Banking records privacy, in this article, means the privacy of the records a tissue bank creates when you store your own adipose tissue, not anything to do with a financial bank. Storing fat creates a paper trail: your identity, health screening answers, any test results, and storage logs. This post explains which records federal rules require, who may read them, and why HIPAA may or may not apply.
TLDR Federal rules under 21 CFR Part 1271 require a tissue bank to keep concurrent, accurate records for at least 10 years, and FDA may review and copy those records during an inspection. Whether HIPAA applies to a bank depends on whether it meets the covered entity or business associate definition, which you should ask about directly. Banking adipose tissue does not guarantee any future use, which depends on FDA regulatory status at that time.
Important Disclaimer: Save My Fat does not provide FDA-approved treatments or cures for any disease or condition. Banking adipose tissue today does not guarantee eligibility, access, or clinical benefit from any future therapy, clinical trial, or medical program. All content is for educational purposes only and does not constitute medical advice. Patients must consult their own licensed healthcare professionals regarding all medical decisions.
How to check whether a bank is legitimate is one of the questions readers bring to this site most often. A close second is a quieter worry: once the tissue is in storage, who can open the file that goes with it?
The honest answer has two parts. Federal tissue rules say a great deal about what a bank must record and how long it must keep it, and they give FDA a right to read it. HIPAA, the second part, turns on facts that only the bank can confirm.
What Records a Tissue Bank Must Keep
A tissue bank must keep a record of every step it performs, and those records must be concurrent, accurate, indelible, and legible, and must identify the person who did the work and the dates. That is the core of 21 CFR 1271.270, the records section of the federal rule for human cells, tissues, and cellular and tissue-based products, known as HCT/Ps.
Records may be electronic, paper, or true copies, with electronic records backed up. Retention is 10 years after a record is created, and longer for records tied to a specific HCT/P: “at least 10 years after the date of its administration, or if the date of administration is not known, then at least 10 years after the date of the HCT/Ps distribution, disposition, or expiration, whichever is latest.”
Section 1271.270 has no confidentiality clause of its own. If the bank uses contractors, their names and responsibilities must be available during an FDA inspection. Ask how the chain of custody is documented and which outside companies appear in it.
Banking Records Privacy: Who Is Allowed to See Your File
Under the federal rule, the party with a clear, written right to read a tissue bank’s records is FDA. Section 1271.400 lets the agency inspect any manufacturing location at any reasonable time, with or without prior notice, and review and copy any records required under Part 1271. Inspection frequency is at the agency’s discretion.
The rule also limits how much identity travels with the tissue. Under 1271.290, every HCT/P carries a distinct identification code, alphanumeric for example, that relates it to the donor and to all records about it. That code may not include a name, social security number, or medical record number, except as section 1271.55 allows. Where a donor eligibility determination is made, section 1271.55 adds that accompanying records “must not contain the donor’s name or other personal information that might identify the donor.”
Under 1271.90, a bank is not required to make a donor eligibility determination, or to screen or test the donor, for tissue intended for autologous use, meaning tissue that goes back into the person it came from. Section 1271.55 also excepts autologous donations from its limit on codes that carry a name or medical record number. So do not assume the anonymity rules for donated tissue apply to your own banked fat. Ask the bank what its code contains.
Does HIPAA Apply to a Tissue Bank
HIPAA applies to a tissue bank only if the bank is a covered entity or a business associate of one, and the federal tissue rule does not say whether a bank is either. According to HHS covered entities guidance, covered entities are health plans, clearinghouses, and providers, and providers count “only if they transmit any information in an electronic form in connection with a transaction for which HHS has adopted a standard.” HHS is direct about the consequence: “If an entity does not meet the definition of a covered entity or business associate, it does not have to comply with the HIPAA Rules.”
The business associate definition sits in 45 CFR 160.103. It covers a person who, on behalf of a covered entity, “creates, receives, maintains, or transmits protected health information for a function or activity regulated by this subchapter.” The HHS page does not mention tissue banks at all.
This article does not assert that any bank, laboratory, or connector is or is not covered by HIPAA. The question to ask is specific: do you conduct standard electronic health care transactions, and if not, what privacy rule or contract term governs my records instead?
What Your Physician’s Office Holds Versus What the Bank Holds
Your physician’s office and the tissue bank hold different pieces of your record, and different rules can govern each piece. The bank keeps the records that Part 1271 requires, while your clinical chart sits with the practice. Ask each party, including Save My Fat as the connector, what it receives; nothing here describes any party’s actual data practice.
