Cell and Gene Therapy Shipment Tracking: Identity and Custody

A tracker can tell you where a container was seen. It may also record temperature, light, shock or another condition. It cannot, by itself, prove that the material inside belongs to the intended patient, that every handover was authorised, or that the therapy remains suitable for use.

That distinction matters most in cell and gene therapy logistics. Some movements are patient-specific, time-critical and operationally difficult to replace. The temptation is to put every useful fact into one tracking portal. A safer design keeps identity, custody and telemetry as separate evidence layers, links them with controlled identifiers and makes each system responsible for the job it can actually perform.

What are the three evidence layers?

Chain of identity: is this the right material for the right patient?

Chain of identity connects the donor or patient, collected starting material, manufacturing process, finished product and intended administration. For autologous therapies, a break in that relationship can be clinically critical. The authoritative record normally belongs in validated clinical, manufacturing or therapy-orchestration systems—not in a general shipment-tracking portal.

The US FDA’s January 2024 CAR T-cell guidance says that labelling and tracking from collection through administration must be documented and recommends at least two unique identifiers for autologous products, with label checks built into the batch record. The details are jurisdiction-, product- and process-specific, but the design lesson is universal: identity controls must be explicit and independently verified.

Chain of custody: who controlled it, where and when?

Chain of custody records possession and responsibility across collection sites, couriers, airports, manufacturing facilities, depots and treatment centres. A useful custody event names the object, event time, location, handing and receiving roles, evidence method and any exception. A GPS point can support the story; it is not the handover record itself.

Telemetry: what did the device observe?

Telemetry is evidence from the monitoring device: time, location, temperature and, where fitted and appropriate, humidity, shock, tilt or light. Its meaning depends on sensor specification, placement, configuration, connectivity, time synchronisation and data handling. Missing reports may mean a network gap, shielding, power loss or device failure—not necessarily a missing shipment.

Layer	Authoritative question	Typical owner	What a tracker can contribute	What it must not claim
Chain of identity	Is this the correct material/product for the intended patient?	Clinical/manufacturing or therapy-orchestration system	Device ID, shipment ID and timestamped evidence linked through a controlled reference	Patient matching or identity assurance by itself
Chain of custody	Who had control, where and when?	Logistics/control-tower workflow, with defined quality records	Location, geofence, time and alert evidence around a handover	Proof of physical handover without a recorded custody event
Telemetry	What did the configured device observe?	Tracking/monitoring platform	Sensor, location, connectivity and device-health data	Product quality, release or disposition decision

Why should patient identity stay out of the tracker portal?

Most operational users do not need a patient name, hospital number or clinical detail to recover a delayed shipment. They need a controlled shipment or therapy reference, route, owner, escalation path and the minimum context required to act. The UK ICO describes data minimisation as keeping personal data adequate, relevant and limited to what is necessary. That supports a practical architecture: use a pseudonymous logistics identifier in the tracking environment, keep the identity link in the authorised clinical or orchestration system and expose only role-appropriate information.

Pseudonymisation is not anonymisation. If a reference can be linked back to a person, it remains protected data and still requires appropriate governance, access control, retention and security. The exact lawful basis, controller/processor roles and validation expectations must be determined by the organisation; a tracking supplier should not invent them.

What should happen at each hand-off?

The operating model should define a small set of controlled event types rather than treating every position as a business milestone.

Collection or packing: verify the authoritative therapy/shipment reference, device assignment, monitoring status and packaging configuration before release.
Carrier acceptance: record custody transfer, responsible roles, time and location; confirm that the device is reporting or intentionally in an approved transport mode.
Intermediate transfer: record arrival, dwell, release and next owner. Use telemetry to prioritise exceptions, not to infer an unrecorded handover.
Manufacturing or treatment-site receipt: reconcile label, identity and custody records independently of the tracker; retrieve and review monitoring evidence through the approved quality process.
Closure: end the device-to-shipment assignment, retain the required evidence in the correct system and remove or disable access that is no longer needed.

How should alerts be designed?

An alert is useful only if a named team can interpret and act on it. Define the triggering observation, required context, acknowledgement owner, escalation timer, authorised action and evidence of closure. Separate operational alerts—such as delay, route deviation or no recent report—from quality signals such as a configured temperature threshold. A quality signal should start review; it should not automatically decide whether product is acceptable.

Reporting frequency is therefore a risk decision. More frequent transmissions can improve awareness but may shorten battery life, increase data volume and create noise. Choose the interval around the shortest decision window in which an intervention could materially help, then test it on the real lane and packaging.

Which system should own which data?

