Compliance Guide

Record Keeping Requirements

DOT regulations specify exactly what records must be kept, for how long, and who can see them. Poor record keeping is one of the most common compliance failures found during audits.

Under 49 CFR Part 40, employers are required to maintain specific records related to their drug and alcohol testing programs. These records must be kept confidential, stored securely, and made available to authorized parties upon request. They are also subject to review during DOT compliance audits.

Retention Periods

How Long to Keep Each Record Type

Part 40 is the floor, not the whole answer. §40.333 binds the DOT modes for the testing Part 40 covers — note that USCG alcohol records follow 46 CFR 4.06 rather than Part 40 (§40.3). Your modal rule (FMCSA §382.401, FTA §655.71, FRA, FAA, PHMSA, USCG) can require more, and sometimes disagrees. The clearest conflict: EBT calibration is 2 years under §40.333(a)(3) but 5 years under §382.401(b)(1)(v). Where they differ, keep the longer period. Rows below are labeled with the rule they come from.

5 Years — Highest sensitivity records
  • • Verified positive drug test results — §40.333(a)(1)(ii)
  • • Adulterated or substituted specimen results — §40.333(a)(1)(iii)
  • • Alcohol test results of 0.02 or greater — §40.333(a)(1)(i)
  • • Refusals to test — §40.333(a)(1)(iii)
  • • SAP reports — §40.333(a)(1)(iv)
  • • All follow-up tests and the follow-up testing schedule — §40.333(a)(1)(v). Note a negative return-to-duty result is a 1-year record under §40.333(a)(4), not a 5-year one
  • • FMCSA adds: driver evaluations and referrals, calibration documentation, records of program administration including all driver violations, and each annual calendar-year summary — §382.401(b)(1)
3 Years — Previous-employer information
  • • Information obtained from previous employers under §40.25 about an employee’s drug and alcohol test results — §40.333(a)(2). This is the only 3-year bucket in Part 40, and it is the one most often missed
2 Years — Program administration records
  • • Inspection, maintenance and calibration records for EBTs — §40.333(a)(3) — but if you are an FMCSA employer, calibration documentation is a FIVE-year record under §382.401(b)(1)(v). Keep it five.
  • • FMCSA only: records related to the collection process except EBT calibration — collection logbooks if used, random-selection documents, BAT training documentation, documents behind reasonable-suspicion and post-accident testing decisions, and documents verifying a medical explanation for an inability to provide a specimen — §382.401(b)(2), (c)(1)
1 Year — Routine test documentation
  • • Negative and cancelled drug test results — §40.333(a)(4)
  • • Alcohol test results below 0.02 — §40.333(a)(4)
  • • FMCSA adds: MRO reversals of cancelled controlled-substances results — §382.401(b)(3)
While performing, + 2 years — the 2 years run from when the person stops performing the role, not from separation. This is a defined period, not an indefinite one
  • • FMCSA only: education and training records for BATs, STTs, supervisors and drivers — kept while the individual performs the function, and for 2 years after they cease to perform it — §382.401(b)(4). That clock starts when they stop doing the job, which can be long before they leave the company
Confidentiality

Who Can Access Test Records

Drug and alcohol test results are confidential and may only be disclosed to specific authorized parties.

The employee themselvesAn employee has the right to access their own test results and related records upon written request.
The employer (DER)The Designated Employer Representative receives MRO-reported results and manages records for the program.
DOT agency representativesDuring compliance audits and safety investigations, authorized DOT agency officials may request access to records.
Subsequent employers (with written consent)A new DOT-regulated employer may obtain test records from a previous employer — but only with the employee's written authorization.
Not general management or coworkersTest results may not be shared with supervisors, HR staff, or coworkers who are not directly involved in the testing program administration.
Storage

How Records Must Be Stored

  • Maintained in a secure location with restricted access
  • Held in a location with controlled access — that is the actual requirement (§40.333(c)). Keeping them out of the general personnel file is a best practice we recommend, not something Part 40 mandates
  • Electronic storage is acceptable if records are securely maintained, readily retrievable, and kept in a location with controlled access — that is what §40.333(c) actually requires. Tamper-evident storage and audit logs are recommended best practice, not a stated Part 40 condition
  • Must be available for inspection upon request from authorized parties within a reasonable timeframe
Audit Readiness

Record Keeping Checklist

  • All verified positives, adulterated/substituted results and refusals retained for a minimum of 5 years (§40.333(a)(1))
  • Negative and cancelled results retained for a minimum of 1 year (§40.333(a)(4))
  • Supervisor reasonable-suspicion training documented with dates — and retained while they hold the role plus 2 years after they stop (§382.401(b)(4))
  • Employee policy acknowledgment signatures on file
  • Service agreements with your C/TPA, MRO, laboratory, BATs and STTs on file — for an FMCSA employer this is not merely good practice. §382.401(c)(6)(i) expressly lists agreements with collection sites, laboratories, breath alcohol technicians, screening test technicians, medical review officers, consortia and third-party service providers as administrative records that must be maintained, and §382.401(b)(1)(vi) puts records related to administration of the programme in the five-year bucket. The separate 2-year bucket covers collection-process records
  • Records stored in a location with controlled access (§40.333(c)); storing them separately from the general personnel file is a recommended practice
  • Random selection records maintained for 2 years (§382.401(b)(2), (c)(1)(ii) — an FMCSA requirement, not §40.333)
  • Annual MIS (Management Information System) report filed if required by agency
← Back to Compliance