QSE 3 — Equipment

Key Concepts

Key Concepts: This QSE describes the selection, use, maintenance, and monitoring of equipment, including information systems. It also describes the use and testing of alternative systems when primary systems fail.

Key Terms
Backup: Digital data and/or physical storage containing copies of relevant data.

Calibrate: To set or align measurement equipment against a known standard.

Corrective Action: Actions taken to address the root cause(s) of an existing nonconformance or other undesirable situation in order to reduce or eliminate recurrence.

Critical Equipment/Materials/Tasks: A piece of equipment, material, service, or task that can affect the quality of the organization’s products or services.

Data Integrity: The accuracy, completeness, and consistency of information.

Equipment: A durable item, instrument, or device used in a process or procedure.

Installation Qualification: Verification that the correct equipment is received and that it is installed according to specifications and the manufacturer’s recommendations in an environment suitable for its operation and use.

Operational Qualification: Verification that equipment will function according to the operational specifications provided by the manufacturer.

Performance Qualification: Verification that equipment performs consistently as expected for its intended use in the organization’s environment, using the organization’s procedures and supplies.

Validation: Establishing evidence that a process, executed by users in their environment, will consistently meet predetermined specifications.

Verification: Confirmation by examination and provision of objective evidence that specified requirements have been met.

Examples of Objective Evidence:

• Policies, processes, and procedures related to this chapter.
• Processes for equipment selection, qualification, and maintenance.
• List or tool used for critical equipment identification.
• Equipment calibration and maintenance records, if applicable.
• Equipment qualification records.
• Manufacturer’s written instructions.
• Records of investigation of equipment malfunction, failure, repair, and requalification, if applicable.
• Alarm system testing and records of alarm management, if appropriate.
• Evidence of information system backup and records of testing.

3.0 Equipment

The organization shall define and control critical equipment.

Guidance

The facility is required to define a list of equipment that is critical to its operations. Critical equipment
used for collection, processing, and storage of samples should be suitable for the task and be maintained appropriately. Acceptable operational limits for equipment should be defined, and processes and procedures should indicate the course of action when these limits are not achieved. (SS)

The committee revised standard 3.0 based on updates to the AABB Quality System Essentials. (SC)

☑ Actionable Checklist

• Develop and maintain a comprehensive list of all critical equipment used in collection, processing, and storage.
  • Reference SOP EQ-001 for equipment listing criteria.
• Define acceptable operational limits for each piece of critical equipment.
  • Document these limits in the Equipment Operational Limits Log.
• Establish and document procedures for equipment maintenance and calibration.
  • Refer to SOP EQ-002 for maintenance schedules and calibration procedures.
• Implement a process for monitoring equipment performance and addressing deviations.
  • Use the Equipment Performance Monitoring Form for documentation.
• Train staff on equipment operation and maintenance procedures.
  • Record training sessions in the Training Records Log.
• Conduct regular internal audits to ensure compliance with equipment control standards.
  • Document findings and corrective actions in the Audit Findings Report.

3.1 Equipment Specifications

Equipment specifications shall be defined before purchase.

Guidance

Standard 3.1 is a commonly cited standard for nonconformances. Examples of the reasoning behind the nonconformances include the following:

1. Equipment maintenance is not performed per manufacturer’s instructions.
2. There is no evidence of validation of new equipment.
3. There is no procedure for assessing acceptability of cellular therapy products when equipment is found to be out of calibration. (SS)

The ​committee revised standard 3.1 based on updates to the AABB Quality System Essentials. (SC)

☑ Actionable Checklist

• Define and document equipment specifications prior to purchase using an Equipment Specification Form.
  • Ensure specifications include manufacturer requirements, performance criteria, and intended use.
• Develop and implement an SOP for equipment maintenance in accordance with manufacturer’s instructions.
  • Include a maintenance log to record all maintenance activities and outcomes.
• Validate all new equipment before use, documenting validation activities in a Validation Report.
  • Include performance qualification, installation qualification, and operational qualification in the validation process.
• Establish a procedure for assessing the acceptability of cellular therapy products when equipment is found to be out of calibration.
  • Document the assessment process and any corrective actions taken in a Deviation Report.
• Conduct regular internal audits to ensure compliance with equipment specifications and maintenance procedures.
  • Use an Equipment Audit Checklist to verify adherence to SOPs and manufacturer instructions.

3.2 Qualification of Equipment

[Cord blood applicable]

All critical equipment shall be qualified for its intended use. Equipment shall be requalified, as needed, after repairs and upgrades.

Guidance

The committee revised standard 3.2 based on updates to the AABB Quality System Essentials. (SC)

☑ Actionable Checklist

• Develop and maintain an Equipment Qualification SOP detailing qualification procedures.
  • Include initial qualification, requalification after repairs, and upgrades.
• Create and utilize an Equipment Qualification Form to document qualification activities.
• Maintain a log of all critical equipment, including qualification status and dates.
• Schedule and perform requalification of equipment following any repairs or upgrades.
• Conduct regular reviews of equipment qualification records to ensure compliance.
• Train relevant staff on equipment qualification procedures and document training records.

