The same surgical procedure story is no longer the plan. That is the starting fact. The clinic still has patients, a brand, and a calendar. Someone is shopping a “registered pathway,” an IND, or a 351-adjacent build. Capital is about to move. Ops gets one job before that check clears: make the file honest enough that counsel can work and a family office can price risk.
I am not an attorney. I am a Dallas healthcare operations and regulatory operator, retained through counsel as an expert witness and working as a senior paralegal. This Letter is operator framing for physicians, clinic operators, family-office diligence teams, and counsel. It is not legal advice. It does not tell you which pathway fits your product. It tells you what I pressure-test first when the exception story has collapsed and the next pitch sounds like compliance.
## Why family-office diligence differs from clinic shopping
A clinic shopping a supplier asks whether the vial works for tomorrow’s schedule. A family office deploying capital asks whether the entity, the pathway, the manufacturing map, and the data rights survive a hard afternoon with counsel. Those are different questions. The second set is the one that should control the wire.
Family-office diligence still starts with classification. It then adds ownership, exit, and evidence transfer. If you cannot name who owns the IND, who owns the batch records, and who can export the clinical data after a change of control, you are not buying a product company. You are buying a story with a lease.
## The exception is a narrow door, not a business model
Under 21 CFR 1271.15(b), an establishment is not required to comply with Part 1271 if it removes HCT/Ps from an individual and implants those HCT/Ps into the same individual during the same surgical procedure. FDA’s November 2017 guidance on that exception makes the scope concrete. Autologous use. Same surgical procedure. The product remains “such HCT/Ps.” As a general matter, processing beyond rinsing, cleansing, sizing, or shaping pushes the establishment out of the exception. Shipping to another site for implantation generally does the same, because distribution is manufacturing under the tissue rules.
When that door closes, the next question is not marketing copy. It is classification. HCT/Ps that meet all criteria in 21 CFR 1271.10(a) are regulated solely under section 361 of the Public Health Service Act and Part 1271. If the product does not meet those criteria and no exception in 1271.15 applies, 21 CFR 1271.20 points you to drug, device, and/or biological product regulation under the FD&C Act and/or section 351 of the PHS Act. That is the fork. Ops must name which fork the seller claims, then test whether the file supports the claim.
Exosome products sit in a different public posture. FDA’s December 6, 2019 Public Safety Notification on Exosome Products states there are currently no FDA-approved exosome products, and that as a general matter exosomes used to treat diseases and conditions in humans are regulated as drugs and biological products subject to premarket review and approval. An HCT/P registration screenshot does not convert that into a commercial green light. An IND number on a slide does not equal an approved BLA. Ops treats those as different instruments.
## What “registered” usually means in a pitch deck
Sellers use “registered” as a comfort word. Ops treats it as a file request.
Tissue establishment registration and listing under Part 1271 Subpart B is for HCT/P manufacturing under the 361 framework. FDA’s tissue establishment registration page is clear that establishments manufacturing HCT/Ps regulated solely under section 361 must register and list, update annually in December, and use the electronic system unless waived. Establishments manufacturing HCT/Ps regulated as drugs, devices, and/or biological products register and list under Part 207 or 807, as applicable, not under Part 1271. FDA also states it does not require registration and listing under those drug or device rules for IND- or IDE-subject HCT/Ps until marketing authorization.
So when a deck says “FDA registered,” I ask: registered as what, under which part, for which product codes, at which FEI, for which manufacturing steps? I ask for the current listing print, the annual update history, and any correspondence that changed the listing. I ask whether the product on the invoice matches the product on the list. Mismatch is not a typo. It is a diligence flag.
A registration does not prove homologous use. It does not prove minimal manipulation. It does not prove the product is safe, pure, and potent under a BLA. It does not replace an IND that is in effect for a clinical investigation under 21 CFR Part 312. Ops says that out loud in the diligence memo so counsel does not have to guess what the seller meant.
