Protocol Deviation Guide

Protocol Deviation: Any non-compliance with the Central Institutional Review Board (CIRB)-approved protocol. Deviations may be incurred by study participants, protocol team members, investigators, sub-investigators, coordinators, physicians, nurses, counselors, data managers, pharmacists, laboratory staff or other supervisory, oversight, or support staff. Protocol deviations may or may not render a participant ineligible to participate in a study.

Significant or Serious Protocol Deviation: A protocol deviation which increases potential risk to participants or affects the integrity of study data. An isolated deviation may not be significant by itself but significance may increase with numerous deviations of the same nature.

Mitigation Strategy: Depending on the severity or frequency of one or more protocol deviations, the site may be expected to define a mitigation strategy (sometimes referred to as a Corrective and Preventive Actions (CAPA). This strategy is broken into two parts:

• Corrective action (CA), which is the action taken to address the deviation. Examples of corrective actions include (but are not limited to): notifying the affected participant(s) and protocol team; re-consenting the participant(s); completing missed procedures; repeating laboratory tests; completing additional participant monitoring or management procedures; and/or destroying specimens collected in error.
• Preventive action (PA), which is the action taken in attempt to prevent recurrence of the product or quality problem moving forward. Examples of preventive actions include (but are not limited to): discussion of the deviation with relevant study staff, refresher training of study staff; review and/or revision of Standard Operating Procedures (SOPs) or other study implementation materials; development of new study implementation materials; implementation of additional communication, Quality Control (QC)/ Quality Assurance (QA), or oversight/supervisory procedures; changes in day-to-day workflow; and/or changes in general participant management or laboratory procedures.

Cancer Trials Support Unit (CTSU): The CTSU is a service of the National Cancer Institute (NCI) designed to facilitate access to NCI-funded clinical trials for qualified clinical sites and to support the management and conduct of those clinical trials.

A standard Protocol Deviation Form was developed by CTSU to standardize reporting of protocol deviations across CTEP-supported and/or –sponsored protocols. This form is available at the protocol participant level in Rave; all protocol deviations for a specific participant on a specific protocol are captured in a single form.

Before releasing the Protocol Deviation Form for all CTEP-supported and/or – sponsored protocols, CTEP decided to pilot the form on a small number of protocols to ensure the form captures the correct data and to give stakeholders the opportunity to provide feedback. The scope of the pilot is one protocol per participating Lead Protocol Organization (LPO). Feedback from LPOs and sites participating in the pilot may result in revisions to the Protocol Deviation Form or process for future protocols. This guide will be updated after the pilot to reflect revisions.

There are three primary sets of individuals that could discover protocol deviations.

1. Clinical site staff;
2. Auditors and Central Monitors; and
3. Network partners (e.g., Operations Center, Data Monitoring Committee (DMC))

When clinical site staff discover a protocol deviation, it must be reported by a Site Investigator (or designee) using the Protocol Deviation Form in Rave within ten working days of site awareness, unless a shorter timeframe is specified in the protocol.

When Auditors and Central Monitors discover a protocol deviation, it will be documented in the Clinical Trials Monitoring Board (CTMB)-Audit Information System (AIS) application as audit findings and communicated to the Site Investigator. Deviations identified in this manner must be reported by the Site Investigator or designee in the Protocol Deviation Form in Rave.

When Network partners discover a protocol deviation, it will be communicated directly to the Site Investigator within ten working days of awareness. Deviations identified in this manner must be reported by the Site Investigator or designee in the Protocol Deviation Form in Rave.

Regardless of which party discovers the deviation, reporting should be completed by the Site Investigator (or designee) according to the steps outlined in Entering a Protocol Deviation. Staff assigned the Rave CRA role in a site's Delegation of Task Log (DTL) will have the ability to enter and update Protocol Deviations on behalf of the Site Investigator for patients at that site.

The flowchart below defines the entry and review process for a protocol deviation in the Protocol Deviation Form. Note the relevant LPO Operations Center will review all deviations entered by a Site Investigator (or designee) for the pilot protocols. If the LPO has any questions about a deviation, LPO representatives may consult with the protocol Principal Investigator (PI). LPO reviewers ultimately determine if information provided by site staff for a deviation constitute a deviation and indicate their decision as the Deviation Review Status.