3.2.1 Installation Qualification

Equipment shall be installed per manufacturer specifications.

☑ Actionable Checklist

• Verify that installation procedures align with manufacturer specifications.
  • Review and document manufacturer installation guidelines.
  • Ensure installation SOPs incorporate manufacturer requirements.
• Maintain records of installation activities.
  • Use an installation checklist to document each step.
  • File completed installation checklists in the equipment log.
• Conduct an installation review.
  • Have a qualified individual verify installation against specifications.
  • Document the review and any discrepancies found.
• Train staff on installation procedures.
  • Update training records to reflect completed installation training.
• Perform a post-installation inspection.
  • Log inspection results and any corrective actions taken.

3.2.2 Operational Qualification

Each piece of equipment and component of an information system shall be verified before actual use.

Guidance

The committee revised standard 3.2.2 to mirror all other AABB Standards and to match the AABB Quality System Essentials. (SC)

☑ Actionable Checklist

• Develop and implement an SOP for the operational qualification (OQ) of equipment and information systems.
  • Include criteria for performance verification and acceptance.
• Maintain a log of all equipment and information systems that require OQ.
• Document the OQ process for each piece of equipment and information system before use.
  • Use standardized forms to record OQ results and approvals.
• Train relevant personnel on the OQ procedures and document training records.
• Review and update the OQ SOP annually or as needed based on changes in equipment or technology.

3.2.3 Performance Qualification

Equipment shall perform as expected for its intended use.

Guidance

The committee revised standard 3.2.3 to mirror all other AABB Standards and to match the AABB Quality System Essentials. (SC)

☑ Actionable Checklist

• Develop and maintain an SOP for performance qualification (PQ) of equipment.
  • Include criteria for acceptance and expected performance parameters.
• Conduct initial performance qualification testing for all new equipment.
  • Document results using a standardized PQ form.
• Schedule and perform regular re-qualification of equipment as per the VMP.
  • Record findings in the equipment qualification log.
• Train staff on PQ procedures and document training in personnel files.
• Review and update PQ protocols annually or as needed.
• Ensure all PQ documentation is reviewed and approved by the quality management team.

3.2.3.1

Facility-developed predetermined criteria shall meet the specifications established by the manufacturer or be qualified for its intended use.

Guidance

When considering equipment purchase or relocation, the facility should have a documented process verifying that the equipment or system is capable of performing the expected task or controlling the activity according to written and preapproved specifications. The equipment or system should be tested to ensure that it performs as described in the manufacturer’s specifications, in the operator’s manual, or in facility expectations. In this last phase of the equipment qualification cycle, the facility verifies that the user requirements and specifications are met. (SS)

The committee edited standard 3.2.3.1 through the inclusion of the clause, “…or be qualified for its intended use.” recognizing that there are parameters set forth by facilities for use. This ensures that accredited institutions are meeting those expectations and requirements. The committee also deleted the clause “or exceed” that appeared in the 11th edition as all standards can be exceeded in practice. (SC)

☑ Actionable Checklist

• Develop and document predetermined criteria for equipment based on manufacturer specifications or facility requirements.
  • Reference SOP EQ-001 for criteria development.
• Implement a documented process for equipment qualification prior to purchase or relocation.
  • Use Form EQ-002 for equipment qualification documentation.
• Test equipment to ensure it meets manufacturer specifications and facility expectations.
  • Record results in Equipment Qualification Log EQ-003.
• Verify user requirements and specifications are met during the final phase of equipment qualification.
  • Conduct review using Checklist EQ-004.
• Maintain records of equipment qualification and verification in the Equipment Management System.
  • Ensure all records are current and accessible for audits.

3.3 Use of Equipment

Equipment shall be used in accordance with the manufacturer’s written instructions.

Guidance

Before the actual selection of equipment for use, criteria to consider are the types of procedures to be performed, the reports to be prepared, the intended instrument operators, the type of environment in which the equipment will be used, the expected production time, and other facility- or practice-specific needs. These criteria can then be used to assess the various equipment options and determine which ones best meet the needs (qualification). After selection, the equipment should then be validated to ensure that it operates as expected and that an appropriate intended output can be produced before its use for patient care. If equipment cannot be used in accordance with the manufacturer’s written instructions, evaluation of the impact of that deviation should be part of the validation protocol. (SS)

☑ Actionable Checklist

• Ensure all equipment is used according to the manufacturer’s written instructions.
  • Maintain a log of all equipment instructions and updates.
  • Train staff on the manufacturer’s instructions and document training records.
• Develop and implement SOPs for equipment use, referencing manufacturer instructions.
  • Review and update SOPs annually or as needed.
• Validate all equipment before use in patient care to confirm it operates as expected.
  • Document validation protocols and results.
  • Include impact evaluation for any deviations from manufacturer instructions.
• Conduct regular internal audits to verify compliance with equipment use standards.
  • Document findings and corrective actions.
• Keep a record of all equipment-related deviations and CAPAs.
  • Review and assess the impact of deviations on equipment performance.

