The definition that catches clinics is in 21 CFR § 803.3, and it is counterintuitive. A serious injury includes an event that “necessitates medical or surgical intervention to preclude permanent impairment of a body function or permanent damage to a body structure.”
Read that carefully. The patient does not have to be harmed in the end. An event that required intervention to prevent permanent damage meets the definition even where the intervention worked perfectly and the patient walked out fine. The complication your team is proudest of handling is frequently the one that counts.
Most clinics decide whether something was an adverse event in the moment, under pressure, with the person who caused it in the room. That is not a decision that should be made without a written rule.
Who has to report what
Start with the part that surprises people in the other direction.
Most med spas are not device user facilities. Section 803.3 defines a device user facility as “a hospital, ambulatory surgical facility, nursing home, outpatient diagnostic facility, or outpatient treatment facility as defined in this section, which is not a physician’s office.” A clinic operating as a physician’s office is outside that definition, so the mandatory medical device reporting duties in Part 803 do not attach to it.
That is narrower relief than it sounds.
| Who | Obligation |
|---|---|
| Device user facilities | Mandatory reporting under 21 CFR Part 803 |
| Physician offices and most med spas | Not user facilities. Voluntary MedWatch reporting available |
| Device and drug manufacturers | Their own mandatory reporting duties, which your report feeds |
| Your state | Frequently mandatory, on its own clock. See Indiana’s 15-day rule |
So the federal mandatory channel may not apply while the state one does, and clinics that have heard “we are not required to report” have usually heard only the first half.
The protocol has to answer five questions in advance
Write these down, have the medical director approve them with a version date, and post the short form where the treatment happens.
- Who decides it is an event? Name a role, not a person who may be off that day. The person who performed the treatment should not be the sole decider.
- Who is called, and within what time? The on-call physician, with a maximum time to reach them and a documented fallback if they cannot be reached.
- What gets documented, and when? Contemporaneously. What happened, what was done, times, who was present, what the patient was told. The chart written a week later is the one that reads badly.
- What is reported, to whom, by when? Manufacturer, state, MedWatch, carrier, and in what order. Deadlines differ and they run from the event.
- Who talks to the patient, and what is said? Decide in advance who handles it, because the instinct in the room is to minimize, and minimizing is what turns an adverse event into a complaint.
The director’s exposure runs through this document
A protocol the medical director never approved is a protocol with nobody’s judgment behind it. When a board looks at an event, the questions are about the standing arrangements: what was approved, when, by whom, and was it followed.
This is also the clearest illustration of the point in your personal license is the collateral. The clinic’s exposure is a claim. The director’s exposure is whether the oversight existed on paper before the event, and it is a fixable problem right up until the moment it is not.
Protocols live under the same discipline as every other clinical document: named, versioned, dated and reviewed. See standing orders, protocols and delegation.
Two failure patterns
The event nobody logged. A complication is managed well, the patient is fine, and nothing is written because it resolved. Months later there is a complaint and no contemporaneous record exists. The clinic’s best evidence would have been the note it never made.
The deadline that started before anyone noticed. Reporting clocks run from the event, not from the day someone decides it was reportable. A week spent deciding is a week off the deadline.
What this means for you
Write the protocol before you need it, get the medical director to approve it with a version date, and drill it once so the sequence is known rather than read. Log every event that required intervention, including the ones that ended well, because the federal definition of a serious injury turns on the intervention rather than the outcome and your best defense is a note written the same day. Check your state’s reporting rule specifically, since the federal mandatory channel may not reach you while the state’s does. And decide now who speaks to the patient, because that conversation determines more outcomes than the clinical management does. Our own standards are at clinical standards.
Related reading
Frequently asked questions
Is my med spa required to report adverse events to the FDA?
Probably not through the mandatory channel. 21 CFR § 803.3 defines a device user facility as a hospital, ambulatory surgical facility, nursing home, outpatient diagnostic facility or outpatient treatment facility “which is not a physician’s office,” so a clinic operating as a physician’s office falls outside the Part 803 duties. Voluntary MedWatch reporting remains available, and state rules may still be mandatory.
What counts as a serious injury?
Under 21 CFR § 803.3, an injury or illness that is life-threatening, results in permanent impairment or damage, or necessitates medical or surgical intervention to preclude permanent impairment or damage. The third limb is the one clinics miss, because it can be met even when the patient recovers completely.
Does a complication that resolved still need to be documented?
Yes. Documentation and reporting are different questions, and the case for contemporaneous documentation is strongest precisely where the outcome was good, because that note is the evidence the management was appropriate.
Who should decide whether an event is reportable?
A named role defined in advance, and not the person who performed the treatment acting alone. The protocol should also name who is called, within what time, and what the fallback is when they cannot be reached.
When do reporting deadlines start?
From the event, not from the day someone concludes it was reportable. Time spent deciding comes out of the deadline, which is why the decision rule needs to exist before the event rather than after it.
This is general information, not legal advice. Rules vary by state and change. Confirm your own facts with counsel.