Compliance Guide

Record Keeping Requirements

DOT regulations specify exactly what records must be kept, for how long, and who can see them. Poor record keeping is one of the most common compliance failures found during audits.

Under 49 CFR Part 40, employers are required to maintain specific records related to their drug and alcohol testing programs. These records must be kept confidential, stored securely, and made available to authorized parties upon request. They are also subject to review during DOT compliance audits.

Retention Periods

How Long to Keep Each Record Type

5 Years — Highest sensitivity records
  • • Verified positive drug test results
  • • Adulterated or substituted specimen results
  • • Alcohol test results of 0.02 BAC or greater
  • • Refusals to test
  • • SAP referral and evaluation documentation
  • • Return-to-duty and follow-up testing records
2 Years — Program administration records
  • • Collection site, laboratory, MRO, SAP, and C/TPA agreements and contracts
  • • Records related to the random testing selection process
  • • Supervisor reasonable suspicion training records
1 Year — Routine test documentation
  • • Negative and cancelled drug test results
  • • Alcohol test results below 0.02 BAC
Indefinite — Keep until employee separation + additional time
  • • Employee training records and policy acknowledgment signatures — keep at least 2 years after separation
Confidentiality

Who Can Access Test Records

Drug and alcohol test results are confidential and may only be disclosed to specific authorized parties.

✓
The employee themselvesAn employee has the right to access their own test results and related records upon written request.
✓
The employer (DER)The Designated Employer Representative receives MRO-reported results and manages records for the program.
✓
DOT agency representativesDuring compliance audits and safety investigations, authorized DOT agency officials may request access to records.
✓
Subsequent employers (with written consent)A new DOT-regulated employer may obtain test records from a previous employer — but only with the employee's written authorization.
✗
Not general management or coworkersTest results may not be shared with supervisors, HR staff, or coworkers who are not directly involved in the testing program administration.
Storage

How Records Must Be Stored

  • ✓ Maintained in a secure location with restricted access
  • ✓ Kept separate from general personnel files
  • ✓ Electronic storage is acceptable if records are retrievable and tamper-evident
  • ✓ Must be available for inspection upon request from authorized parties within a reasonable timeframe
Audit Readiness

Record Keeping Checklist

  • ✓ All positive results and refusals retained for minimum 5 years
  • ✓ Negative results retained for minimum 1 year
  • ✓ Supervisor reasonable suspicion training documented with dates
  • ✓ Employee policy acknowledgment signatures on file
  • ✓ C/TPA, MRO, and lab agreements retained for 2 years
  • ✓ Records stored securely and separate from general personnel files
  • ✓ Random pool selection records maintained for 2 years
  • ✓ Annual MIS (Management Information System) report filed if required by agency
← Back to Compliance