3.4 Unique Identification of Equipment

[Cord blood applicable]

Equipment shall have unique identification.

Guidance

The committee revised standard 3.4 to mirror all other AABB Standards and to match the AABB Quality System Essentials. (SC)

☑ Actionable Checklist

• Assign a unique identification number to each piece of equipment.
  • Update the equipment inventory log with unique IDs.
• Label each piece of equipment with its unique identification number.
• Reference the unique identification number in all relevant SOPs and forms.
• Verify that all equipment records include the unique identification number.
• Conduct regular audits to ensure all equipment is properly identified and labeled.
• Review and update the equipment identification process annually.

3.5 Equipment Monitoring and Maintenance

Equipment shall be monitored and maintained in accordance with the manufacturer’s written instructions.

Guidance

The committee revised standard 3.5 to mirror all other AABB Standards and to match the AABB Quality System Essentials. (SC)

☑ Actionable Checklist

• Develop and maintain SOPs for equipment monitoring and maintenance based on manufacturer’s instructions.
  • Include specific procedures for each type of equipment used.
• Schedule regular maintenance checks and document them in an equipment maintenance log.
• Train staff on equipment monitoring and maintenance procedures, and document training records.
• Conduct periodic reviews of equipment performance and maintenance records.
• Implement a system for reporting and addressing equipment malfunctions or deviations.
• Ensure all equipment is calibrated as per manufacturer’s recommendations and maintain calibration records.

3.5.1 Calibration and Accuracy of Equipment

[Cord blood applicable]

Calibrations and/or adjustments shall be performed using equipment and materials that have adequate accuracy and precision. At a minimum, calibrations and/or adjustments shall be confirmed as described below unless otherwise indicated by the manufacturer:

1. Before use.
2. After activities that may affect the calibration.
3. At prescribed intervals.

Guidance

Appropriate calibration and maintenance of equipment includes a number of concepts. All equipment must be properly installed and calibrated before use, with appropriate records maintained of any problems encountered and corrected. The organization must develop appropriate processes and schedules for ongoing calibration, preventive maintenance, and quality control. Records of calibration, preventive maintenance, and repairs must be maintained. Defective equipment must be identified, controlled, and managed to ensure that it is not used. A system for reporting adverse events to the manufacturer must be in place. (SS)

Guidance

The committee revised standard 3.5.1 to mirror all other AABB Standards and to match the AABB Quality System Essentials. (SC)

☑ Actionable Checklist

• Develop and maintain a Calibration SOP detailing procedures for equipment calibration before use, after activities affecting calibration, and at prescribed intervals.
  • Include manufacturer guidelines and specifications in the Calibration SOP.
• Establish a Calibration Log to document all calibration activities, including dates, results, and personnel involved.
• Implement a Preventive Maintenance Schedule for all equipment, ensuring adherence to manufacturer recommendations.
• Maintain records of all preventive maintenance, calibration, and repairs in a centralized Equipment Maintenance Log.
• Identify and tag defective equipment, ensuring it is removed from service until repaired or recalibrated.
• Develop a system for reporting adverse events related to equipment to the manufacturer, including a standardized reporting form.

3.5.1.1

Calibration of equipment shall include details of equipment type, unique identification, location, frequency of checks, check method, acceptance criteria, and specified limitations.

Guidance

The committee revised standard 3.5.1.1 to mirror all other AABB Standards and to match the AABB Quality System Essentials. (SC)

☑ Actionable Checklist

• Develop and maintain an Equipment Calibration SOP that includes equipment type, unique identification, location, frequency, method, criteria, and limitations.
  • Ensure SOP references specific forms or logs for recording calibration details.
• Create a master equipment list with unique identification and location for each piece of equipment.
• Schedule and document calibration checks in an Equipment Calibration Log.
  • Include frequency of checks and method used for each equipment type.
• Define and document acceptance criteria and limitations for each equipment type in the calibration records.
• Conduct and document periodic reviews of calibration records to ensure compliance with SOPs and standards.
• Train relevant staff on equipment calibration procedures and maintain training records.

3.5.1.2

Equipment used for calibration, inspection, measuring, and testing shall be certified to meet nationally recognized measurement standards. Certification shall occur before initial use, after repair, and at prescribed intervals. Where no such measurement standards exist, the basis for calibration shall be described and recorded.

