Most operational risks in a fertility clinic are recoverable. A billing error can be corrected, a scheduling mistake rescheduled, a documentation gap filled in retrospectively by someone who remembers.
Cryostorage is the exception. The material is irreplaceable, the consequences of losing track of it are absolute, and the gap is usually discovered years after it opened — by which point nobody involved is still at the clinic.
Why storage is different from every other lab risk
A cryostorage record has to stay correct for longer than any other record a clinic keeps, and it has to stay correct without anyone looking at it.
An active cycle is under constant observation: several people see the record every day, and an error surfaces quickly because someone is using the data. Stored material is the opposite. A straw placed in a goblet in 2019 may not be touched again until 2031. Nothing in the intervening twelve years will reveal that its position was recorded wrong, its consent lapsed, or its owner moved country — until someone goes looking for it and it is not where the record says.
That asymmetry is why storage tolerates spreadsheets for a long time and then fails all at once. The spreadsheet is not wrong on the day it is written. It becomes wrong slowly, and silently, and nobody is watching.
The financial edge of the same problem is well documented in the sector: between 5% and 18% of cryo samples become unclaimed each year, accumulating storage obligation the clinic carries without authority, payment, or a clear route to resolution.
Position is the record: tank, canister, goblet, straw
Cryostorage identity is hierarchical, and every level has to be exact. A sample is not “in tank 3” — it is in a specific position, in a specific goblet, in a specific canister, in tank 3.
A logbook records the position at the moment of freezing. What it handles badly is everything after: a canister reorganised during a tank transfer, a goblet consolidated when space ran short, material moved during decommissioning of an ageing vessel. Each of those is routine lab work, and each invalidates every downstream record unless the move itself is captured as an event.
MedCryo pins every oocyte, embryo, sperm sample and ovarian-tissue specimen to a precise tank, canister, goblet and position, with witness sign-offs at each transfer — so a move is a recorded event rather than an edit to a cell that used to say something else.
The distinction matters most during an investigation. “Where is this sample now?” is answerable from a logbook. “Where has it been, and who moved it?” usually is not.
Continuous monitoring versus the morning check
Manual temperature and level checks sample the tank a couple of times a day. Between those checks, the clinic is relying on the physics of the vessel and on nothing else.
That is adequate right up until it isn’t. A slow LN₂ loss, a failing vacuum jacket, a lid not fully seated after a routine access — these develop over hours, and the morning round either catches them near the end or catches them after. The log will faithfully record that everything was fine at 8am and fine again the next day.
MedCryo streams LN₂ level, temperature, humidity and battery telemetry from every tank straight into the EMR, and its witness RFID linkage raises alarms in real time when a specimen-to-patient mismatch is detected at transfer.
The integration is the point rather than the sensors. Plenty of tanks have alarms. Far fewer clinics can answer the question that follows one: which patients’ material was inside that vessel during the excursion? If monitoring data lives in a facilities system and sample positions live somewhere else, that answer takes days to assemble — and it will be the first thing anyone asks.
Reconciliation is the control nobody runs
Here is the practice most cryostorage programmes lack entirely: a scheduled physical count, checked against the system record.
Reconciliation is standard in any operation holding valuable inventory, and cryostorage is treated as an exception mostly because counting is laborious and the tanks feel self-evidently full. But a cryo discrepancy is unlike a stock discrepancy in one decisive way: it cannot be written off. Every position holds identifiable patient material with consent and legal ownership attached. A count that does not match is not a number to adjust; it is a question that has to be answered.
Discrepancies arrive in both directions, and both matter:
- Something in a position the record says is empty. Material that exists without a clear owner — the hardest case, because there may be no lawful basis for either continued storage or disposal.
- Nothing in a position the record says is occupied. Either it was moved and the move was not captured, or it was disposed of and the disposal was not recorded.
The second is more common and less alarming than it sounds — it is usually a documentation failure rather than a lost sample. But you cannot know which until you look, and you can only look if you counted.
The practical recommendation is simply to schedule it. A reconciliation performed because something already looks wrong is an incident response. A reconciliation performed quarterly is a control.
Consent has an expiry date and the sample does not know it
Storage authority is not permanent. It rests on a consent with a defined term, and when that term lapses the clinic’s legal basis for holding the material lapses with it.