The table below sorts the common record types by who usually holds them and which rule speaks to each. It is a map for your questions, not a statement about any practice or bank. Read it alongside what consent covers, since the consent form is where most of these records begin.
| Record type | Who usually holds it | Which rule speaks to it |
|---|---|---|
| Procedure note and clinical chart | Your physician’s office | HIPAA, if the practice is a covered entity under the HHS definition |
| Storage agreement and consent form | You and the bank | The agreement itself; ask what it says about access and sharing |
| Screening answers and any test results | The bank, if any were performed | 21 CFR 1271.270 for retention; 1271.90 makes screening optional for autologous use |
| Identification code and container labels | Travels with the tissue | 21 CFR 1271.290 and 1271.55 |
| Storage logs | The bank | 21 CFR 1271.270 |
| Inspection copies | FDA | 21 CFR 1271.400 |
A question about your chart goes to the practice, and a question about a storage log goes to the bank. For where the practice fits in the sequence, see how your physician’s role is described on this site.
What to Ask a Bank About Banking Records Privacy
Ask for the privacy notice, who has access, how you would be told of a breach, whether records are shared with the connector, and what happens to records after your agreement ends. Get the answers in writing.
Start with the privacy notice, and read the privacy policy of every company in the chain, including this one, before you send any health information. Then ask who inside the bank can open your file and which contractors appear in it.
Ask what a breach notice would say and where that promise is written. Ask whether the bank shares your records with Save My Fat as the connector, and which fields. Finally, the 10 year rule means records persist after tissue is released or discarded, so ask what the bank does with the identifying parts.
Frequently Asked Questions
Can FDA see my name in a tissue bank’s records?
FDA can review and copy any record a bank must keep under Part 1271. Section 1271.55 keeps the donor’s name out of accompanying records where a donor eligibility determination is made, but autologous donations are excepted from its code limit. Ask the bank which identifying details sit in its file.
Does a tissue bank have to keep my records after I stop storing?
Yes. Section 1271.270 requires retention for 10 years after a record is created, and for records tied to a specific HCT/P, at least 10 years after administration, distribution, disposition, or expiration, whichever is latest.
Is Save My Fat or its laboratory partner covered by HIPAA?
This article does not state whether Save My Fat, its laboratory partner, or any bank is a HIPAA covered entity or business associate. Under the HHS definitions, the answer depends on whether an entity conducts standard electronic transactions or acts on behalf of a covered entity. Ask each party directly.
What identifying information is on the container?
The container carries a distinct identification code under 1271.290, and tissue stored for autologous use must be prominently labeled “FOR AUTOLOGOUS USE ONLY” under 1271.90. It must also read “NOT EVALUATED FOR INFECTIOUS SUBSTANCES” unless all applicable screening and testing was done. Whether the code includes your name is a question for the bank.
Key Takeaways
Banking records privacy rests on two separate sets of rules. Part 1271 tells a tissue bank what to record, requires retention for at least 10 years, and gives FDA the right to inspect and copy the file with or without notice. HIPAA applies only to covered entities and business associates, and the HHS definitions do not mention tissue banks, so whether a bank is covered is a question you must ask. Banking preserves tissue for potential future use and guarantees nothing about that use, which depends on FDA status at that time.
Save My Fat connects patients and providers with a U.S.-based tissue bank. It is not a tissue bank, a laboratory, a medical practice, or a treatment provider. Stem cell and regenerative medicine regulations vary by state, including specific informed-consent and disclosure requirements in Florida, Utah, California, Georgia, and Tennessee governing tissue and stem cell services. Banking adipose tissue does not connect patients to any treatment pathway, and any future use depends on FDA regulatory status, physician guidance, and the availability of approved or investigational pathways at that time.
Readers weighing adipose tissue banking for potential future use can review the pricing page or raise a records question through the contact page.
Save My Fat works with a U.S.-based tissue bank for laboratory processing and storage.
This article is for educational purposes only and does not constitute medical or legal advice. Please consult your own licensed healthcare provider before making any decisions about treatment or research participation.
About the author: Oscar Tellez is the founder and CEO of Save My Fat. He holds a Bachelor of Science in Exercise Science and Health Promotion from Florida Atlantic University. He has spent a decade in the regenerative medicine industry across product distribution, laboratory and vendor relationships, and provider training. He is not a licensed clinician, and this article is educational, not medical advice.
Related guide: FDA adipose tissue regulation.