Guidance

The committee revised standard 3.5.1.2 to mirror all other AABB Standards and to match the AABB Quality System Essentials. (SC)

☑ Actionable Checklist

• Verify that all equipment used for calibration, inspection, measuring, and testing is certified to meet nationally recognized measurement standards.
  • Maintain a log of certification for each piece of equipment, including dates of certification and expiration.
• Ensure certification occurs before initial use, after any repairs, and at prescribed intervals.
  • Document all certification events in the equipment maintenance log.
• Identify equipment for which no national measurement standards exist.
  • Describe and record the basis for calibration for such equipment in the equipment calibration SOP.
• Review and update the equipment calibration SOP to include certification requirements and intervals.
• Conduct regular internal audits to verify compliance with equipment certification and calibration requirements.
• Retain all records of equipment certification, calibration, and maintenance in accordance with the document retention policy.

3.5.1.3

Equipment shall be safeguarded from adjustments that would invalidate the calibration setting.

☑ Actionable Checklist

• Implement physical locks or seals on equipment to prevent unauthorized adjustments.
  • Document lock/seal installation in the equipment maintenance log.
• Develop and maintain an SOP for equipment calibration protection measures.
• Train staff on the importance of safeguarding calibration settings and document completion in training records.
• Conduct regular audits to verify that equipment calibration settings remain secure.
• Review and update the equipment calibration protection SOP annually or as needed.
• Record any incidents of unauthorized adjustments and initiate a CAPA if necessary.

3.5.1.4

The organization shall identify equipment that is to be maintained in a calibrated state.

☑ Actionable Checklist

• Create and maintain an equipment inventory list identifying all equipment requiring calibration.
  • Include equipment name, model, serial number, and location.
• Develop and implement an SOP for equipment calibration procedures.
  • Reference calibration frequency and acceptable tolerance levels.
• Schedule regular calibration for each piece of equipment as per manufacturer recommendations.
  • Document calibration dates and results in a calibration log.
• Train staff on the importance of equipment calibration and how to identify equipment in need of calibration.
  • Maintain training records and competency evaluations.
• Review and update the equipment calibration SOP annually or as needed.
• Conduct internal audits to ensure compliance with calibration procedures and documentation.

3.5.1.5

The organization shall determine the measurements to be made and the accuracy and precision required.

☑ Actionable Checklist

• Identify and document all critical measurements required for each equipment type in the Equipment SOP.
  • Define accuracy and precision requirements for each measurement in the Equipment Calibration Log.
• Develop and implement a Calibration Schedule to ensure regular verification of equipment accuracy and precision.
• Maintain a Calibration Record for each piece of equipment, including dates, results, and any adjustments made.
• Conduct regular competency evaluations for staff responsible for equipment calibration and measurement.
• Review and update the Equipment SOP annually or as needed to reflect changes in measurement requirements.
• Document any deviations from established measurement accuracy and precision, and initiate CAPAs as necessary.

3.5.2

[Cord blood applicable]

When equipment is found to be out of calibration or specification, the validity of previous inspection and test results and the conformance of potentially affected products or services (including those that have already been released or delivered) shall be verified.

Guidance

The committee revised standard 3.5.2 to mirror all other AABB Standards and to match the AABB Quality System Essentials. (SC)

☑ Actionable Checklist

• Develop a procedure for identifying and documenting equipment found out of calibration or specification.
  • Reference SOP for equipment calibration (e.g., SOP-001).
• Implement a process to assess the impact on previous inspection and test results.
  • Use a standardized impact assessment form (e.g., FORM-002).
• Verify conformance of potentially affected products or services.
  • Document verification results in a log (e.g., LOG-003).
• Review and update calibration records to ensure accuracy.
  • Maintain a calibration log for all equipment (e.g., LOG-004).
• Conduct a risk assessment for released or delivered products potentially affected.
  • Use a risk assessment template (e.g., FORM-005).
• Implement corrective and preventive actions (CAPAs) for any identified non-conformances.
  • Document CAPAs in the CAPA log (e.g., LOG-006).

3.5.3

[Cord blood applicable]

The organization shall:

1. Define cleaning and sanitization methods and intervals for equipment.
2. Ensure that environmental conditions are suitable for the operations, calibrations, inspections, measurements, and tests carried out.
3. Remove equipment from service that is malfunctioning/out of service and communicate to appropriate personnel.
4. Monitor equipment to ensure that defined parameters are maintained.
5. Ensure that the handling, maintenance, and storage of equipment are such that the equipment remains fit for use.
6. Ensure that all equipment maintenance and repairs are performed by qualified individuals and in accordance with the manufacturer’s recommendations.

Standard 3.2 applies.

