HTA inspectors do not assess traceability by reading your policy. They test it, on site, by picking material and asking you to prove where it has been. This paper sets out how the HTA structures its licensing standards, what the Traceability standards actually ask for, how a traceability audit tends to unfold in practice, and what separates establishments that pass one calmly from those that spend a fortnight preparing for it.
Under the Human Tissue (Quality and Safety for Human Application) Regulations 2007, the Human Tissue Authority licenses and inspects establishments that procure, test, process, store, distribute, import or export tissues and cells for human application. Licensed establishments range widely: hospitals, stem cell laboratories, tissue banks, cord blood banks, suppliers of acellular material, and establishments procuring starting material for advanced therapy medicinal products.
What they have in common is a duty to know, and to be able to show, exactly where their material has been. That duty is not satisfied by intent or by documentation describing intent. It is satisfied by records that survive contact with an inspector.
The HTA groups its licensing standards under four headings:
The HTA's expectation for the Traceability standards is direct: establishments meeting them will be able to demonstrate full traceability for the human material for which they are responsible, from receipt to final disposal or disposition. The phrase to sit with is "from receipt to final disposal or disposition". Not from receipt to storage. Not for the samples that are still in the freezer. Everything, including what has left, been used, or been destroyed.
Every licensed establishment must appoint a Designated Individual (DI), who carries a statutory responsibility under the Human Tissue Act to supervise the activities taking place under the licence. The DI must ensure that suitable practices are carried out by those working under the licence, that the premises are suitable, and that the conditions of the licence are complied with.
This matters for traceability in a way that is easy to miss. The DI is accountable for practices they cannot personally observe. The only way that accountability is discharged in reality is through records that let the DI see what actually happened rather than what should have happened. An establishment whose DI cannot answer "where is this sample and who last handled it" without asking someone has a governance gap, not just a records gap.
The HTA tests traceability through traceability audits carried out on site. The mechanics are simple enough to describe and uncomfortable to experience if your records are thin.
An inspector selects material, or a record of material, and asks the establishment to evidence its history. The direction can run either way: from a donation record forward to where the material ended up, or from material in storage back to its donation, consent and testing. The establishment answers using its own records, in the room, at the time.
Three things tend to go wrong:
Establishments that handle traceability audits calmly tend to share a small number of characteristics.
The record is created by the work, not after it. If updating the record is a separate task that follows the physical task, it will sometimes not happen, and the gap will be invisible until an inspector finds it. Scanning material at each step makes the record a by-product of doing the work.
Every movement is captured, including the boring ones. Moving a box between shelves feels too trivial to record. It is exactly the event that breaks a trail six years later.
The audit trail is attributable. "The record was changed" is weaker than "this named user changed this field from this value to that value at this time". Role-based access with named users is what turns a log into evidence.
Disposal is recorded as carefully as receipt. With a reason, a date, and a person. The end of the trail is part of the trail.
Retrieval takes minutes, not days. Traceability that exists in principle but takes a week to assemble does not help you in an inspection room. The test is not whether the data exists somewhere, it is whether you can produce it while someone waits.
Traceability records for tissues and cells intended for human application must be retained for a minimum of 30 years after clinical use. Thirty years is longer than most laboratory information systems, file formats, storage media and software suppliers survive.
This turns retention into a migration question rather than a storage question. A structured electronic record can be exported, migrated and read by a successor system. A shared drive full of spreadsheets whose author left in 2019, or a filing cabinet of worksheets, is a liability that grows quietly. When assessing any system against this requirement, the question worth asking is not "can it store the data for thirty years" but "can I get my data out of it in a form the next system can read".
A purpose-built biological sample tracking system addresses the Traceability standards structurally rather than procedurally.
None of this makes an establishment compliant on its own. Compliance is a matter of practice, and a system that people work around produces worse records than an honest paper log. What a well-fitted system does is make the compliant path the easy path.
The Traceability standards ask a question that sounds simple and is not: can you account for every piece of human material you are responsible for, from receipt to final disposal or disposition, on demand. Inspectors answer that question empirically, by testing. The establishments that find this straightforward are not the ones with the best-written policies. They are the ones whose day-to-day work generates the evidence as it goes.
Requirements change: the EU framework is being replaced by the SoHO Regulation from August 2027, with different consequences for Northern Ireland and Great Britain. The traceability discipline underneath does not change. It is worth building for its own sake.
