Every Bag's Journey — Digitizing Blood Product Chain of Custody in Disaster Medicine

The Paper Problem

In a hospital blood bank, chain of custody is maintained with paper forms, signatures, and manual logs. It works well in stable conditions with dedicated blood bank technicians, controlled refrigeration, and standardized protocols.

Now remove all of that. You are in a disaster zone. The blood products arrived in a cooler on the back of a truck. The blood bank "technician" is a nurse who cross-trained last month. Three clinical areas need blood simultaneously. One of them is about to evacuate.

The paper forms — assuming they have not gotten wet, lost, or left behind — will capture fragments of the truth. Station A's log says they issued two units. Station B's log says they received one. Where is the other unit? Was it in transit during the evacuation? Did it come back? Is it in someone's pocket?

xGrid replaces the paper chain with a digital custody chain — 16 defined steps, each recorded with timestamps, responsible personnel, and verification data.

The Lifecycle of a Blood Unit

A blood product in xGrid moves through clearly defined stages:

After issuance, the unit enters the 16-step custody chain — transport, receipt at nursing station, bedside verification, transfusion start, monitoring, and completion. Every state transition creates an immutable event record. The complete journey of any blood unit can be reconstructed from its event chain.

Terminal states: Transfusion completed, Returned to blood bank, or Waste (cold chain broken or expired).

Dual-Person Verification

Three steps in the custody chain require two independent people to verify:

1. Release — Blood bank releases the unit. Two staff members independently confirm: correct unit, correct blood type, correct patient, not expired.

2. Nursing receipt — The nurse at the clinical area receives the unit. Two people verify identity match between the blood product label and the patient wristband.

3. Transfusion start — Before blood enters the patient. Two clinicians independently confirm blood type compatibility at bedside.

The system enforces this by requiring two identified verifiers for these steps. A custody event submitted with only one verifier for a dual-check step is rejected by the system.

Why two people instead of one person checking twice? Because the most common blood transfusion errors are not failures of knowledge — they are failures of attention. Two independent verifiers catch the errors that a single person's confirmation bias misses.

The Compatibility Matrix

Before issuing blood, cross-match verification confirms ABO/Rh compatibility:

Patient Blood Type	Compatible Donor Types
O-	O- only (universal donor for red blood cells)
O+	O-, O+
A+	O-, O+, A-, A+
B+	O-, O+, B-, B+
AB+	All types (universal recipient)

The verification step checks four things simultaneously: unit exists in inventory, blood type is compatible, product is not expired, and current status is valid for issuance. All four must pass. A single failure blocks the operation.

The 30-Minute Cold Chain Rule

Blood products must remain refrigerated. Once removed from the cooler, a clock starts ticking.

When a unit is returned to the blood bank, the system asks: "How many minutes was this out of refrigeration?"

• 30 minutes or less: Unit returns to available inventory. Re-shelved.
• Over 30 minutes: Unit is automatically marked as waste. Cold chain broken. Cannot be re-shelved.

This is not a warning or a recommendation. It is an enforced rule. The system will not allow a blood product that has been at room temperature for 35 minutes to re-enter the available inventory — regardless of who is asking.

Break-Glass: When Normal Process Cannot Wait

A patient is hemorrhaging. The physician is triaging twenty others. The blood bank technician is at another station. A nurse needs blood. Now.

Normal process: physician orders, blood bank verifies, cross-match, dual-verify release, transport, dual-verify receive, dual-verify start transfusion.

Emergency process: the nurse activates break-glass.

Constraints: Only universally compatible blood types (O+ or O-). No individual cross-matching — this is a conscious trade-off between certainty of safety and certainty of speed.

What happens:

1. The system selects available units by expiry date (oldest first)
2. Units are flagged as emergency release, uncrossmatched
3. The event is logged with critical severity
4. A pending order is created with a 24-hour deadline for physician sign-off
5. A 72-hour deadline for supervisor review

Both deadlines are tracked by the system. Overdue items appear on an alert dashboard. The emergency override does not eliminate accountability — it defers it to a moment when the patient is not actively dying.

The Walking Blood Bank

Disaster zones may have no blood center supply. But there is a blood source that is always present: people.

xGrid's Walking Blood Bank module enables field blood collection:

1. Donor registration: Name, blood type, weight, rapid screening results
2. Compatibility matching: Query compatible donors for a specific patient
3. Collection tracking: Start and end times, volume, pre- and post-donation vitals, adverse reactions
4. Interval management: 56-day standard or 28-day emergency minimum between donations

Fresh whole blood has a 24-hour shelf life. The system alerts before expiration — ensuring no expired fresh blood is used.

The Walking Blood Bank also supports break-glass: unscreened donors and imperfect blood type matches can proceed with documented authorization and reason codes. Everything is recorded; nothing is invisible.

Three-Layer Expiry Defense

Blood product expiration is the most common cause of blood bank waste. xGrid defends against it at three levels:

Even if the dashboard is ignored and the automatic cleanup encounters an error, the hard block at the point of issuance physically prevents expired blood from being issued through the system.

Cross-Station Tracking

xGrid's end-to-end test suite includes a consolidation scenario: three stations, each with an active blood product, forced to evacuate simultaneously.

The test verifies not just "did the data survive?" but "is every custody step recorded?" — including the last step before evacuation, the transport to the new station, and re-verification at the receiving site.

34 steps executed. 34 passed. Zero data loss. The complete chain of custody survived a three-station simultaneous evacuation.

The Audit Trail That Matters

Every blood unit event is immutable. Receive, reserve, cross-match, issue, every custody step, return, waste, emergency release — all recorded with timestamp, responsible person, severity level, and supplementary notes.

In the weeks after a disaster, when reviews happen and questions are asked, this trail is one of the most valuable records the system produces. Not because it prevents errors (that is what the dual-verification and cold-chain rules do), but because it makes every decision visible, every action traceable, and every outcome explainable.

---

Related: ISBAR Is More Than a Handoff Format · When the Wall Is Breached — Designing Medical Systems with Safety-II