Guidance

When equipment or systems undergo preventive maintenance, calibration, or repairs, the facility should verify that the person performing the maintenance work is trained and qualified to perform the task. The facility should verify that there is a record or report about the type of work performed. The maintenance work performed should match the expectations of the facility, the agreement with the service provider, and the specifications of the manufacturer’s/operator’s manual. (SS)

The committee revised standard 3.5.3 to mirror all other AABB Standards and to match the AABB Quality System Essentials. (SC)

☑ Actionable Checklist

• Define and document SOPs for cleaning and sanitization methods and intervals for each piece of equipment.
  • Include specific cleaning agents and techniques in SOPs.
• Conduct and document regular environmental condition assessments to ensure suitability for operations, calibrations, inspections, measurements, and tests.
• Implement a procedure to immediately remove malfunctioning or out-of-service equipment from use and notify relevant personnel.
  • Maintain a log of equipment status updates and notifications.
• Establish a monitoring system to ensure equipment parameters are consistently maintained.
  • Record and review monitoring data regularly.
• Develop SOPs for handling, maintenance, and storage of equipment to ensure it remains fit for use.
  • Include manufacturer’s recommendations in SOPs.
• Verify and document that all equipment maintenance and repairs are performed by qualified individuals.
  • Maintain records of qualifications and training for individuals performing maintenance.

3.5.4 Investigation and Follow-Up

Investigation and follow-up of equipment malfunctions, failures, or adverse events shall include:

1. Assessment of products or services provided since the equipment was last known to be functioning per the manufacturer’s written instructions or organization-defined specifications.
2. Assessment of the effect on the safety of individuals affected.
3. Removal of equipment from service, if indicated.
4. Investigation of the malfunction, failure, or adverse event, and a determination if other equipment is similarly affected, as applicable.
5. Requalification of the equipment.
6. Reporting the nature of the malfunction, failure, or adverse event to the manufacturer, when indicated.

Guidance

The committee added standard 3.5.4 to mirror all other AABB Standards and to match the AABB Quality System Essentials. (SC)

☑ Actionable Checklist

• Develop an SOP for investigating equipment malfunctions, including assessment protocols for affected products and services.
  • Include a checklist for assessing the impact on product safety and individual safety.
• Maintain a log for documenting equipment malfunctions, failures, or adverse events.
• Implement a procedure for removing equipment from service when indicated.
• Establish a protocol for investigating malfunctions and determining if other equipment is affected.
• Create a requalification process for equipment post-repair or maintenance.
• Develop a reporting template for notifying manufacturers of equipment malfunctions, failures, or adverse events.

3.6 Equipment Traceability

[Cord blood applicable]

The organization shall maintain records of equipment use in a manner that permits:

1. Equipment to be uniquely identified and traceable.
2. Tracing of any given product or service to all equipment associated with the procurement, processing, storage, distribution, and administration of the product or service.
3. Identification and recall of all cellular therapy products associated with a specific piece of equipment.

☑ Actionable Checklist

• Develop and implement an SOP for equipment identification and traceability.
  • Include procedures for assigning unique identifiers to each piece of equipment.
• Maintain an equipment log that records usage, maintenance, and calibration.
  • Ensure the log includes fields for unique equipment identifiers.
• Implement a system to link equipment identifiers with specific cellular therapy products.
  • Use software or manual logs to track equipment-product associations.
• Conduct regular audits to verify the accuracy and completeness of equipment traceability records.
• Train staff on procedures for documenting and maintaining equipment traceability.
  • Keep training records and competency evaluations up to date.
• Establish a recall procedure for products associated with specific equipment.
  • Test the recall procedure annually to ensure effectiveness.

3.7 Information Systems

[Cord blood applicable]

The organization shall have controls in place for the implementation, use, ongoing support, and modifications of information system software, hardware, and databases. Elements of planning and ongoing control shall include:

1. Numeric designation of system versions with inclusive dates of use.
2. Validation/verification/qualification of system software, hardware, databases, and user-defined tables before implementation.
3. Fulfillment of life-cycle requirements for internally developed software.
4. Defined processes for system operation and maintenance.
5. Defined process for authorizing and documenting modifications to the system.
6. System security to prevent unauthorized access.
7. Policies, processes, and procedures and other instructional documents developed using terminology that is understandable to the user.
8. Functionality that allows for display and verification of data before final acceptance of the additions or alterations.
9. Defined process for monitoring of data integrity for critical data elements.
10. System design that establishes and maintains unique identity of the donor, the product, or the service, and the recipient (as applicable).
11. Training and competency of personnel who use information systems.
12. Procedures to ensure confidentiality of protected information.

