Protocol deviations, the line between minor and major, and why hiding one is always worse than having one. Written for coordinators, and for anyone who assumes deviations are rare.

In this file:

·        Why a visit 2 days late is a regulatory event

·        Where the rule actually lives, and why FDA never defined the word

·        Minor, major, and who made those words up

·        What a pattern of deviations tells a sponsor

The hurricane warning went up on a Wednesday. Walter's week 8 visit was scheduled for Friday, the county closed the bridges Thursday night, and by the time the roads reopened his visit window had closed with him on the wrong side of it.

Nani filed the deviation the same day. Not the following week when the paperwork caught up, and not at the monitoring visit when Mira would have found it anyway. The same day, with the reason written in plain language, because a deviation with an explanation attached on the day it happened is an event, and the same deviation found 5 weeks later by somebody else is a finding.

A protocol deviation is any departure from what the protocol says will happen. A visit outside its window. A lab drawn in the wrong tube. A dose given at the wrong time. A questionnaire administered in the wrong order.

Here’s the part that surprises people, and it’s worth saying early because it explains a lot of the confusion in this area. FDA never defined the term. Its own draft guidance says so directly: "FDA regulations do not include a definition of the term protocol deviation or provide a system for classifying the various types of deviations."

The definitions everyone uses come from ICH E3, the guideline on how to structure a clinical study report, and they were picked up by FDA in a draft guidance issued in December 2024, which is still a draft. A protocol deviation is "any change, divergence, or departure from the study design or procedures defined in the protocol." An important protocol deviation is "a subset of protocol deviations that might significantly affect the completeness, accuracy, and/or reliability of the study data or that might significantly affect a subject's rights, safety, or well-being."

Read those twice, because the second one is the whole job. Not every deviation matters equally. The word doing the work is significantly, and deciding what meets it is judgment, not arithmetic.

If the FDA never defined the word, what exactly is being broken when a visit runs late?

The obligation, not the definition. Under 21 CFR 312.60, an investigator is responsible for ensuring that an investigation is conducted according to the signed investigator statement, the investigational plan, and applicable regulations. The investigational plan is the protocol. Conducting the study as written is the commitment made when the investigator signed the 1572.

Then 21 CFR 312.66 adds the reporting side. The investigator has to promptly report to the IRB all changes in the research activity and all unanticipated problems involving risk to human subjects, and cannot make changes in the research without IRB approval, "except where necessary to eliminate apparent immediate hazards to human subjects." The IRB side of the same rule sits at 21 CFR 56.108(a)(3) and (4).

ICH GCP says the same thing from the other direction. In E6(R3), section 2.5 is called Compliance with Protocol. The investigator should comply with the protocol. The investigator should document all protocol deviations, and for those deemed important, should explain the deviation and implement measures to prevent recurrence where applicable. The investigator should deviate only where necessary to eliminate an immediate hazard to participants, and where that happens, should inform the sponsor promptly and report it to the IRB.

That exception is the one to memorize. You may break the protocol to protect a participant from immediate harm, without asking anyone first. You then tell everybody, quickly. It is the only place in this system where doing the thing first and reporting after is the correct order.

Ask 3 sites what makes a deviation major and you will get 3 answers, and none of them will be a citation.

That is not sloppiness. There is no regulatory taxonomy. The FDA does not define minor, major or critical, and the classification you use is your sponsor's and your site's, built on top of the ICH E3 idea of an important deviation. Your SOP will have a table. That table is a house rule, not a law, and the smartest thing a new coordinator can do is read it early, because you will be classifying things against it for years.

What tends to land on the important side, across most systems:

·        Enrolling someone who did not meet eligibility criteria

·        Dosing errors, wrong drug, wrong dose, wrong route

·        A missed safety assessment, particularly one tied to a stopping rule

·        Consent problems, including using a superseded version of the form

·        Anything that makes a primary endpoint uninterpretable for that participant

What tends to land on the other side: a visit a few days outside a window with no assessment lost, a questionnaire completed in the wrong order, a noncritical lab drawn late. Real, logged, explained, and not the same species of problem.

Walter's hurricane visit is the second kind, and it still gets filed.

Every year FDA publishes what its Bioresearch Monitoring inspections most commonly cite at clinical investigator sites. In the most recent published set, fiscal year 2024, failure to follow the investigational plan sits among the short list of common observations, alongside inadequate case histories and problems with the 1572. FDA does not publish percentages for that list, so treat it as a ranking of themes rather than a scoreboard.

What the warning letters show is more useful than a number anyway, because they show the shape of the failure. Two from 2025, both citing the same regulation:

In a letter dated 28 April 2025, FDA wrote to an investigator: "You failed to ensure that the investigation was conducted according to the investigational plan," citing enrollment of subjects who did not meet eligibility criteria.