## The IND is not a marketing license
Clinical investigation of a product regulated as a drug or biologic generally requires an IND under 21 CFR Part 312. The IND package is not a brochure. Under 21 CFR 312.23, the sponsor submits an investigational plan, protocols, investigator information, CMC information, labeling, and pharmacology and toxicology information adequate to support that it is reasonably safe to conduct the proposed investigations. Phase-appropriate CMC must support identity, quality, purity, and strength. Human subjects protections under 21 CFR Parts 50 and 56 sit alongside that package. An IRB stamp without an IND in effect is not a complete story for a product that needs an IND.
For commercial marketing of a biological product under section 351 of the PHS Act, a valid biologics license must be in effect. Development-stage clinical distribution is a different legal posture from selling an approved product. Ops pressure-tests whether the seller is selling study enrollment, selling product, or selling both with the same invoice. Patient-funded “trials” that look like cash-pay treatment get special scrutiny. Counsel needs the sponsor identity, the IND acknowledgment communication, the protocol version in force, the investigator list, and the stop rules. Ops needs the chain of custody for every lot that touched a patient.
I do not bless pathway selection. I document what the paper actually shows.
## Diligence before the check clears: the first five pressure tests
**1. Product identity that survives a document pull.**
Ask for the exact product name used on labels, invoices, CoAs, consent forms, and websites. Ask for composition: cells, secretome, exosome fraction, scaffold, vehicle, cryoprotectant. Ask for starting material: autologous, allogeneic, birth tissue, adipose, bone marrow, peripheral blood. Ask for intended use language in the seller’s own documents. If the website says “treats” and the CoA says “for research use only,” the file is already in conflict. Resolve the conflict before wire instructions circulate.
**2. Manufacturing map, not a logo.**
Who recovers? Who processes? Who tests? Who stores? Who labels? Who ships? Who implants? Draw the map with legal entities, addresses, and FEIs. Cross-check lease, equipment ownership, and quality agreements. A “partner lab” with no quality agreement is not a partner. It is an open liability. If processing includes enzymatic digestion, expansion, isolation of extracellular vesicles, pooling, or culture, document it. Those facts matter to classification and to CMC. Do not let a marketing term erase a process step.
**3. Quality system that produces records, not posters.**
Ask for SOPs that govern recovery, processing, environmental monitoring, deviation handling, complaint handling, and distribution. Ask for batch records for the last three lots. Ask for CoAs with methods, specs, and results. Ask for stability data that matches the labeled storage claim. Ask for sterility, endotoxin, and identity methods that match the route of administration. If the product is injectable, missing sterility and endotoxin story is not a paperwork preference. It is a patient-risk story. If the seller cannot produce a controlled document list, the quality system is a claim, not a system.
**4. Regulatory correspondence that exists outside the slide deck.**
Ask for FDA registration and listing extracts. Ask for any Form FDA 483, untitled letter, warning letter, or meeting minutes related to the product or establishment. Ask for IND acknowledgment communications and amendment history if an IND is claimed. Ask for ClinicalTrials.gov NCT numbers that match the protocol title and sponsor. Verify the NCT on ClinicalTrials.gov yourself. Do not invent citations. If you cannot verify a claimed letter or IND number, mark it [TBD: seller / counsel to produce] and stop treating it as fact.
**5. Money path versus clinical path.**
Map how patients pay. Map how study subjects are recruited. Map how physicians are paid. If the same lot is sold as cash-pay therapy and also listed as investigational product, counsel needs that fact early. Ops records the dates, the consent forms, and the invoice language. Investors need to know whether revenue depends on a posture that the regulatory file does not support.
## File hygiene: what “clean” actually looks like
File hygiene is not a shared drive with 40 PDFs named Final_v7. It is a controlled archive that can answer questions under time pressure.
Create a diligence binder with fixed folders: corporate, facilities, quality, CMC, clinical, regulatory correspondence, commercial claims, adverse events, contracts. Version every SOP. Keep superseded versions. Preserve email threads that changed process. Preserve CoA templates and raw data where available. Preserve training records for critical steps. Preserve environmental monitoring summaries for cleanrooms if aseptic processing is claimed.
Name files so a stranger can find them. “IND_ack_2024-06-12.pdf” beats “scan003.pdf.” “CoA_Lot_A17_2025-03.pdf” beats “lab results.” If the seller refuses to produce native files and only sends screenshots, note that. Screenshots without metadata are weak evidence.