Guidance

The committee revised standard 3.7 to mirror all other AABB Standards and to match the AABB Quality System Essentials. (SC)

☑ Actionable Checklist

• Maintain a log of numeric designations for system versions, including inclusive dates of use.
  • Verify that all system versions are documented with dates in the version control log.
• Validate, verify, and qualify system software, hardware, databases, and user-defined tables before implementation.
  • Document validation/verification/qualification results in the validation master plan (VMP).
• Develop and document life-cycle requirements for internally developed software.
  • Review and update the software development life-cycle documentation annually.
• Establish and document processes for system operation and maintenance.
  • Review and update SOPs for system operation and maintenance annually.
• Define and document processes for authorizing and documenting modifications to the system.
  • Maintain a modification log with authorization signatures for all changes.
• Implement system security measures to prevent unauthorized access.
  • Conduct and document annual security audits.
• Develop policies, processes, and procedures using user-understandable terminology.
  • Review and update instructional documents for clarity annually.
• Ensure functionality for display and verification of data before final acceptance of additions or alterations.
  • Test and document data verification processes during system validation.
• Define and document a process for monitoring data integrity for critical data elements.
  • Perform and document quarterly data integrity checks.
• Design the system to establish and maintain unique identities for donors, products, services, and recipients.
  • Validate and document the unique identity feature during system testing.
• Ensure training and competency evaluation of personnel using information systems.
  • Maintain current training records and competency evaluations for all system users.
• Implement procedures to ensure confidentiality of protected information.
  • Review and update confidentiality procedures annually.

3.7.1 Alternative Systems

[F]

An alternative system shall be maintained to ensure continuous operation in the event that computerized data and computer-assisted functions are unavailable. The alternate system shall be tested at defined intervals. Processes and procedures shall address mitigation of the effects of disasters and include recovery plans.

Guidance

The purchase of computer software, hardware, or databases should have adequate supplier qualification. For example, if the facility is purchasing computer software that will be used by the entire facility, the program should request an opportunity to provide input to ensure that it meets the program’s needs. Similarly, if the facility places an order for software, hardware, or databases to be used in its department, it should identify necessary requirements and ensure that the software, hardware, or databases to be obtained or modified will be capable of meeting those requirements. It should ensure that the information systems department can provide adequate technical support.

Once the system is obtained, training of applicable staff must be provided, and the equipment and software must be validated to ensure that it performs as intended. It must be tested in a “live” environment (“implementation”), and once it has been functioning for a few days or weeks, the facility should determine whether the system is operating as anticipated and generating expected results (“evaluation and postimplementation”). Whether software is developed in-house or is purchased and then modified, software that involves critical processes must go through the same rigorous stages in risk analysis, training, validation, implementation, and postimplementation evaluation of effectiveness.

Standard 3.7, #3 requires records of the fulfillment of life-cycle requirements for internally developed software. The term “fulfillment of life-cycle requirements” refers to the completion of the series of stages that computer software is required to go through from its time of inception to retirement. These stages are defined by the software developer, and will depend on the product and the organization.

The typical development phase for internally developed software, including purchased software that is subsequently modified, includes:

• Management of software.
• Identification of requirements.
• Design.
• Coding.
• Integration and testing.

Typical stages of software during and following implementation are:

• Installation.
• Acceptance testing.
• Operation and support.
• Maintenance.

For modifications that will be made during or after implementation, the development phase should be revisited. Based on the system, the facility will incorporate the life-cycle requirements into its processes and procedures. Records are required to be maintained throughout the life-cycle of the software.

In the event of a downtime where primary electronic systems are not operational, the facility must have an alternative validated method that allows access to critical information as well as continuous operation of critical computer-related activities. Although the standards do not stipulate, the alternative systems may use manual paper or an electronically based approach. (SS)

The committee revised standard 3.7.1 to mirror all other AABB Standards and to match the AABB Quality System Essentials. (SC)

☑ Actionable Checklist

• Develop and document an alternative system for data continuity during computer system outages.
  • Include detailed procedures for manual data entry and retrieval.
  • Ensure the alternative system is accessible to all relevant staff.
• Conduct regular testing of the alternative system at defined intervals.
  • Document test results and any corrective actions taken.
• Create and maintain disaster recovery plans addressing data loss and system failures.
  • Include step-by-step recovery procedures and responsible personnel.
• Validate all software and hardware used in critical processes.
  • Maintain records of validation activities and outcomes.
• Train staff on the use of alternative systems and recovery procedures.
  • Keep training records and competency evaluations up to date.
• Perform regular audits to ensure compliance with data continuity and recovery standards.
  • Document audit findings and track corrective actions through CAPAs.

3.7.2

Personnel responsible for management of information systems shall be responsible for compliance with the regulations that affect the use of the system.

Guidance

The committee added standard 3.7.2 to mirror all other AABB Standards and to match the AABB Quality System Essentials. (SC)

☑ Actionable Checklist

• Identify personnel responsible for the management of information systems.
  • Document roles and responsibilities in an SOP.
• Provide training for responsible personnel on relevant regulations affecting information systems.
  • Maintain training records and competency evaluations.
• Conduct a gap analysis to ensure compliance with regulations related to information systems.
  • Document findings and implement necessary corrective actions.
• Establish a procedure for regular review and updates of information system compliance.
  • Schedule and document periodic reviews.
• Maintain a log of all information system updates and changes.
  • Ensure all changes are reviewed and approved by responsible personnel.
• Conduct internal audits focusing on information system compliance.
  • Document audit findings and track corrective actions.