Data object	Recommended authority	Integration rule
Patient/donor identity and clinical link	Clinical or therapy-orchestration system	Do not copy direct identifiers into the tracking platform unless necessary, authorised and controlled
Product/batch status and quality disposition	Manufacturing/QMS/clinical quality system	Tracking data may be reviewed evidence; it is not the release engine
Shipment plan, parties, milestones and custody events	TMS/control tower or defined logistics record	Use stable, effective-dated references and preserve event history
Device identity, configuration, health and telemetry	Tracking platform	Expose configuration and provenance with the readings
Cross-system event exchange	Integration layer/API or EPCIS-style event model	Validate identifiers, timestamps, retries, duplicates, access and audit trails

GS1 EPCIS 2.0 is one available event-sharing standard. It is designed to express what, when, where, why and how for supply-chain events. It can help structure interoperable custody and visibility data, but it does not replace therapy-specific identity controls, validation or clinical governance.

Do all cell and gene therapy shipments need live tracking?

No. Monitoring intensity should follow risk and the ability to intervene. Consider patient specificity, product value and replaceability, stability profile, temperature regime, route and seasonal exposure, number of hand-offs, connectivity, time sensitivity, diversion risk and the consequence of delay. A destination-read logger may be appropriate where retrospective evidence is sufficient. Connected monitoring adds value when earlier awareness can change the outcome. Some programmes may need both.

What should a pilot prove?

A pilot should test the operating model, not just whether dots appear on a map. Use representative packaging, lanes, hand-offs and user roles. Include deliberate faults and evidence review.

Wrong-device assignment and duplicate shipment reference are detected before despatch.
A temporarily disconnected device stores and forwards events without corrupting event order.
A late event from a previous assignment cannot appear against the current shipment.
Delay, no-report and configured condition signals reach the correct team with usable context.
An additional or missed hand-off is reconciled without treating a geofence as proof of custody.
Role-based access reveals the minimum information needed; audit records show who viewed or changed what.
Receipt, quality review, retention and device retirement close correctly across systems.

Buyer decision framework

Decision	Question to answer before selecting technology	Evidence to request
Problem	Which failure are we trying to detect or prevent, and what action is possible?	Lane risk assessment; intervention playbook; named owners
Identity boundary	Where is the authoritative patient/product link?	System-of-record map; identifier rules; reconciliation procedure
Custody model	Which transfers require a recorded handover?	Event taxonomy; responsibility matrix; exception process
Telemetry need	Which observation changes a decision, and how quickly?	Sensor specification; placement rationale; reporting profile; alert tests
Data governance	What data is necessary for each role and how long is it retained?	Access matrix; data-flow map; retention and deletion controls
Integration	How are duplicates, delays, retries and out-of-order events handled?	API/event model; idempotency; audit trail; failure tests
Assurance	What must be qualified or validated for intended use?	Risk assessment; supplier evidence; protocol, acceptance criteria and change control

Strategic Tracking Verdict

Do not start with a cellular label, BLE sensor or reusable tracker. Start with the decision that must be protected: correct identity, accountable custody, timely intervention or quality evidence. Keep the three evidence layers separate, link them with controlled references and test the failure modes at the boundaries. The strongest design is not the dashboard containing the most data. It is the design that gives each authorised person the minimum reliable evidence needed to act—and makes clear what the tracker cannot prove.

Frequently asked questions

Can GPS provide chain of custody?

No. GPS or network location can support a custody record, but custody requires a defined transfer event, responsible parties and evidence. A location point alone does not prove control.

Should a tracker carry a patient name?

Usually the tracking layer can operate with a pseudonymous shipment or therapy reference. Direct identifiers should be used only where necessary, authorised and appropriately controlled.

Can a temperature alert automatically reject a therapy?

A connected monitor can flag an observation for review. Product disposition should follow the approved quality process, product stability knowledge and authorised decision-making.

Is real-time monitoring mandatory for every CGT shipment?

Not as a universal rule. Select monitoring according to product, lane, hand-off and intervention risk, alongside the applicable regulatory and organisational requirements.

What is the most important integration control?

Maintain stable identifiers and effective-dated assignments, then prove that duplicates, retries, delayed and out-of-order events cannot corrupt identity or custody history.

Does EPCIS solve chain of identity?

EPCIS can structure and exchange visibility and custody events. It does not replace therapy-specific identity controls or validated clinical and manufacturing records.

Discuss your tracking requirements

Planning a cell or gene therapy visibility pilot? Strategic Tracking can help define the buyer requirement, map identity and custody boundaries, compare connected monitors and data loggers, design exception workflows and test integrations—independently of any device or platform vendor.

Plan a pharmaceutical monitoring evaluation or request quotations from specialist suppliers.

Cell and Gene Therapy Shipment Tracking: How Should Chain of Identity, Chain of Custody and Telemetry Work Together?