If revisions on an entered deviation are needed, the Protocol Deviation Form record should be updated accordingly by the Site Investigator (or designee), which will necessitate re-review by the LPO.

All protocol deviations should be reported by the Site Investigator or designee using the Protocol Deviation Form in Rave. Designees should be assigned the role of Rave CRA in the site DTL. Please note this includes deviations identified by site personnel and deviations communicated to the site by central monitors, auditors, or Network partners.

Protocol Deviation Form entries are not shared with the local Institutional Review Board (IRB) or CIRB. Site staff should continue to follow existing processes to communicate deviations to these regulatory boards.

There are two categories of protocol deviations which need to be documented:

1. Deviations involving a single participant; and
2. Deviations involving multiple participants.

The Protocol Deviation Form in Rave has been implemented at the participant level. For deviations involving multiple participants, documentation of the deviation in the Rave form will require repeating entry for each participant involved. CTSU is working to develop an application which can support streamlined entry of protocol deviations involving large numbers of participants. This guide will be updated with details for that application once it is available.

If a deviation does not involve any specific subject, please email ctuscontact@westat.com for additional instructions.

To document a protocol deviation, you should:

Step 1: Access the study on the Rave URL.

Step 2: Locate the participant for which the protocol deviation needs to be entered (recall that any deviation involving multiple participants will need to be entered separately for each participant).

Step 3: Click the Protocol Deviation Form link at top-left.

Figure 1: Protocol Deviation Form Link

Step 4: If this is the first protocol deviation you have ever entered for this subject, proceed directly to Step 5. If you have previously entered one or more protocol deviations for the participant, you will see a table with data for each entered deviation. Click the Add a New Log line link below the table to continue entry.

Figure 2: Add a New Log Line Link

Step 5: Complete fields according to the definitions and guidance in Table 1.

Step 6: After entering all relevant fields, click Save.

• If there are no queries resulting from entered responses, deviation entry is complete.
• If there are queries resulting from entered responses, proceed to Step 7.

Step 7: Any system-generated queries will be highlighted in the protocol deviation table. Click any field in the highlighted row to open the Protocol Deviation Form for the specific deviation. The entered deviation will not be reviewed by the LPO until all queries have been resolved.

Step 8: When all queries have been resolved, click Save.

• If there are no additional queries resulting from changes, deviation entry is complete.
• If there are additional queries resulting from changes, return to Step 7 and repeat resolution until no additional system-generated queries appear after clicking Save.

It is possible to update previously entered deviations in the Protocol Deviation Form. In some cases, LPOs may lock deviations, which prevents any update by site staff. If you need to update a locked deviation, please contact the relevant LPO or contact the CTSU Help Desk at ctsucontact@westat.com.

To update a deviation, you should:

Step 1: Navigate to the Protocol Deviation Form for the relevant subject.

Step 2: Click any field in the specific table row for the deviation to be updated.

Step 3: Click the Edit () icon for any field needing to be updated.

Step 4: Enter or select the new response. Repeat Steps 3 and 4 until all updates are complete.

Step 5: After all updates are complete, click Save.

• If there are no queries resulting from entered responses, deviation update is complete.
• If there are queries resulting from entered responses, proceed to Step 6.

Step 6: Any queries will be highlighted in the protocol deviation table. Click any field in the highlighted row to open the Protocol Deviation Form for the specific deviation. The updated deviation will not be reviewed by the LPO until all queries have been resolved.

Step 7: When all queries have been resolved, click Save.

• If there are no additional queries resulting from changes, deviation update is complete.
• If there are additional queries resulting from changes, return to Step 6 and repeat resolution until no additional queries appear after clicking Save.

Note: The LPO may create queries during their review of a protocol deviation. If the LPO creates any such queries, staff who entered the protocol deviation will be notified via the Rave Task Summary.