Chain of custody matters for cells and for documents. Who had write access to the eQMS? Who could alter batch records? Who owns the cloud tenant? If the founder’s personal Google Drive is the quality system, say so. Counsel cannot fix ownership after a dispute if ops never named the owner.
## Who owns the data
This is where deals die quietly.
Patient records, batch records, assay raw data, image files, adverse event files, and IND modules are assets. They are also obligations. Ask who is the sponsor of record. Ask who is the manufacturer of record. Ask who is the covered entity or business associate for PHI. Ask whether the clinic, the lab, or the holding company holds the IND. Ask whether a change of control triggers FDA notifications or quality agreement amendments. Ask whether investigators can export their own data if the relationship ends.
For family offices, data ownership is valuation. A clinic with patient outcomes but no transferable CMC package bought a practice, not a product company. A lab with CMC but no rights to clinical data bought a manufacturing story without an efficacy story. For counsel, data ownership is the discovery map. Ops should deliver a one-page ownership matrix before LOI language hardens: data type, system of record, legal owner, custodian, access rights, retention period, transfer mechanism on exit.
If the seller says “we’ll figure out data later,” the check should wait.
## Capital questions that sit on top of the regulatory fork
Family-office operators add a second layer that clinic buyers often skip.
Ask whether the revenue model survives a claims pull-down. If disease claims must come off the website, what remains? Ask how much cash a CMC rebuild requires if the current process cannot support an IND or a BLA plan. Ask whether the IND sponsor is the entity receiving the capital. Ask whether key people can leave with the know-how and leave the buyer with empty folders. Ask for a red-flag memo that lists every document requested and refused.
Ask for a use-of-proceeds map that matches the pathway. Money for “marketing” when the file needs method validation is a mismatch. Money for “clinic expansion” when the product identity is still unresolved is a mismatch. Ops writes the mismatch list. Counsel decides what the mismatch means for the deal.
Ask whether insurance and indemnity language matches the product description. Carriers need current service descriptions. Ops marks [TBD: clinic risk manager] when that answer is missing.
## What counsel actually needs from ops
Counsel does not need your opinions about science theater. Counsel needs timed, sourced facts.
Deliver a chronology. First patient date. First lot date. Registration dates. IND submission and acknowledgment dates if any. Major process changes. Major claim changes on the website. Any FDA contact. Any serious adverse event. Keep the chronology to dates and documents. Leave legal conclusions to counsel.
Deliver a claims inventory. Screenshot and URL with date. Match each claim to the regulatory posture the seller asserts. Flag mismatches. Do not rewrite the website for them during diligence. Document it.
Deliver a gap list ranked by patient risk and deal risk. Missing sterility method sits above missing brand guidelines. Missing IND acknowledgment for a claimed clinical investigation sits above missing LinkedIn hygiene. Missing quality agreement with the processing lab sits above missing pitch-deck polish.
Deliver a witness and custodian list. Who can speak to recovery, processing, release, and clinical use? Who controls the passwords? Who signed the CoAs? Ops that hides custodians creates later cost for everyone.
I write these packages for counsel to use. I do not give legal advice to the clinic. If you are the operator inside the clinic, your job is the same: give counsel a file that can survive a hard afternoon.
## Pathway shopping without self-deception
After the exception story fails, clinics often shop three narratives: stay in a 361-looking lane with registration and listing, enter clinical development under an IND, or build toward a 351 BLA. Each narrative has different cost, timeline, and evidence burden. Ops should refuse to merge them in one sentence.
A 361 posture depends on meeting 1271.10(a) criteria or a valid exception. Registration is maintenance, not proof of criteria. An IND posture is investigation under Part 312 with IRB oversight and CMC that matches the protocol. A BLA-adjacent plan is industrial: consistent manufacturing, validated controls, clinical evidence aimed at safety, purity, and potency for licensure. Calling an IND a “BLA pathway” in a patient brochure is a claims problem. Calling a registration an “approval” is worse.
