2a:"/_next/static/chunks/1pil2ui6m6gup.js" 2b:I[97616,["$3","$4","$5","$6","$7","$8","$9","$a","$2a"],"PageTitle"] 2c:I[43780,["$3","$4","$5","$6","$7","$8","$9","$a","$2a"],"Topic"] 2f:I[27201,["$3","$4","$5","$6","$7","$8","$9","$a"],"IconMark"] 2d:T3257,

§ 40.321 What is the general confidentiality rule for drug and alcohol test information? Except as otherwise provided in this subpart, as a service agent or employer participating in the DOT drug or alcohol testing process, you are prohibited from releasing individual test results or medical information about an employee to third parties without the employee’s specific written consent.

(a) A “third party” is any person or organization to whom other subparts of this regulation do not explicitly authorize or require the transmission of information in the course of the drug or alcohol testing process.

(b) “Specific written consent” means a statement signed by the employee agreeing to the release of a particular piece of information to a particular, explicitly identified person or organization at a particular time. “Blanket releases,” where an employee agrees to the release of a category of information (for example, all test results) or to release information to a category of parties (for example, other employers who are members of a C/TPA or companies to which the employee may apply for employment), are prohibited under this part.

§ 40.323 May program participants release drug or alcohol test information in connection with legal proceedings? (a) As an employer, you may release information pertaining to an employee’s drug or alcohol test without the employee’s consent in certain legal proceedings.

(1) These proceedings include a lawsuit, for example a wrongful discharge action, a grievance, for example an arbitration concerning disciplinary action taken by the employer, or an administrative proceeding, for example an unemployment compensation hearing, brought by or on behalf of an employee and resulting from a positive DOT drug or alcohol test or a refusal to test, including adulterated or substituted test results.

(2) These proceedings also include criminal or civil actions resulting from an employee’s performance of safety-sensitive duties, in which a court of competent jurisdiction determines that the drug or alcohol test information sought is relevant and issues an order requiring the employer to produce the information. For example, in personal injury litigation following a truck or bus collision, the court could determine that a post-accident drug test result of an employee is relevant to determining whether the driver or the driver’s employer was negligent. The employer is authorized to respond to the court’s order to produce the records.

(b) In such a proceeding, you may release the information to the decision-maker in the proceeding, for example the court in a lawsuit. You may release the information only with a binding stipulation that the decision-maker to whom it is released will make it available only to parties to the proceeding.

(c) If you are a service agent and the employer requests its employee’s drug or alcohol testing information from you to use in a legal proceeding as authorized in paragraph (a) of this section, for example the laboratory’s data package, you must provide the requested information to the employer.

(d) As an employer or service agent, you must immediately notify the employee in writing of any information you release under this section.

§ 40.325 [Reserved]

§ 40.327 When must the MRO report medical information gathered in the verification process? (a) As the MRO, you must, except as provided in paragraph (c) of this section, report drug test results and medical information obtained during the verification process to third parties without the employee’s consent if you determine, in your reasonable medical judgment, that:

(1) The information is likely to result in the employee being determined to be medically unqualified under an applicable DOT agency regulation; or

(2) The information indicates that continued performance by the employee of his or her safety-sensitive function is likely to pose a significant safety risk.

(b) The third parties to whom you are authorized to provide information by this section include the employer, a physician or other health care provider responsible for determining the medical qualifications of the employee under an applicable DOT agency safety regulation, a SAP evaluating the employee as part of the return-to-duty process (see § 40.293(g)), a DOT agency, or the National Transportation Safety Board in the course of an accident investigation.

(c) If the law of a foreign country, for example Canada, prohibits you from providing medical information to the employer, you may comply with that prohibition.

§ 40.329 What information must laboratories, MROs, and other service agents release to employees? (a) As an MRO or service agent you must provide, within 10 business days of receiving a written request from an employee, copies of any records pertaining to the employee’s use of alcohol and/or drugs, including records of the employee’s DOT-mandated drug and/or alcohol tests. You may charge no more than the cost of preparation and reproduction for copies of these records.

(b) As a laboratory, you must provide, within 10 business days of receiving a written request from an employee, and made through the MRO, the records relating to the results of the employee’s drug test, that is, the laboratory report and data package. You may charge no more than the cost of preparation and reproduction for copies of these records.

(c) As a SAP, you must make available to an employee, on request, a copy of all SAP reports (see § 40.311). However, you must redact follow-up testing information from the report before providing it to the employee.

§ 40.331 To what additional parties must employers and service agents release information? As an employer or service agent you must release information under the following circumstances:

(a) If you receive a specific, written consent from an employee authorizing the release of information about that employee’s drug or alcohol tests to an identified person, you must provide the information to the identified person. For example, as an employer, when you receive a written request from a former employee to provide information to a subsequent employer, you must do so. In providing the information, you must comply with the terms of the employee’s consent.

(b) If you are an employer, you must, upon request of DOT agency representatives, provide the following:

(1) Access to your facilities used for this part and DOT agency drug and alcohol program functions.
(2) All written, printed, and computer-based drug and alcohol program records and reports, including copies of name-specific records or reports; files; materials; data; documents and documentation; agreements; contracts; policies; and statements required by this part and DOT agency regulations. You must provide this information at your principal place of business in the time required by the DOT agency.
(3) All items in paragraph (b)(2) of this section must be easily accessible, legible, and provided in an organized manner. If electronic records do not meet these standards, they must be converted to printed documentation that meets these standards.