3.7.3

The organization shall support the management of information systems.

Guidance

The committee added standard 3.7.3 to mirror all other AABB Standards and to match the AABB Quality System Essentials. (SC)

☑ Actionable Checklist

• Develop and maintain an SOP for the management of information systems.
  • Include procedures for data entry, access control, and data backup.
• Conduct regular risk assessments of information systems to identify vulnerabilities.
• Implement a training program for staff on the use and management of information systems.
  • Document all training sessions and maintain records.
• Schedule and perform regular audits of information systems to ensure compliance with SOPs.
• Establish a process for reporting and addressing information system failures or breaches.
  • Document all incidents and corrective actions taken.

3.7.4

A system designed to prevent unauthorized access to computers and electronic records shall be in place.

Guidance

The committee added standard 3.7.4 to mirror all other AABB Standards and to match the AABB Quality System Essentials. (SC)

☑ Actionable Checklist

• Implement user authentication protocols for all computer systems.
  • Ensure unique user IDs and secure passwords are required.
• Develop and maintain an SOP for managing user access levels.
  • Include procedures for granting, modifying, and revoking access.
• Conduct regular audits of user access logs to detect unauthorized access attempts.
• Install and maintain firewall and antivirus software on all networked devices.
• Train staff on the importance of cybersecurity and proper use of electronic records.
• Review and update the electronic records access policy annually.

3.7.5

The organization shall have measures in place to minimize the risk of internal and external data breaches.

Guidance

Cellular therapy facilities store a great deal of donor- and patient-specific confidential data. Like any organization in today’s world, it is its responsibility to protect this data from an internal or external breach. Policies and procedures aimed at this are often determined at the highest level of an organization. Examples of policies may include, but are not limited to, the following:

• Information security policies are in place and being followed.
• Compliance is audited. (For example, do people change passwords frequently enough and keep them secure?)
• All reports/electronic communications, etc, carrying sensitive/confidential information are controlled and disposed of securely.
• Assessment of the need to encrypt transmitted data.
• Data extraction is controlled (eg, prohibiting staff from running a query on the facility’s database and generating an excel spreadsheet that they keep on their laptop without proper security controls).
• All hardware to be disposed of has been appropriately data-cleansed.
• Staff have been trained in the basics of data protection (eg, training documentation should show that they were instructed not to open a suspicious attachment in an email, click on links in emails from unknown senders, or navigate to websites that are questionable.

Management staff should have knowledge of and be able to explain, at least at a general level, the policies surrounding data protection in their organization. (SS)

☑ Actionable Checklist

• Develop and implement an information security policy addressing data breach prevention.
  • Review and update the policy annually or as needed.
• Conduct regular audits to ensure compliance with security policies.
  • Verify password security and change frequency.
• Implement secure disposal procedures for reports and electronic communications containing sensitive data.
• Assess and document the need for data encryption during transmission.
• Establish controls for data extraction and storage on personal devices.
  • Prohibit unauthorized queries and storage of data on unprotected devices.
• Ensure all hardware is data-cleansed before disposal.
• Provide staff training on data protection basics.
  • Maintain training records and document competency evaluations.

3.8 Technology Infrastructure

[F]

The organization shall have an active program to ensure that critical technology and communication infrastructures function as intended, including risk-based monitoring or testing at facility-defined intervals. Standards 1.4, 1.5, and 1.6 apply.

Guidance

The committee created new standard 3.8 to ensure that facilities monitor their critical technology infrastructure and that they function as expected. This standard requires that there are defined checks to monitor that technology is working as intended and expected. (SC)

☑ Actionable Checklist

• Develop and implement an SOP for monitoring critical technology and communication infrastructures.
  • Include risk-based monitoring or testing intervals in the SOP.
• Conduct and document regular testing of technology infrastructure per the defined intervals.
  • Use a standardized form or log to record test results and any identified issues.
• Perform a risk assessment to identify critical technology components and potential failure points.
  • Update the risk assessment annually or as significant changes occur.
• Ensure all staff are trained on the SOP and understand their roles in monitoring technology infrastructure.
  • Maintain training records and competency evaluations for all relevant personnel.
• Review and update the technology infrastructure monitoring program during management reviews.
  • Document any changes or improvements made to the program.

