The quality program behind a tissue-derived product

Two layers, and most coverage only reads one

Human cell and tissue products regulated under the tissue rules carry a set of manufacturing requirements called current good tissue practice. Most summaries describe the visible half: the room, the air, the processing step, the label.

There is a second half that governs who decides, who signs, and what survives afterward. It sits in the same subpart and it is where a reader can ask the sharper questions.

The umbrella section states the reach plainly. Current good tissue practice requirements "govern the methods used in, and the facilities and controls used for, the manufacture of HCT/Ps". The same sentence names the reach: "all steps in recovery, donor screening, donor testing, processing, storage, labeling, packaging, and distribution."

The stated purpose is narrower than the word quality suggests. These rules exist to prevent the introduction, transmission, or spread of communicable diseases, not to establish that a product works.

Ten requirements are marked core, and the marking matters

The umbrella section lists which requirements count as core. Ten items are named, covering facilities, environmental control, equipment, supplies and reagents, recovery, processing, labeling controls, storage, distribution, and donor eligibility.

That list is not decorative. Other obligations in the subpart attach specifically to the core set: the quality program has to address all of it, complaints are reviewed against it, and deviation reports are triggered by it.

So a firm can be doing a great deal that is real and still be measured on a defined shortlist. Reading the shortlist tells you what a regulator will ask about first.

The obligation that reaches a supplier you never see

A tissue product often passes through several hands. The rules divide responsibility rather than pooling it: an establishment that performs only some operations need only comply with the requirements applicable to the operations it performs.

The contracted party carries its own weight too. Where another establishment is engaged to perform a manufacturing step, that establishment is responsible for complying with requirements applicable to that step.

Then comes a duty that runs the other way. Before entering into such an arrangement, the hiring establishment must ensure the other one complies with applicable requirements, and must take reasonable steps if it later learns otherwise.

The section ends that sequence with an instruction, not a suggestion. "If you determine that the establishment is not in compliance with those requirements, you must terminate your contract, agreement, or other arrangement with the establishment."

The phrase that looks like a loophole and is not

Several requirements in this subpart are qualified by the words where appropriate. Read casually, that reads like an escape.

The section closes it. A requirement so qualified is deemed appropriate "unless you can document justification otherwise."

The default is that the requirement applies. Skipping it is allowed only with a written reason on file, which converts a judgment call into a record someone can later read.

What the quality program has to actually do

An establishment performing any manufacturing step "must establish and maintain a quality program intended to prevent the introduction, transmission, or spread of communicable diseases through the manufacture and use of HCT/Ps."

The program is not a document. The section lists six functions it has to perform, and each one is a verb.

It maintains procedures for core requirements. It ensures procedures exist for receiving, investigating, evaluating and documenting information, including complaints. It ensures corrective actions are taken, documented and verified as effective. It ensures personnel are trained. It maintains monitoring systems. It investigates and documents deviations and trends in deviations.

Corrective action documentation has a shape as well. Where appropriate it must identify the product affected and describe its disposition, state the nature of the problem, describe the action taken, and give the dates.

Information has to travel sideways, not just upward

One function of the quality program is unusual and worth reading twice. Information about possible contamination or potential disease transmission has to be shared outside the firm.

Three destinations are named. Other establishments known to have recovered products from the same donor. Other establishments known to have performed manufacturing steps on the same product. And, where the information arrives after distribution, the consignees.

For that last group the rules require more than a notice. Procedures must cover assessing risk, appropriate follow-up, evaluating the effect on the product, notifying everyone the affected product went to, quarantine and recall, and reporting to the agency as necessary.

This is the mechanism by which one bad finding is supposed to reach every product traceable to the same donor. Whether it did so in any given instance is not something a buyer can see from outside.

Audits, and the software nobody thinks of as equipment

The quality program has to be checked by someone. The section requires that you "must periodically perform for management review a quality audit" of activities related to core requirements.

How often is not stated as a number. Periodically is the whole of it, which means an interval is a judgment the firm makes and has to be able to defend.

Software gets its own paragraph. Custom software, or commercial software that has been customized or programmed, must have its performance validated for the intended use if the firm relies on it to comply with core requirements.

A user-defined calculation or table counts. All other software relied on for the same purpose must at least be verified. These activities are approved and documented before implementation, not after.

People: enough of them, qualified, and kept in their lane

The personnel section is three sentences long and each one does work. Personnel must be sufficient to ensure compliance with the part.

They must have the necessary education, experience and training to ensure competent performance of their assigned functions. Then a boundary: "Personnel must perform only those activities for which they are qualified and authorized."

Training is a continuing obligation rather than an onboarding event. All personnel must be trained, and retrained as necessary, to perform their assigned responsibilities adequately.

Procedures exist before the work, not after it

The procedures section fixes the order of events. Procedures appropriate to meet core requirements are established for every step the establishment performs, and designed to prevent circumstances that increase risk.

Approval comes first. "Before implementation, a responsible person must review and approve these procedures."

They also have to be where the work happens. Procedures must be readily available to personnel in the area where the operations they relate to are performed, or in a nearby area if that is impractical.

Borrowing is allowed, with a condition. "If you adopt current standard procedures from another organization, you must verify that the procedures meet the requirements of this part and are appropriate for your operations."

The records rule, and the ten-year clock

Records are made at the same time as the work. The section requires records maintained concurrently with the performance of each step, and treats any requirement to document something as the creation of a record subject to this section.

The quality bar is short and physical: "All records must be accurate, indelible, and legible." They must identify who performed the work and the dates of entries.

Retention is long. "You must retain all records for 10 years after their creation," the section says. Records tied to a particular product run at least ten years after it was administered, or from its distribution, disposition or expiration, whichever is latest.

One record is aimed squarely at the outsourcing question. The establishment must keep the name, address and list of responsibilities of any establishment performing a manufacturing step for it, available during an inspection.

What this does and does not settle

These rules apply to products regulated solely under the tissue provisions. A product that is a drug, a device, or a licensed biological product is governed by other rulebooks, and which category a marketed product falls into is a separate question this does not answer.

None of these requirements speak to whether a product does anything for a patient. They are disease-transmission controls and record controls.

They also produce almost nothing a buyer can read. The audit, the corrective action file, the training documentation and the supplier list are internal, surfacing to an agency inspector rather than a customer.

What they do give a reader is a set of precise questions. Which establishment determined this met release criteria and made it available. What manufacturing steps were performed elsewhere and by whom. Whether the seller can name those things at all.

Sources

Each document below is named as it names itself, with the date printed on that document rather than the day it was read.

1. 21 CFR 1271.150, Current good tissue practice requirements — Electronic Code of Federal Regulations, title 21, August 2026
2. 21 CFR 1271.160, Establishment and maintenance of a quality program — Electronic Code of Federal Regulations, title 21, August 2026
3. 21 CFR 1271.170, Personnel — Electronic Code of Federal Regulations, title 21, August 2026
4. 21 CFR 1271.180, Procedures — Electronic Code of Federal Regulations, title 21, August 2026
5. 21 CFR 1271.270, Records — Electronic Code of Federal Regulations, title 21, August 2026