(1) Access to your facilities used for this part and DOT agency drug and alcohol program functions.
(2) All written, printed, and computer-based drug and alcohol program records and reports, including copies of name-specific records or reports; files; materials; data; documents and documentation; agreements; contracts; policies; and statements required by this part and DOT agency regulations. You must provide this information at your principal place of business in the time required by the DOT agency.
(3) All items in paragraph (c)(2) of this section must be easily accessible, legible, and provided in an organized manner. If electronic records do not meet these standards, they must be converted to printed documentation that meets these standards.

(d) If requested by the National Transportation Safety Board as part of an accident investigation, you must provide information concerning post-accident tests administered after the accident.

(e) If requested by a Federal, state, or local safety agency with regulatory authority over you or the employee, you must provide drug and alcohol test records concerning the employee.

(f) Except as otherwise provided in this part, as a laboratory you must not release or provide a specimen or a part of a specimen to a requesting party without first obtaining written consent from ODAPC. DNA testing and other types of identity testing are not authorized and ODAPC will not give permission for such testing. If a party seeks a court order directing you to release a specimen or part of a specimen contrary to any provision of this part, you must take necessary legal steps to contest the issuance of the order, for example seek to quash a subpoena, citing the requirements of § 40.13. This part does not require you to disobey a court order, however.

(g) Notwithstanding any other provision of this part, as an employer of Commercial Motor Vehicle drivers holding commercial driving licenses or as a third party administrator for owner-operator Commercial Motor Vehicle drivers with commercial driving licenses, you are authorized to comply with State laws requiring you to provide to State CDL licensing authorities information about all violations of DOT drug and alcohol testing rules, including positive tests and refusals, by any Commercial Motor Vehicle driver holding a commercial driving license.

§ 40.333 What records must employers keep? (a) As an employer, you must keep the following records for the following periods of time:

(1) You must keep the following records for five years:

(i) Records of alcohol test results indicating an alcohol concentration of 0.02 or greater;
(ii) Records of verified positive drug test results;
(iii) Documentation of refusals to take required alcohol and/or drug tests, including substituted or adulterated drug test results;
(iv) SAP reports; and
(v) All follow-up tests and schedules for follow-up tests.

(2) You must keep records for three years of information obtained from previous employers under § 40.25 concerning drug and alcohol test results of employees.

(3) You must keep records of the inspection, maintenance, and calibration of EBTs for two years.

(4) You must keep records of negative and cancelled drug test results and alcohol test results with a concentration of less than 0.02 for one year.

(b) You do not have to keep records related to a program requirement that does not apply to you, for example a maritime employer who does not have a DOT-mandated random alcohol testing program need not maintain random alcohol testing records.

(d) A service agent may maintain these records for you. However, you must ensure that you can produce these records at your principal place of business in the time required by the DOT agency. For example, as a motor carrier, when an FMCSA inspector requests your records, you must ensure that you can provide them within two business days.

(e) If you store records electronically, where permitted by this part, you must ensure that the records are easily accessible, legible, and formatted and stored in an organized manner. If electronic records do not meet these criteria, you must convert them to printed documentation in a rapid and readily auditable manner, at the request of DOT agency personnel.

1f:[["$","$L2b",null,{"title":"Part 40 subpart P: Confidentiality and release of information"}],["$","$L2c",null,{"code":"subpart_p___confidentiality_and_release_of_information","initial":{"record":{"title":"Part 40 subpart P: Confidentiality and release of information","description":"Part 40 subpart P: the general confidentiality rule and when drug and alcohol test information may be released and to whom.","keywords":"dot, confidentiality, release of information, mro, sap, records, § 40.321, § 40.333","data":"$2d","icon":"ri-file-list-3-line","category":"TOPIC","updated":"09/24/2026","code":"subpart_p___confidentiality_and_release_of_information","id":"12fe0b44-febc-4fb9-b748-eae168722f29"},"parents":[{"code":"dot_rules_and_regulations","title":"DOT drug and alcohol testing","type":"parent","category":"TOPIC","sortid":90},{"code":"part_40_drug_and_alcohol_regulations","title":"49 CFR Part 40 reference","type":"parent","category":"TOPIC","sortid":100}],"children":[],"see":[],"next":[],"prev":[],"faq":[],"guides":[]}}],"$L2e"] 21:null 27:[["$","title","0",{"children":"Part 40 subpart P: Confidentiality and release of information | Med-Stop Help"}],["$","meta","1",{"name":"description","content":"Part 40 subpart P: the general confidentiality rule and when drug and alcohol test information may be released and to whom."}],["$","link","2",{"rel":"manifest","href":"/manifest.webmanifest","crossOrigin":"$undefined"}],["$","meta","3",{"name":"keywords","content":"dot, confidentiality, release of information, mro, sap, records, § 40.321, § 40.333"}],["$","link","4",{"rel":"icon","href":"/favicon.ico"}],["$","link","5",{"rel":"apple-touch-icon","href":"/apple-touch-icon.png"}],["$","$L2f","6",{}]]