3.9 Alarm Systems

[F]

Storage devices for cellular therapy products shall have alarms and shall conform to the following standards:

Guidance

Quality control testing for alarm systems needs to ensure the alarms are being activated and the temperature-recording device is responding before the temperature-sensing device (probe) reaches an unacceptable temperature. An electronic alarm test that merely increases or decreases the electronic digital readout to determine if the audio alarm sounds would not meet the intent of these standards. The temperature-sensing device is not being tested to determine if it is sending the signal to activate the alarm, but whether the recording device is responding to allow proper action before unacceptable temperatures are detected. If the electronic test is increasing and decreasing the actual temperature of the probe to verify 1) the probe is sending the signal to activate the alarms and 2) the recording device is documenting when inappropriate temperatures are reached, then this method would meet the intent of these standards. (SS)

The committee added new standard 3.9 for completeness. This standard does appear in other AABB Standards that require the use of alarm systems. The committee felt that having these elements in chapter 3 was necessary as it relates to equipment. The concept of alarm systems also appears in chapters 5 and 10 but these are not redundant. (SC)

☑ Actionable Checklist

• Verify that all storage devices for cellular therapy products are equipped with functional alarm systems.
  • Conduct regular quality control testing to ensure alarms activate before reaching unacceptable temperatures.
  • Test temperature-sensing devices to confirm they send signals to activate alarms.
  • Ensure temperature-recording devices respond appropriately to alarm signals.
• Document all alarm system tests in the appropriate log or form.
• Review and update SOPs related to alarm system testing and maintenance.
• Train staff on procedures for responding to alarms and document training records.
• Perform and document regular internal audits to ensure compliance with alarm system standards.

3.9.1

The alarm shall be set to activate under conditions that will allow enough time for proper action to be taken before cellular therapy products reach unacceptable conditions.

Guidance

The committee added new standard 3.9.1 for completeness. This standard does appear in other AABB Standards that require the use of alarm systems. The committee felt that having these elements in chapter 3 was necessary as it relates to equipment. The concept of alarm systems also appears in chapters 5 and 10 but these are not redundant. (SC)

☑ Actionable Checklist

• Verify that all equipment alarms are set to activate before cellular therapy products reach unacceptable conditions.
  • Review and document alarm set points for each piece of equipment.
  • Ensure alarm set points are based on validated parameters.
• Conduct regular testing of alarm systems to confirm functionality.
  • Schedule and document alarm tests at least quarterly.
  • Record test results in the equipment maintenance log.
• Develop and maintain SOPs for responding to alarm activations.
  • Include step-by-step actions to be taken upon alarm activation.
  • Train staff on SOPs and document training completion.
• Implement a system for logging all alarm activations and responses.
  • Use an alarm response log to track incidents and corrective actions.
  • Review logs during management reviews for trends or issues.
• Perform a risk assessment to evaluate the adequacy of current alarm settings.
  • Document findings and update alarm settings as necessary.
  • Review risk assessment annually or when significant changes occur.

3.9.2

Activation of an alarm shall initiate a process for immediate action, investigation, and appropriate corrective action.

Guidance

The committee added new standard 3.9.2 for completeness. This standard does appear in other AABB Standards that require the use of alarm systems. The committee felt that having these elements in chapter 3 was necessary as it relates to equipment. The concept of alarm systems also appears in chapters 5 and 10 but these are not redundant. (SC)

Excerpt of Reference Standard 6.2.9A Relevant to Equipment

Standard	Record to Be Maintained	Quality System Records	Donor Eligibility/ Management Issues	Unit/ Recipient	Retention after Creation (C) or Final Disposition (F) of Related Product	Minimum Retention Time (in years)1
3.2	Equipment qualification	X	X	X	C	10 years after retirement of the equipment
3.4	Unique identification of equipment	X	X	X	C	10
3.5.1	Equipment calibration activities	X	X	X	C	10
3.5.2	Equipment found to be out of calibration	X	X	X	C	10
3.5.3	Equipment monitoring, maintenance, calibration, and repair	X	X	X	C	10
3.6	Equipment traceability	X	X	X	C	10
3.7	Implementation and modification of software, hardware, or databases	X	X	X	C	2 years after retirement of system
3.7.1	Testing of alternative systems	X	X	X	F	10
3.8	Monitoring of technology infrastructure	X	X	X	F	10
3.9	Alarm system check	X	X	X	F	10

¹Applicable federal, state, or local law may exceed this period.

☑ Actionable Checklist

• Develop and implement an SOP for alarm activation response, including immediate action steps.
  • Include procedures for investigating the cause of the alarm.
  • Define roles and responsibilities for staff during an alarm event.
• Maintain a log for all alarm activations, documenting the date, time, and nature of the alarm.
  • Record the investigation findings and corrective actions taken.
• Conduct regular training sessions on alarm response procedures for all relevant staff.
  • Keep training records and competency evaluations updated.
• Perform routine audits of alarm system functionality and response procedures.
  • Document findings and implement CAPAs for any identified deficiencies.
• Review and update the alarm response SOP annually or as needed based on audit findings or system changes.
• Ensure all alarm system checks are documented and records are retained for a minimum of 10 years.