Chain of custody for medical specimens, stop by stop

Complete at every handover: specimen ID + releasing party +
receiving party + date/time + container temperature + seal
intact (Y/N) + condition on receipt

A cold chain of custody is two records, not one

Operators treat chain of custody as a signature problem and cold chain as a cooler problem, handled by different people. Labs read them together.

When a specimen is questioned, the lab lines up two timelines. One says: collected 08:14, released to courier 09:02, received at lab 11:40. The other says: 4.1 °C at load, 6.8 °C at delivery, nothing above 8 °C in between. If the first has a two-hour gap at a depot and the second has no reading covering it, the specimen is unverifiable. Not spoiled. Unverifiable, which for a lab is the same decision.

So: every custody event gets a temperature reading attached, and the temperature record covers the whole elapsed time, not just the endpoints. A min/max reading at delivery tells you an excursion happened. It cannot tell you when, so it cannot tell you which of the nine specimens in that cooler was affected.

Stop one: collection and the handover at the site

Nothing downstream can fix a labeling failure, so this is where to be pedantic. Before the specimen leaves the room it needs two patient identifiers on the tube itself rather than on the bag, labeled at the patient and not at the desk afterwards; the collection date and time to the minute, which starts every stability clock the lab will later apply; the collector's identity; and the requisition or accession number tying the tube to the order.

If you are the courier rather than the collector you are not responsible for any of that, but you are the last person who can catch it. A driver who spots an unlabeled tube at pickup saves a recollection. Build that into the pickup, not into a training slide.

The release itself is the first transfer of custody, and it is the one most often done badly, because it happens at a counter while someone is on the phone. Capture:

• Specimen count, by temperature class. Not "6 specimens" but "4 refrigerated, 2 ambient". Mixing classes in one cooler is how a frozen sample ends up at 5 °C.
• Releasing and receiving party, both named. A signature from the site, a logged driver identity on your side.
• Timestamp, automatic from the device. Handwritten times get rounded to the nearest convenient five minutes, sometimes the nearest convenient hour.
• Container temperature at load, read from the cooler, not assumed from the gel pack.
• Seal number if sealed, and seal intact yes or no.
• Condition. Leaking, hemolyzed-looking, under-filled, unlabeled. Noted at pickup it is the site's problem. Noted at the lab it is yours.

Two practical notes from running these routes. Pre-condition gel packs rather than using them straight from the freezer, and keep a barrier between pack and tubes, because a refrigerated specimen pressed against a −20 °C pack for two hours is not refrigerated. And blood culture bottles go at room temperature. Putting them in the cold cooler because that was the cooler in your hand is a common, expensive mistake.

For a model of how much detail a chain can carry, look at DOT drug testing: a federal custody and control form, the donor initialing the seals they watched go on, a 30 mL and 15 mL split, and a temperature read within four minutes, acceptable range 32–38 °C.

Stop two: the leg in the van

The in-transit record is where most operations have nothing, and it is the longest stretch of time, so it is what the lab cares about most. Covering it takes a logger in the cooler reading on an interval plus a driver record you can read against it.

The detail that only shows up once you have run the routes is that the problem is almost never ambient temperature. It is door-open time and accumulation. A multi-stop collection route opens the same cooler eight times. Each opening is a short excursion and individually none of them matter. The specimen picked up first has absorbed all eight, plus three hours of elapsed time, and it is the one that fails. Which means:

• Sequence by stability, not only by distance. If one site's specimens have a two-hour separation window and another's have twenty-four, the tight one goes last on the collection leg.
• Measure your own longest leg. Take the gap between first pickup and lab arrival for every run, for two weeks. The maximum, not the average, has to fit inside your tightest stability window. Most teams have never written it down and are surprised by it.
• Count door-open events if your logger supports it. It turns "the cooler was fine" into something you can show.

If the maximum leg does not fit the window, no amount of recordkeeping fixes it. You need a mid-route lab drop, a second vehicle, or a conversation with the client about collection times. That is a routing decision, and it is a different problem from getting the route itself right.

Stop three: the relay, the depot, and the drop box

Every intermediate transfer is a custody event. These three routinely go unrecorded.

Driver-to-driver relay. Two people meet in a parking lot and move a cooler. Unless both sides log it with a count and a temperature reading, you have one continuous record that silently covers two people, and nobody can say who held the specimen during the gap.

The depot stop. A cooler sitting at your hub for forty minutes between runs needs a reading at drop and at collect, with a name against both. A hub is not neutral space in the record. It is a stop.

The after-hours drop box. A locked box your driver empties at 06:00 holds specimens with no witnessed release. That is a genuine custody gap and paperwork does not close it. You can only narrow it: a box only your driver can open, a site log of what went in and when, a seal on each bag, refrigeration where the contents need it, and a timestamped record of the box being opened. Tell the client plainly that your chain starts at the box and the site's log covers the hours before.

Stop four: accessioning

The final handover is what the lab produces if there is ever a dispute, so make it the most complete.

That last row is worth fighting for. A rejected specimen with no condition note at pickup and none at delivery becomes an argument, and couriers lose arguments with labs by default. A rejection logged with a reason, a time and a temperature trace is a fact, and facts get assigned to whoever caused them.

All of this is capture discipline rather than handling skill, which is why it improves the moment the record comes off paper and attaches to the task. It is the same argument as electronic proof of delivery in ordinary courier work, with a temperature column added and a lab at the other end who reads it.

OkPilot timestamps each handover against the job and keeps the proof with it, so the custody trail and the temperature log come out of the same record rather than being reconciled afterwards from a clipboard and a logger download.