Deliveries
Tissue in a transport container is on a clock. The container holds validated conditions for a fixed period — after that the material is compromised, whatever the freezer would have done.
Book in a delivery
Scan the label, or type the code if there is no barcodeIn a container now
Empty is the normal stateStored
Transferred and verifiedStock
Every graft held under the licence, with its donation, shelf life and current location. Frozen allograft keeps for five years; fresh osteochondral keeps for twenty-eight days, which is a different job of work.
Shelf life
shortest life remaining firstFresh osteochondral keeps for twenty-eight days in a refrigerator; frozen allograft keeps for five years. The same number of days means something different to each, so each carries its own warning bands rather than one rule applied to both.
Graft register
| Reference | Product | Item code | Supplier | Donation | Expiry | Location | Status |
|---|
Documents
The thirteen document types their audit checklist asks for, each with its version history kept. Training is recorded against a version, not a document — so "has this person read the current one?" has an answer.
Training records
Who has read what · standard operating procedures onlyTheir checklist asks for a staff list and training records separately. Neither answers this question on its own.
Register
Document
Build quality in at the beginning, not as an afterthought
Every stage of the tissue pathway must be safe, traceable and compliant. Quality is not something that can be inspected into a process later. It has to be designed in, implemented and maintained from the very beginning.
Five things to get right
Everyone has a responsibility
Safe practice. Full traceability. Regulatory compliance. Continuous improvement.
Every sample, every process, every time.
Cold chain
The clock starts when theatre staff take a graft out of the freezer. Inside thirty minutes it can go back to stock. Past thirty minutes it is not viable — and unlike the receipt window, there is no override, because there is nothing a senior signature can do about tissue that has warmed up.
Take a graft out of the freezer
starts a thirty minute clockOut of the freezer now
Earlier today
every removal is kept, used or notEach removal starts a fresh thirty minutes. Every one is recorded, so if it later turns out that time out of the freezer accumulates over a graft's life rather than resetting, the history is already here to show it.
Incidents
Safeguard holds the incident. Vigil never writes to it and never replaces it. What Vigil does is pull the ones that concern human tissue, put the three reporting clocks on them, and keep the quick reference beside them so nobody has to remember the deadlines at two in the morning.
Quick reference
what to report, to whom, and by whenThe twenty-four hour clock is the one people get wrong. It does not start because an incident is serious. It starts because a serious adverse event or reaction has an impact on patient wellbeing, and that is a judgement a Designated Individual or Person Designated makes, not a score.
Grading
RNOH's own matrix, worked examples verbatimSomebody grading an incident at two in the morning needs the examples, not the definitions. These are the ones from your own matrix, unedited.
Open
Incident
Recall
An adverse event is analysed. If there is a potential risk to patient safety, the implicated tissue is quarantined while somebody assesses it, and only then is it recalled or discarded. Everything else in Vigil records what happened. This is the screen that uses those records to find people.
Open recall
When to recall
his grounds and examples, verbatimFour of these seven are labelling or packaging failures. That is worth noticing: scanning the Single European Code at receipt is the control that catches most of this list before it ever reaches a freezer.
Disposal
Most tissue in a bank is never implanted. It expires on the shelf, fails a check, or is simply not needed, and every one of those has to be recorded with a reason and a witness. A discarded graft carries the same thirty year retention as one that went into a patient.
Record a disposal
two people, alwaysRecorded by H. Whitcombe, witnessed by a second person. The witness is not a formality: their name is what makes the record evidence rather than an assertion, and it is the first thing an assessor looks for on a disposal.
Disposed
Audit readiness
Every line of GQ2c-02, in your order and your words, showing where the evidence actually is today. Three answers only: this system holds it and you can click through to it now, it is a document in the register with a review date, or it is not here — in which case it says so rather than showing a tick.
An audit checklist that only ever shows green has stopped being a checklist. The point of the amber and red rows is that you see them in September rather than the week before a visit.
Consent audit
Whether patients receiving allografts were properly consented, audited against the five things the discussion has to cover. Vigil holds the audit and what came of it. It does not hold anybody's consent, which belongs in the patient record and stays there.
What the discussion must cover
and how often it didAudit rounds
most recent firstCorrective and preventive actions
GQ2 item 24Evidence to retain for inspection
his listAn audit that finds nothing wrong, twice running, is usually an audit that is not looking. The value of the first round here is the two things it failed, and the value of the second is that it can show they were fixed rather than asserted.
Activity return
Product by month, for the HTA annual data collection exercise. Nothing here is entered by anybody: every figure is counted from the register, because each graft already carries a product type and a date. The parallel spreadsheet exists because systems cannot usually produce this. This one can.
Entered the freezer
A product with nothing against it all year is still listed, because a return that silently omits its empty rows is a return somebody has to check by hand against the register. Counts here are of grafts, not of donations: one donation yielding three grafts appears three times, which is what the return asks for.
Retention
Standard 47 keeps the traceability data for thirty years. Standard 46 keeps the raw data critical to safety and quality for ten. Both run from the same moment, and it is not implantation: it is use, expiry or disposal, whichever actually happened. A graft that expired on the shelf and one that went into a patient are held for exactly as long as each other.
What is kept, and for how long
standards 46 and 47Every graft, and when its clock started
soonest destruction date first| Reference | What started the clock | Started | Raw data until | Traceability until | Status |
|---|
Nothing is ever destroyed automatically. These dates say when a record may be destroyed, not when it will be, and the destruction itself would be a recorded act with a witness in the same way a disposal is.
HTA licensing standards
All 114 standards the HTA assesses a Human Application establishment against, in the regulator's order and the regulator's words, each one saying where the evidence sits today. GQ2c-02 on the previous screen is one hospital's reading of this; this is the thing itself.
Nothing here is marked out of scope. A records system could in principle hold evidence for almost any of these, including the ones about premises and equipment, so calling them somebody else's problem would be the same self-serving tick this screen exists to avoid. What the red rows show is how far Vigil has got, not how far it could go.
Risk assessments
Held as records rather than documents, each attached to the thing it concerns — a donation, a supplier, a freezer, a process — so an audit can show the assessment beside the item.
Where the risks sit
Likelihood × consequence, the same five-by-five every NHS risk register uses. Click a cell to filter.
Assessment
Register
Temperature
Every monitored location, its specification, and what happened when one went out of range. An excursion is not a reading — it is a response that has to be documented. And a second excursion from the same cause is not a second incident, it is evidence the first one was never fixed.
Monitored locations
Select one to see its traceTrace
Excursion response
OpenIssue to theatre
Select the graft, record who it went to and where. The register updates as the graft leaves the freezer.
Issue record
Selected graft
Traceability
Records are retained for 30 years after clinical use. Search from either end of the chain.