For LPO/group staff identified as Protocol Deviation reviewers, a Rave alert will be delivered as a query when:

1. A site has entered a protocol deviation for one of your group's protocols and the deviation is query-free; or
2. A site has updated a protocol deviation for one of your group's protocols and the deviation is query-free.

These queries will appear in the Rave Task Summary for staff with the role identified in the LPO-specified marking group.

Figure 3: Query in Task Summary

To review a deviation:

Step 1: Navigate to the subject for whom the deviation is ready for review. You can click on the subject ID within the Task Summary to go directly to the relevant subject.

Step 2: Click any value in the highlighted row of the deviations table. The highlighted row denotes the open query identifying the deviation for review.

Step 3: Review all entered values for the deviation.

Step 4: Indicate whether the deviation is critical using the Critical Deviation? field. Note this checkbox should be selected when the deviation increases potential risk to participants or affects the integrity of study data. Please follow any relevant LPO guidance regarding criteria for critical deviations. If you are not ready to make this determination, leave the field blank and use Pending as the Deviation Review Status (see Step 5, below).

Step 5: Enter a Deviation Review Status response consistent with your review:

• Use Pending if you need additional information before making a decision. This status should be used if you need to consult with another person at the LPO/group or initiate a query to the site. Proceed to Step 8.
• Use Deviation Confirmed by LPO to formally confirm the entered deviation. Proceed to Step 6.
• Use Not a Protocol Deviation to indicate the entered deviation is not a protocol deviation based on your review. Sites should not be instructed to inactivate any entered deviations, even those identified by LPO reviewers with this status. For this status, a comment is required. Enter a comment in the Rave query and proceed to Step 6.
• If you are reviewing an updated deviation for which a Deviation Review Status was entered during a previous review, proceed to the Notes on Reviewing Updated Deviations at the end of these instructions.

Step 6: Enter the role of the person who reviewed the deviation in the Who Reviewed the Deviation? field. In the event you consult with a second party, indicate the role of the person who ultimately made the decision reflected in the Deviation Review Status field.

Step 7: Enter the first and last name of the person who reviewed the deviation in the LPO Reviewer Name field. In the event you consult with a second party, indicate the name of the person who ultimately made the decision reflected in the Deviation Review Status field.

Step 8: Click Save.

• If there are no system-generated queries resulting from entered responses, deviation review is complete.
• If there are system-generated queries resulting from entered responses, proceed to Step 9.

Step 9: Locate and resolve specific queries according to provided guidance within Rave.

Step 10: When all queries have been resolved, click Save.

• If there are no additional system-generated queries resulting from changes, deviation review is complete.
• If there are additional system-generated queries resulting from changes, return to Step 9 and repeat resolution until no additional system-generated queries appear after clicking Save.

Notes on Reviewing Updated Deviations: It is possible that you may review updated protocol deviations for which a Deviation Review Status was entered based on a previous review.

• If review of the updated deviation changes the Deviation Review Status entry:
  • If the new status is Deviation Confirmed by LPO, update values for Who Reviewed the Deviation? and LPO Reviewer Name, as needed, then click Save.
  • If the new status is Not a Protocol Deviation, enter a comment in the Rave specify field, then update values for Who Reviewed the Deviation? and LPO Reviewer Name, as needed, then click Save.
• If review of the updated deviation does not change the Deviation Review Status entry, enter query response, click Save and open the logline to manually close the query, then update Who Reviewed the Deviation? and LPO Reviewer Name as needed, then click Save.

If a deviation was entered in error, use the Inactivate link under the deviation table in the Protocol Deviation Form. Entered deviations which are marked by the LPO as Not a Protocol Deviation should not be inactivated. Inactivation should only be completed for deviations entered in error (e.g. a deviation is entered on the wrong patient's RAVE form)?

To inactivate a deviation from the Protocol Deviation Form, you should:

Step 1: Click the Inactivate link.

Figure 4: Inactivate Link

Step 2: Select the number of the row in the first drop-down. This number is seen in the left-most column of the deviations table.

Figure 5: Inactivate Detail

Step 3: Click the Inactivate button. Use the Cancel button only if you decide you do not want to proceed with the inactivation.