In a letter dated 26 June 2025, the same operative sentence appears again, and the findings included an investigational product administered at more than double the intended dose after a kilograms and pounds error, plus enrollment of ineligible subjects.

Notice what is not in either letter. Neither one is about a late visit. They are about eligibility and dosing, the deviations that change what the data mean and what happens to a person. And in both cases the citation is 21 CFR 312.60, the obligation to run the study as written, not some separate deviation rule.

Note to File. The deviation is not the problem. The deviation without a written reason is the problem. A logged deviation with a same day explanation is a documented event that a monitor reads, closes and moves past. The same deviation found by a monitor 5 weeks later, with no note, is now 2 findings: the deviation, and the failure to document it. You cannot go back and pretend you never knew. You can only be the person who wrote it down first.

The same day habit isn't paperwork for its own sake. Many of the rules behind it were written after a study went wrong without them, and our Version History page tells those stories.

One deviation is a fact about a day. Twenty are a fact about a site.

Sponsors and monitors read deviation logs sideways, looking for repetition rather than severity. Six visits outside their windows in one quarter is not 6 unlucky weeks, it’s a scheduling process that does not work, or a visit schedule nobody can actually deliver in a real clinic. Repeated eligibility deviations point at screening. Repeated consent version errors point at document control.

That’s also why the good sites file the small ones. A log full of minor, explained deviations gives a monitor something to read a trend in, and a trend that gets caught in month 4 is a conversation. A clean looking log that turns out to be incomplete is something else entirely, and it changes how everything else at that site gets read.

One more piece of plumbing, because new coordinators often get this backwards. A site does not report deviations to FDA. The investigator reports to the sponsor, and reports important ones to the IRB. The sponsor summarizes deviations in the clinical study report that eventually reaches FDA. FDA sees your deviation log when it inspects you, and by then the log is either an argument in your favor or the exhibit.

A protocol deviation is any departure from what the protocol says will happen, and it is far more common than people outside research assume. FDA has never defined the term or set out minor and major categories; those come from ICH E3 and from your own sponsor's SOP, and the only category with any real definition behind it is the important deviation, meaning one that could significantly affect the data or a participant's rights, safety or wellbeing. The binding obligation is 21 CFR 312.60, which requires the investigator to conduct the study according to the investigational plan, with 312.66 and 21 CFR 56.108 governing what gets reported to the IRB. You may deviate without prior approval only to eliminate an immediate hazard to a participant, and then you tell everyone promptly. Walter's visit missed its window because a bridge closed. Nani wrote down why, on the day, and that is the entire difference between an event and a finding.

Reply to this email or leave a comment on the newsletter: which deviation does your site always argue about classifying? The one that turns into a debate every time it happens. Every query gets read, and the best ones get answered in a future issue.

Know someone training for their first coordinator job, or thinking about one? Send them this issue with your own referral link below, so the share counts. The Open Site File is written for exactly that person.

The Open Site File is one part of Root to Rx, and we all work toward the same thing: making clinical research easier to understand and harder to misrepresent. Monday, The Root Room shows a real health claim trying to work on someone. Wednesday, Plain Talk takes one topic from the news apart in plain language, with the receipts. Sunday, The Roots, on LinkedIn, is a letter for the people whose family treats them as the medical desk. And twice a week, The Open Site File shows you the inside of the site, where the people who make trials run actually work. Different doors, one mission: more people who understand how medicine gets made, and fewer people misled about it.

· Previous issue: Issue 13, GCP has a version number

·        Next issue: Issue 15, clinical research careers for foreign trained doctors

·        For the people whose family treats them as the medical desk: The Roots, our weekly letter.

·        Helping a patient or family member look for a study? A walkthrough of the public trial registries.

·        Patient materials, including a medication and supplement log modeled on the conmed logs used in trials: shop.roottorx.com.

·        21 CFR 312.60, General responsibilities of investigators (eCFR)

·        21 CFR 312.66, Assurance of IRB review (eCFR)

·        21 CFR 56.108, IRB functions and operations (eCFR)

·        FDA, Protocol Deviations for Clinical Investigations of Drugs, Biological Products, and Devices. Draft guidance, December 2024, still draft

·        ICH E3, Structure and Content of Clinical Study Reports, and ICH E3 Questions and Answers (R1)

·        ICH E6(R3) Good Clinical Practice, section 2.5, Compliance with Protocol

·        FDA, BIMO Inspection Metrics, fiscal year 2024

·        FDA warning letter, 28 April 2025

·        FDA warning letter, 26 June 2025

•  •  •

The Open Site File is general education about how clinical research sites work. It is not regulatory, legal, or medical advice, and it is not tied to any specific study, sponsor, or employer. All names are invented. Always follow your own site's SOPs, your protocol, and your PI and QA team. Characters are composites.

Filed by Justin Yamashita, MSc., Open Label Media

Next in the file: Issue 15, the physicians who trained abroad and are rebuilding a career here.