Physically, nothing happens. The sample sits exactly where it was, at exactly the right temperature, indefinitely. The clinic continues to maintain it, continues to incur cost, and — in many cases — continues to bill for it, while holding material it no longer has clear authority to hold.
That gap between an expired authorisation and an unchanged tank is the most common cryostorage compliance failure, and it is entirely a data-linkage problem. If consent lives in a document store and samples live in an inventory, expiry is invisible. If consent dates are attached to the samples themselves, expiry is a report.
MedCryo handles the operational side of this with renewal alerts and four-party consent workflows, with renewals feeding through to Billing so the commercial and clinical sides of a renewal stay in step rather than being matched up afterwards.
Note that this is renewal tracking, not inventory reconciliation — the two are often conflated. Renewal alerts tell you a consent is approaching its term. Only a physical count tells you the sample is still where the record says.
Storage duration limits differ by an order of magnitude
Any clinic operating across borders — or treating international patients, which in fertility means most clinics in the Gulf, Southeast Asia and the Caucasus — is running more than one storage clock.
The spread is not marginal:
- The United Arab Emirates permits embryo storage for up to five years, extendible with the consent of the relevant parties, under Federal Law No. 7 of 2019, whose executive regulations came into force on 1 January 2021 (UAE Legislation).
- The United Kingdom permits storage for up to 55 years following the change of 1 July 2022 — but conditionally, with consent renewed at least every ten years, which turns a long limit into a recurring obligation rather than a single decision (HFEA).
Five years against fifty-five is a difference in kind, not degree. And the UK model is instructive for everyone: a long permitted duration with a ten-year renewal cycle means the compliance burden is not the limit itself but the recurring checkpoint. A clinic that treats storage duration as a single expiry date will miss it.
For a multi-site group the practical implication is that duration rules have to be configurable per site rather than set as a policy, and that a patient relocating between jurisdictions changes which clock applies to material that has not moved at all.
Disposition and fate accountability
Every sample eventually leaves storage. It is thawed for use, transferred to another clinic, donated, or disposed of — and each of those is a terminal event that the record has to survive.
Disposition is the one cryostorage event with no second chance. A position error can be corrected once found; a monitoring gap can be closed; an expired consent can sometimes be renewed retrospectively. Material that has been discarded cannot be re-examined, which means the record created at the moment of disposal is the only record that will ever exist.
It needs to carry all of it: what was disposed of, from which exact position, on what date, under whose authority, against which consent, witnessed by whom. MedCryo tracks vitrification events, warming records and dispositions through its bridges to LIMS and MedART, with audit-ready event logs carrying tamper-evident hashes and exports in registry-ready formats for ESHRE, SART, DHA, MOH, KARM and PSRM.
The tamper-evident part matters more here than anywhere else in the clinic. For every other record, an inspector can compare the record against reality. For a disposition, the record is the reality.
What audit-ready actually means
Audit-readiness is not a document you prepare. It is a set of questions you can answer without preparation:
- Pick a random position. What is in it, whose is it, and when was it last physically verified?
- Pick a patient. Where is all of their material, in every tank, across every site?
- List every sample whose storage consent expires in the next ninety days. If this needs a manual cross-reference, you do not have consent linkage.
- Take last quarter’s tank excursion. Which patients’ material was affected?
- Take a sample disposed of two years ago. Who authorised it, and on what basis?
A clinic that can answer all five in an afternoon is audit-ready. One that can answer three is running on institutional memory, which works precisely until the person holding it leaves.
None of this is really about software. It is about whether storage is being managed as an inventory with controls, or as a set of tanks that people are careful around. The distinction only becomes visible at the moment it matters, and by then the gap has usually been open for years.
For the broader picture of how traceability spans several systems rather than one, see what your EMR should and shouldn’t be tracking in the IVF lab. On the patient-facing side of storage, fertility preservation software for egg freezing covers the egg-freezing workflow specifically. And Embryology in MedART holds the clinical events that storage records ultimately attach to.
Topics
Product Head — MedART
Preeti Pamecha is Product Head for MedART, the purpose-built IVF EMR platform powering fertility clinics across 25+ countries. She leads the product roadmap across MedART's 17+ modules — clinical documentation, embryology, andrology, laboratory, billing, patient-360, analytics, and beyond — translating how IVF care actually happens on the ground into what the platform does next. She works closely with fertility clinic leaders, embryologists, and lab directors to make sure every release reflects real clinic workflows, not assumptions about them.
