between centre, courier, manufacturing and sponsor, with the link reconstructable only where it should be.
• Chain of custody with courier events, cryoshipper temperature records and exception handling when an excursion occurs.
• Manufacturing integration for real slot capacity, batch status, deviations and release disposition.
• Release testing tracking including tests whose results arrive after shipment, and the conditional release paths your quality system defines.
• Label generation and reprint control, because a reprinted label is a chain of identity risk and needs its own audit.
• Exception and deviation management that links directly to the patient and the batch rather than living in a separate quality system.
• Full audit trail under 21 CFR Part 11 and support for the evidence your quality system and accreditation bodies require.

What it costs and how long it takes

Across the regulated orchestration work Digital Heroes has delivered, a first release covering centre ordering, backwards scheduling and chain of identity runs $150,000 to $320,000 and ships in 18 to 26 weeks. A full platform adding courier and cryoshipper tracking, release testing, labelling, infusion scheduling, centre portals and manufacturing integration runs $400,000 to $1,000,000 across 12 to 24 months.

What drives the number up specifically here: the number of treatment centres and whether any of them require an interface into their own systems rather than a portal. Multiple manufacturing sites, particularly across regions with different regulatory expectations. Courier integrations, which are per provider. Computer system validation, which in this domain is not optional and typically adds twenty to thirty percent. Multi therapy support, if you intend to run more than one product through the same platform, which is worth designing for early because retrofitting it is expensive. What keeps it down: one therapy, one manufacturing site, and the first ten centres.

Build versus buy, stated plainly

Buy TrakCel, Title21 or Vineti if you are pre pivotal, running a small number of centres, and your priority is being compliant and running quickly. A build will not beat them on time to first patient and we would tell you so directly rather than take the project.

Build when two or more of these are true. You are approaching or past commercial launch and time to treatment is a competitive and clinical issue you intend to own. You have more than a handful of centres and coordinator experience is materially affecting your slot utilisation. Your manufacturing capacity model needs to be visible live to scheduling rather than reconciled weekly. You have more than one therapy and want one platform rather than three vendor relationships. Or your therapy's shape, allogeneic lots, a bridging step, regional manufacturing, does not fit the configuration surface you were sold.

How to choose a developer for cell and gene therapy software

Ask them to explain chain of identity and chain of custody as separate concepts, and to describe where the deidentification boundary sits between centre, courier, manufacturer and sponsor. A developer who treats these as one thing will build a system that either leaks patient identity to a manufacturing site or loses the link entirely.

Ask how the schedule recalculates when apheresis slips by four days. If the answer is that a coordinator updates the dates, they have built forms rather than orchestration and your operations team will still be living in a spreadsheet.

Ask what they have actually integrated, by name. A courier's tracking interface, a manufacturing execution system, a hospital scheduling system and a label printer are four different problems, and the last one has a compliance dimension most developers do not expect.

Ask who owns the code, the validation package and the infrastructure, and get it in writing before kickoff. At Digital Heroes the client owns all three from the first commit. In this domain that ownership is also a business continuity matter: a system that schedules patient treatment cannot be hostage to a commercial dispute with a supplier.