• If there are other active deviations on the Protocol Deviation Form, you will see a strikethrough on all row values of the inactivated deviation. Inactivation is complete.
• If the inactivated deviation was the only active deviation on the Protocol Deviation Form, you will see an empty Protocol Deviation Form for entry. You do not need to enter any details in this form. Inactivation is complete.

Protocol deviations are organized according to category and term. A category is a broad area to which a deviation applies. A term is category-specific and helps group similar deviations across subjects and protocols.

Table 2 presents a hierarchy of categories and terms. Remember:

• Categories and terms may be shown across multiple pages of the drop-down response field. Where appropriate, use the Next and Back buttons to navigate between pages.
• A term is required for any deviation entered in the Protocol Deviation Form, even if the only available term is Not Applicable.

Protocol Deviation Form entries are not shared with the local IRB or CIRB. Site staff should continue to follow existing processes to communicate deviations to these regulatory boards.

The PI or designee must determine if the CIRB should be informed. Informing the CIRB is necessary for the following:

• Unanticipated Problems
• Serious or Continuing Noncompliance
• Suspected Research Misconduct

More information is available on the CIRB website using the Completing the Unanticipated Problem and/or the Noncompliance Reporting Worksheet.

Additional details on responsibilities for reporting these types of events can be found at: https://www.ncicirb.org/.

United States Code of Federal Regulations (U.S. CFR)

• 21 CFR 312.60: states that "an investigator is responsible for ensuring that an investigation is conducted according to the signed investigator statement, the investigational plan, and the applicable regulations; for protecting the rights, safety, and welfare of subjects under the investigator's care; and for the control of drugs under investigation…"
• 21 CFR 56.108: states that investigators must "(b) Follow written procedures for ensuring prompt reporting to the IRB, appropriate institutional officials, and the Food and Drug Administration of: (1) Any unanticipated problems involving risks to human subjects or others; (2) any instance of serious or continuing noncompliance with these regulations or the requirements or determinations of the IRB; or (3) any suspension or termination of IRB approval."
• 45 CFR 46.113: authorizes the IRB to suspend or terminate approval of research that is not being conducted in accordance with IRB's requirements or that has been associated with unexpected or serious harm to subjects.
• 45 CFR 46.103 (b) (5): states that institutions must have written procedures (which investigators must follow) for prompt reporting to the IRB, appropriate institutional officials, and the department or agency head of any unanticipated problems involving risks to subjects or others, or any serious or continuing noncompliance with 45 CFR 46 or the requirements or determinations of the IRB; and any suspension or termination of IRB approval.

The full U.S. CFR may be found at https://www.ecfr.gov/.

International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use (ICH)

• ICH 4.5.3: states that the investigator, or person designated by the investigator, should document and explain any deviation from the approved protocol.

The full ICH guidelines may be found at http://ichgcp.net/.

United States Food and Drug Administration

Guidance, compliance, and regulatory information from the US Food and Drug Administration (FDA) may be found at http://www.fda.gov/drugs/default.htm. The FDA considers protocol deviations as acts contrary to the written protocol.

Further insight into the FDA's perspective on protocol deviations can be found at https://www.fda.gov/inspections-compliance-enforcement-and-criminal-investigations/compliance-actions-and-activities/warning-letters. The website contains copies of warning letters issued by the FDA, as made available under the 1996 amended Freedom of Information Act. Examples of warning letters including protocol non-compliance issues include:

• Letter to JM Isner; 28 April 2000 (St. Elizabeth's Medical Center; Boston, Massachusetts): Subject ______ was enrolled into study VEGF2-CAD-001 (cardiac arterial disease study); however, the subject met the protocol exclusion criteria.
• Letter to EJ Kopp; 21 June 2000 (CARE Center, Raleigh, NC): Two of 14 subjects did not meet protocol criteria regarding duration of _____.

United States Health and Human Services

Regulations from the U.S. HHS may be found at http://www.hhs.gov/ohrp/.

Email ctsucontact@westat.com with any questions or concerns about the Protocol Deviation Form or process.