Chain of Custody · Reference design

Proof at every handoff, for every slide folder.

A hybrid chain-of-custody design for histology slide routing. Cameras at doors, benches and shelves, the batch scanners a lab already has, and the LIS feed into one event model, so every folder has a route history you can search by case, person, place or time. Most events are captured passively, as staff do their normal work.

See the rollout The full program

Reference design · Rev A · October 2026

Fig. 0 · One folder's routeGeneric plan · not a real site

Where slides go missing

The breakdown happens at handoffs, not in transit.

In anatomic pathology labs we see the same six problems again and again. The LIS can say a folder was delivered while nobody can say where it physically is.

Routing

Misdelivery

Folders reach the wrong pathologist group or site, and biopsies end up in large-case piles. The LIS records a delivery without checking where it physically went.

Location

Delivered, then lost

A slide can be "delivered" in the LIS and still be nowhere to be found for weeks. Nobody can say who picked it up or where it was last seen. Recuts follow.

Time

Work ages unseen

Cases wait unassigned or unsigned with no measure of physical time between stages, so no one can see where the delay builds up.

Systems

Events in any order

LIS tracking events can be applied in any sequence, and batch scanners tied to a workstation do not suit handoffs on the move.

Cost

Labels and RFID

Poor label print quality erodes trust in scanning, and tagging every slide every day is expensive and loses the trail when slides leave the building.

People

Scan fatigue

If staff must scan every move on a handheld and it slows them down, they stop. The design cannot depend on that.

Four design principles

Control where custody changes hands, without slowing anyone down.

Prove the handoff

Failures happen at handoffs between people, rooms, benches and bins, not in transit. Control goes where custody changes hands.

Track the folder

The folder or tray is the license plate for its slides: fewer labels, simpler routing, and the way staff already batch work.

Capture passively

Fixed cameras and gates record events as people work. Handhelds are kept for exceptions and damaged labels.

Keep the LIS

The LIS stays the system of record; the custody service becomes the system of movement truth, and the two are compared.

The folder's journey

Seven custody events, a logical path and a physical one.

1Folder assembledAssociated with its case or bundle in the production area.
FOLDER_CREATED
2QC and deliveredPlaced on the QC bench; the overhead camera records the folder and the associate.
QC_DELIVERED
3Leaves the labPasses the monitored exit, optionally confirmed by the badge reader.
EXIT_LAB
4Arrives at destinationEnters the sign-out room or second-site staging.
ARRIVE_ZONE
5Placed on a shelfThe shelf camera records the actual destination: the first proof of where it went.
PLACED_<DESTINATION>
6Picked upA pathologist or downstream handler takes possession.
PICKED_UP
7Closed outVerified, scanned, archived, rerouted or escalated.
VERIFIED · ARCHIVED · ESCALATED

Each event carries the folder, the place, the time, the person when known, a confidence score and a video reference. Because the LIS events land on the same timeline, the platform can compare the software state with observed movement and flag a mismatch early: a folder marked delivered that never passed the exit gate, or one placed on a shelf it was not ordered to.

Operating ruleAnything leaving a controlled area carries a visible license plate and passes a monitored gate.

Production architecture

Five layers, with normalization at the heart.

Capture covers doorway and bench cameras, batch scanners, badge readers, optional RFID gates and LIS events. Edge gateways process video on site, which keeps bandwidth down and keeps events flowing when upstream systems are unavailable. The normalization layer turns every source into one custody event model. Custody services keep timelines, SLA clocks, alerts and investigations. The experience layer gives leadership, staff and pathologists route playback, last-known-location search and overdue queues.

Hardware, kept small

Doorway cameras at every zone transition in scope
Overhead cameras on the QC bench and the destination shelves
One or two edge gateways on a segmented network
Existing batch scanners, feeding the same timeline
A few rugged handhelds, for exceptions only

Fig. A · ArchitectureGreen: the layer that reconciles everything

The rollout · five phases

The same floor plan, from unknown to proven.

Each phase ends at an exit gate. Follow the capture points in the drawings: dashed while they are candidates, hatched while they are being measured, solid once they are trusted.

00Weeks, not months

Design and alignment

Agree on where custody changes hands before installing anything.

We walk the route a folder takes, confirm which doors, benches and shelves are in scope, and give each one a location code. Destination codes, the event taxonomy, privacy and video retention are agreed with the lab, compliance and IT before a camera goes up.

What we do

Walk-through of every handoff on the route
Location codes for doors, benches, shelves, staging
Event taxonomy and destination codes
Privacy, retention and network zone review

What you receive

Capture-point map with priorities
Event model and code book
Privacy and retention decisions on record

Exit gateEvery capture point in scope has a code, and privacy and retention are signed off.

Fig. 1 · Design and alignmentDashed: not yet confirmed

01Smallest set, highest risk first

Instrumentation and integration

Cameras at the riskiest handoffs, an edge gateway on site, the LIS mapped in.