Exosome and secretome pitches deserve blunt treatment. FDA’s public safety notification is not ambiguous on the general regulatory category for disease-treatment claims. Diligence should assume premarket expectations unless counsel and the regulatory file say otherwise with documents you can verify. Mark unverified seller claims [TBD: regulatory counsel / seller]. Do not launder them into footnotes.
## Investor, physician, and operator reads of the same file
Physicians should ask what happens to the patient if the lot fails release testing after the procedure is booked. They should ask who reports adverse events and to whom. They should ask whether their own medical judgment is being used as a regulatory shield for a manufacturing operation they do not control.
Family-office diligence teams should ask what revenue remains if disease claims must come down. They should ask how much cash the CMC rebuild requires. They should ask whether the IND sponsor is the entity they are buying. They should ask for a red-flag memo that lists every document requested and refused.
Clinic operators should ask whether their consent forms still match the product. They should ask whether their malpractice carrier has the current description of services. They should ask whether staff training matches the SOP version in force. They should stop procedures that the quality system cannot release.
Counsel should ask ops for the ownership matrix, the chronology, the claims inventory, and the custodians. That is the useful package. Theory without those four items burns hours.
## Operator checklist: family-office diligence before the wire
1. Obtain the exact product identity string used on label, CoA, invoice, consent, and website. Force one reconciled name or document the conflicts.
2. Pull current FDA registration and listing evidence. Record the regulatory part claimed (1271 vs 207/807), FEI, product list, and last annual update. Mark gaps [TBD: seller].
3. Name the claimed pathway in one sentence: 361 under 1271.10(a), exception under 1271.15, IND under Part 312, or BLA under section 351. Refuse blended slogans.
4. Map every manufacturing and clinical step to a legal entity, address, and responsible person. Attach quality agreements or note their absence.
5. Collect the last three complete batch records and CoAs. Verify methods for identity, sterility, endotoxin, and potency or functional claims match the labeled use.
6. If an IND is claimed, obtain the IND number, acknowledgment communication, sponsor name, protocol version, investigator list, and IRB approvals. Verify any NCT on ClinicalTrials.gov.
7. If a BLA or “approval” is claimed, obtain the license evidence or mark the claim unsupported. Do not treat IND effective status as licensure.
8. Inventory public claims with dated URLs and screenshots. Align each claim to the asserted pathway. Flag disease-treatment language for counsel.
9. Build the data ownership matrix: clinical, CMC, quality, and commercial data. Name owner, custodian, system, and exit transfer path.
10. Compile FDA and state correspondence history. Include 483s, untitled letters, warning letters, and meeting minutes if they exist. Note refusals to produce.
11. Chronology of first use, process changes, and claim changes. Dates and document IDs only.
12. Adverse event and complaint log with follow-up status. Confirm who reports to FDA and how.
13. Money path: patient payment terms, study stipends, physician compensation, and distributor margins tied to the same lots.
14. Use-of-proceeds map matched to pathway gaps (CMC, validation, quality systems) rather than brand spend alone.
15. Insurance notices: confirm carriers have current service descriptions. Mark [TBD: clinic risk manager] if unknown.
16. Stop-ship and recall SOP test: ask the seller to walk a mock recall for the last shipped lot. Record whether lot genealogy exists.
17. Change-of-control checklist: which agreements, IND sponsorship, quality agreements, and cloud tenants transfer, and which do not.
18. Deliver counsel the four-pack: chronology, claims inventory, ownership matrix, custodian list. Do not wire until counsel confirms the package is sufficient for their risk call.
## Closing
When the same surgical procedure story is gone, the clinic is not choosing a slogan. It is choosing a regulatory posture with manufacturing, clinical, and commercial consequences. Registration, IND, and BLA are not interchangeable stickers. Family-office diligence pressure-tests product identity, manufacturing map, quality records, correspondence, money path, and data ownership before the check clears. Ops names who owns the data. Ops gives counsel facts with dates and documents.
That work is not glamorous. It is how you keep patients safer and keep capital from buying a story that the file cannot carry.
- Andrew Jonathan Hillman
Dallas. Healthcare operations and regulatory operator. Expert witness retained through counsel. Senior paralegal. Not an attorney. This Letter is not legal advice.
---
*The Hillman Letter. For physicians, investors, clinic operators, and counsel.*
