How do I set up a lab information management system for chain of custody and timestamped records in water testing?

Setting up a LIMS for chain of custody (CoC) and timestamped records in water testing is mostly about designing the workflow, permissions, and audit trail first—then choosing software that can enforce them.

1) Define the workflow first

Map your process end to end:

1. Sample collection
2. Sample receipt at lab
3. Accessioning / login
4. Test assignment
5. Analysis
6. Review and approval
7. Report release
8. Record retention / archiving

For each step, define:

• Who can perform it
• What data must be captured
• Which timestamp is required
• What signature/approval is needed
• What happens if a sample is rejected or delayed

2) Make chain of custody a formal record

Your CoC should track every handoff. Include:

• Unique sample ID/barcode
• Sample location / matrix
• Date/time collected
• Collector name and signature
• Transfer date/time
• From/to person or organization
• Condition upon receipt
• Container count / seal status
• Requested analyses
• Holding time / preservation requirements

Best practice:

• Use barcode labels at collection.
• Require electronic or scanned signatures at each transfer.
• Prevent edits to finalized CoC entries; use corrections with audit history instead.

3) Ensure timestamp integrity

For timestamped records, the LIMS should:

• Auto-generate timestamps from the system clock
• Record created, modified, reviewed, and approved times
• Store user ID associated with each action
• Maintain an immutable audit trail
• Sync system time via a trusted time source (e.g., NTP)
• Use timezone-aware timestamps

If you need regulatory-grade records, avoid manual timestamp entry unless strictly necessary and controlled.

4) Choose a LIMS with audit trail and role-based access

Look for these features:

• Role-based permissions: sampler, analyst, reviewer, admin
• Audit trails: who changed what and when
• Electronic signatures
• Sample login and barcode support
• Workflow status tracking
• Chain of custody module
• Attachment support for field sheets, photos, instrument outputs
• Report generation
• Retention and backup controls
• API/integration with instruments, ELN, and ERP if needed

If you operate under regulated environments, check support for:

• 21 CFR Part 11-style controls
• ISO/IEC 17025 recordkeeping practices
• Local environmental testing regulations

5) Design the data model

At minimum, create tables/entities for:

• Samples
• Sample events: collection, receipt, transfer, analysis, disposal
• Custody transfers
• Tests / analytes
• Results
• Users / roles
• Audit log
• Documents / attachments
• Approvals / signatures

Key principle: keep the sample record separate from the event log so you can preserve a complete history.

6) Use workflows and status gates

A sample should move through controlled states, for example:

• Collected
• In transit
• Received
• Logged in
• In analysis
• QA review
• Approved
• Reported
• Archived

Only allow status transitions that make sense, and record each transition with timestamp + user.

7) Define sample rejection and exception handling

Your system should handle:

• Broken containers
• Missing labels
• Incorrect temperature on receipt
• Late arrival past holding time
• Incomplete CoC

Log:

• Rejection reason
• Who rejected it
• Timestamp
• Whether the sample was tested anyway and under what deviation approval

8) Build in compliance and security controls

Important controls:

• Unique user accounts only
• Strong passwords / MFA if possible
• Least-privilege access
• Immutable audit logs
• Regular backups
• Data retention policy
• Disaster recovery testing
• Validation of the system if required by your QA program

9) Validate the system

Before using it operationally:

• Write user requirements
• Test each workflow
• Verify timestamps, audit trail, permissions, signatures, barcode scanning, and report generation
• Confirm records cannot be altered without trace
• Document validation results

10) Train staff and standardize SOPs

A good system fails if users don’t follow process. Create SOPs for:

• Sample collection and labeling
• Custody transfer
• Sample login
• Result review and approval
• Error correction
• Record retention

Train everyone involved and audit compliance regularly.

---

Practical implementation approach

If you’re building rather than buying:

Minimum viable system

• Web app + relational database
• Barcode labels/scanners
• User login with roles
• Event log table with immutable writes
• Time sync
• Electronic approval/signature module
• PDF CoC and report generation

Good tech choices

• Database: PostgreSQL or SQL Server
• Backend: .NET, Java, Python/Django, or Node.js
• Audit log: append-only event table
• Auth: SSO/OAuth + MFA
• Time: server-side timestamps only
• Docs: PDF storage in controlled object storage

---

A simple rule of thumb

If it matters for custody, quality, or compliance, it should be:

• captured automatically
• time-stamped by the system
• linked to a user
• protected from silent editing
• recoverable in an audit

If you want, I can also help you with:

1. a sample LIMS workflow diagram,
2. a database schema for chain of custody, or
3. a vendor evaluation checklist for buying a LIMS.