Doorway cameras go on the lab exit and the destination entries, overhead cameras on the QC bench and the destination shelves. One or two edge gateways process the streams on site and emit events with a video reference. Existing batch scanners keep working and feed the same timeline, and LIS event codes are mapped into the shared model.

What we do

Doorway and overhead cameras
Edge gateways on a segmented network
Batch-scanner and badge feeds
LIS event codes mapped to the model

What you receive

As-built capture-point record
Integration map: source, event, owner
Test events from every capture point

Exit gateEvery capture point produces events, and every LIS code maps to the shared model.

Fig. 2 · Instrumentation and integrationGreen: capture point live

02Measure before you change anything

Shadow mode

Run alongside today's process and measure how well it sees.

Nothing changes for staff. The platform reads labels, builds routes and is compared with what really happened. We measure read rates, event accuracy, how completely a route can be reconstructed, and the false positives and missed events at each capture point.

What we do

Read rates by capture point
Route reconstruction checks
False-positive and missed-event review
Label quality findings

What you receive

Accuracy report per capture point
Fix list: angles, lighting, labels
Baseline KPIs before go-live

Exit gateRoute reconstruction and missed-event rate are measured and accepted.

Fig. 3 · Shadow modeHatched: checked against today

03Alerts on, weekly review

Operational pilot

Turn on the alerts and work the exceptions.

Misroute, custody-gap and aging-work alerts go live. An investigation workflow opens a case for every misdelivery or lost folder, and lab leadership reviews the KPIs every week. Handhelds handle the exceptions: damaged labels and handoffs off the normal path.

What we do

Misroute, custody-gap and aging alerts
Investigation cases with route playback
Exception handling on handhelds
Weekly KPI review

What you receive

Live dashboards for leadership
Investigation history per folder
Pilot results against the baseline

Exit gateAlerts are reviewed weekly and the KPIs beat the baseline.

Fig. 4 · Operational pilotDashed: placed where it was not ordered

04Evidence decides the next door

Production expansion

More doors, more benches, scanner integrations, and RFID only where it pays.

Coverage grows to more doors, benches and the second-site staging point, and digital-pathology scanners can feed the same timeline. RFID stays limited to narrow choke points where a trial shows a measurable drop in risk or cost.

What we do

New capture points by measured risk
Slide-scanner and archive events
Constrained RFID trials
Runbook and staff training

What you receive

Expansion plan with expected ROI
RFID trial results
Operations runbook

Exit gateEach new capture point is justified by measured risk or cost.

Fig. 5 · Production expansionDashed: RFID trial only

The custody record

A simple, auditable schema.

Patient references are tokenized. Every event keeps a hash of its raw payload, so the record can be audited back to its source.

Folder

folder idcase idbundle idslide countbarcodeRFID tag (optional)target destinationpriority

Case

case idaccession idpatient reference (tokenized)service lineordered destinationcurrent state

Location

location codenametype: door, room, bench, shelf, staging, scanner, archiveparent locationzone

Custody event

folderemployee (if known)locationsource: camera, RFID, scanner, LISevent typetime (UTC)confidencevideo referencedirection

Investigation

folder and caseissue: misdelivery, lost slide, overdue, misrouteopened by and whenstatusresolution

Derived views

Folder timelineCustody gaps past SLAMisroutes: ordered vs observedAging work by destination

Who it changes things for

Less scanning for staff, more answers for everyone else.

Lab associate

Works as today, placing folders in monitored zones with a readable label. No extra scan on a normal move.

Courier or runner

Walks through monitored doors; pickup and arrival are recorded automatically. A handheld covers damaged labels.

Pathologist

Gets folders where they belong, and can search a case or folder for its last known route and shelf.

Lab leadership

Sees coverage, dwell times, overdue folders and misdelivery hotspots, week by week.

KPI	Definition	Measures
Confirmed custody coverage	Share of required handoffs with who, what, where and when evidence	Operational control
Misdelivery rate	Share of folders placed somewhere other than their ordered destination	Routing accuracy
QC to destination	Elapsed time from the QC bench to arrival at the destination	Logistics speed
Aging folders	Folders with no pickup or verification after the agreed SLA	Hidden backlog
Recuts avoided	Lost-slide investigations resolved from route history before a recut	Labor and tissue saved
Exceptions by zone	Custody gaps or misroutes per room, door or shelf	Process hotspots

This is a reference design drawn from our work on chain-of-custody solutions for anatomic pathology. Floor plans, zones and event names are generic and do not depict any client site. Epic and Beaker are trademarks of Epic Systems Corporation; CarolinaEMR is an independent consulting firm and is not affiliated with or endorsed by Epic. Camera, RFID and scanner choices are made per site after Phase 00.

Begin at Phase 00

Walk one folder's route with us.

We map every handoff from the QC bench to the pathologist's shelf, mark which ones you can prove today, and hand you the capture-point plan. The gaps become the scope of the pilot.

Request a walk-through Epic Beaker story