1,000+ monitored units, one validated record,
zero unexplained excursions.
How a multi-state blood health network retired its legacy
Rees Scientific system and brought over 1,000 active monitored units — freezers, ultra-lows, incubators, LN2 tanks, platelet agitators — under one validated monitoring architecture.
A record assembled after the fact is a record that can be questioned.
Versiti operated a legacy Rees Scientific installation alongside standalone data loggers across its blood centers, research laboratories, and donor sites. Each system worked. None of them worked together.
Coverage was uneven: over 1,000 monitored units spanning thirteen equipment classes in multiple states, with parameters no single system captured end to end. The gaps were not in the instruments. They were in the seams between them — the places where one platform's record stopped and another's had not yet started, and where the only thing spanning the two was a person who remembered.
That person was the real system. A questioned unit — an excursion flagged during review, an inspector asking what happened on a specific afternoon eight months ago — could take a full day to resolve. Pull the trend from one platform. Match it against a logger export. Locate the alarm acknowledgment, then the deviation record, then confirm who responded and when. The answer usually existed. It simply had to be reassembled by hand, by someone who knew where to look, and the resulting narrative depended on the person assembling it.
Calibration compounded it. Every sensor across every site carried its own due date, and meeting those dates meant sending staff to the equipment — pulling units from service, running comparisons in place, transcribing results, and filing certificates by hand. Across a thousand units in multiple states, that work consumed hundreds of technician hours a year and generated its own paperwork burden, all of it in support of the record rather than the product.
Blood components and research material carry non-negotiable storage windows.
These are not conventions. They are the conditions under which the product remains a product. Outside them it cannot be reworked; it can only be discarded. And what is discarded is not inventory — it is a donation, given by a person, that will not reach a patient.
The regulatory obligation runs in two directions at once. AABB and FDA inspection cycles required Versiti to demonstrate not only that storage was in control, but that it could prove it for any moment in the retention period. Current state is a reading. Proof is a record: continuous, attributable, time-stamped, and intact from the moment of capture through the moment of review. A gap in that record is difficult to distinguish from a gap in control, and defending the difference costs more than closing it.
Scale made the exposure structural rather than occasional. Over a thousand units. Thirteen classes of equipment, each with its own alarm behavior and its own failure signature. Sites in multiple states, many of them donor centers where the nearest technical staff were hours away. Every uncovered parameter, every manual round, every hand-transcribed download — and every calibration cycle run on site — was a place where the record could thin out, and there was no way to know in advance which one would be asked about.
In a blood center, the loss is rarely the equipment. It is the interval nobody was watching.
Every component Versiti holds has a storage window written into a standard, and each one fails in its own way. These are the four failure modes that drive discard decisions in blood banking — none of them announce themselves at the moment they begin.
A stalled agitator holds temperature for hours while the platelets inside lose viability. Nothing on the unit indicates the interruption, so the discard decision comes down to how long the motion was absent — a number no one can produce after the fact. The AABB interruption limit is measured in hours; a shift change can consume it.
A blood bank refrigerator with a door out of seal keeps compressing and keeps reporting a temperature inside range, until it does not. The excursion is visible in the trend long before it is visible on the display, and the units at the front of the shelf warm first. Temperature alone cannot distinguish a busy issue window from a fault.
Ultra-low freezers hold material that cannot be recollected — donor cohorts, longitudinal study samples, cell lines. The recovery window between compressor failure and specimen loss is a matter of hours, and it opens when the building is empty. An audible alarm in an unoccupied corridor is not a control.
Liquid nitrogen consumption changes with lid cycling, ambient load, and tank age, so a fixed fill schedule is an assumption rather than a control. The same event that puts specimens at risk displaces oxygen in the room, which makes it a staff safety matter as well as a product one.
For each of these, how long would it take to establish exactly when the interval began, and who was told?
Each failure mode is met by a measurement, not by a procedure.
Monitoring only prevents loss where the parameter that actually fails is the parameter being recorded. Qualified Controls specified the sensing layer against the four failure modes above, not against the equipment list.
A procedure asks a person to notice. A measurement records whether they did, and both outcomes are defensible only if the record exists before the question is asked.
Loss of motion raises a tiered alarm within minutes and writes a timestamped start and end to the audit trail. The QA decision is made against a recorded interval rather than an estimate, and the same record supports the disposition if product must be discarded.
A door open past its threshold escalates on its own path, separate from a temperature excursion, so a busy issue window never reads the same as a failed seal. Escalation is shift-aware and reaches the person on the floor rather than a distribution list.
A network or power interruption does not silence the system: readings buffer on the sensor and reconcile on reconnection, while independent uplinks carry the alarm out of the building. Off-hours escalation chains route to on-call staff by role, with acknowledgement captured under electronic signature.
Fill scheduling moves from a calendar assumption to an observed consumption rate, and the oxygen reading in the same repository gives facilities and safety one shared source. One record answers the product question and the personnel question at once.
One sensing layer, one record, every equipment class.
Qualified Controls walked every zone across the network, mapped each critical parameter to its governing specification, and designed a single Nano SPY sensing layer reporting into one validated MySirius monitoring single-sign on account. Wireless range removed the need for new cabling in occupied clinical and laboratory space, and the legacy Rees Scientific system was decommissioned only after the parallel run closed.
Every monitored unit records on a 15-minute interval with 5-minute alarm evaluation; humidity at 30 minutes, the most critical assets at one.
Redundant gateway coverage in every monitored zone with independent uplinks; on-sensor buffering holds data through network or power interruption.
Role-based routing with duration thresholds and shift-aware on-call chains, replacing per-device audible alarms across thirteen equipment classes.
ALCOA+ aligned audit trail with electronic signatures on every acknowledgement and corrective action.
Serialized sensors are exchanged for
pre-calibrated units with certificates already on file — no on-site comparison runs, no transcription, no unit taken out of service.
Qualified on paper before it was trusted in practice.
Qualified Controls authored and executed the full validation package. Every sensor was calibrated against NIST-traceable standards, mapped to its asset, and signed off before the legacy loggers were removed.
Units taken out of service remain in documented maintenance mode.
Every change of state is captured in the audit trail with an attributed electronic signature.
Installed in occupied clinical and laboratory space, without new cabling.
“We no longer assemble evidence when an inspector asks. The evidence already exists, it is signed, and it covers every minute since go-live.”
What is in service across the network.
Single-channel temperature recorder. Deployed across freezers, refrigerators, walk-ins, and cold rooms network-wide.
Combined temperature and humidity recorder. Covers ambient rooms, incubators, and fume hoods where humidity is a controlled parameter.
External-probe recorder for 4–20 mA, 0–1 V, and dry-contact inputs — LN2 level, O₂ monitors, CO₂, and door opening.
Digital recorder paired with Evolution low-temperature probes — every ultra-low freezer and LN2 tank in the estate.
Are all of your critical parameters being captured continuously?
The REM Risk Assessment documents every gap between what your specifications require and what your current system records. It takes one site visit.