(a) A “third party” is any person or organization to whom other subparts of this regulation do not explicitly authorize or require the transmission of information in the course of the drug or alcohol testing process.

(b) “Specific written consent” means a statement signed by the employee that he or she agrees to the release of a particular piece of information to a particular, explicitly identified, person or organization at a particular time. “Blanket releases,” in which an employee agrees to a release of a category of information (e.g., all test results) or to release information to a category of parties (e.g., other employers who are members of a C/TPA, companies to which the employee may apply for employment), are prohibited under this part.

(a) As an employer, you may release information pertaining to an employee's drug or alcohol test without the employee's consent in certain legal proceedings.

(b) In such a proceeding, you may release the information to the decisionmaker in the proceeding (e.g., the court in a lawsuit). You may release the information only with a binding stipulation that the decisionmaker to whom it is released will make it available only to parties to the proceeding.

(c) If you are a service agent, and the employer requests its employee's drug or alcohol testing information from you to use in a legal proceeding as authorized in paragraph (a) of this section (e.g., the laboratory's data package), you must provide the requested information to the employer.

(d) As an employer or service agent, you must immediately notify the employee in writing of any information you release under this section.

(a) As the MRO, you must, except as provided in paragraph (c) of this section, report drug test results and medical information you learned as part of the verification process to third parties without the employee's consent if you determine, in your reasonable medical judgment, that:

(b) The third parties to whom you are authorized to provide information by this section include the employer, a physician or other health care provider responsible for determining the medical qualifications of the employee under an applicable DOT agency safety regulation, a SAP evaluating the employee as part of the return to duty process (see § 40.293(g)), a DOT agency, or the National Transportation Safety Board in the course of an accident investigation.

(c) If the law of a foreign country (e.g., Canada) prohibits you from providing medical information to the employer, you may comply with that prohibition.

(a) As an MRO or service agent you must provide, within 10 business days of receiving a written request from an employee, copies of any records pertaining to the employee's use of alcohol and/or drugs, including records of the employee's DOT-mandated drug and/or alcohol tests. You may charge no more than the cost of preparation and reproduction for copies of these records.

(b) As a laboratory, you must provide, within 10 business days of receiving a written request from an employee, and made through the MRO, the records relating to the results of the employee's drug test (i.e., laboratory report and data package). You may charge no more than the cost of preparation and reproduction for copies of these records.

(c) As a SAP, you must make available to an employee, on request, a copy of all SAP reports (see § 40.311). However, you must redact follow-up testing information from the report before providing it to the employee.

(a) If you receive a specific, written consent from an employee authorizing the release of information about that employee's drug or alcohol tests to an identified person, you must provide the information to the identified person. For example, as an employer, when you receive a written request from a former employee to provide information to a subsequent employer, you must do so. In providing the information, you must comply with the terms of the employee's consent.

(b) If you are an employer, you must, upon request of DOT agency representatives, provide the following:

(c) If you are a service agent, you must, upon request of DOT agency representatives, provide the following:

(d) If requested by the National Transportation Safety Board as part of an accident investigation, you must provide information concerning post-accident tests administered after the accident.

(e) If requested by a Federal, state or local safety agency with regulatory authority over you or the employee, you must provide drug and alcohol test records concerning the employee.

(f) Except as otherwise provided in this part, as a laboratory you must not release or provide a specimen or a part of a specimen to a requesting party, without first obtaining written consent from ODAPC. DNA testing and other types of identity testing are not authorized and ODAPC will not give permission for such testing. If a party seeks a court order directing you to release a specimen or part of a specimen contrary to any provision of this part, you must take necessary legal steps to contest the issuance of the order (e.g., seek to quash a subpoena, citing the requirements of § 40.13). This part does not require you to disobey a court order, however.

(g) Notwithstanding any other provision of this Part, as an employer of Commercial Motor Vehicle (CMV) drivers holding commercial driving licenses (CDLs) or as a third party administrator for owner-operator CMV drivers with CDLs, you are authorized to comply with State laws requiring you to provide to State CDL licensing authorities information about all violations of DOT drug and alcohol testing rules (including positive tests and refusals) by any CMV driver holding a CDL.

(a) As an employer, you must keep the following records for the following periods of time:

(b) You do not have to keep records related to a program requirement that does not apply to you (e.g., a maritime employer who does not have a DOT-mandated random alcohol testing program need not maintain random alcohol testing records).

(c) You must maintain the records in a location with controlled access.

(d) A service agent may maintain these records for you. However, you must ensure that you can produce these records at your principal place of business in the time required by the DOT agency. For example, as a motor carrier, when an FMCSA inspector requests your records, you must ensure that you can provide them within two business days.

(e) If you store records electronically, where permitted by this part, you must ensure that the records are easily accessible, legible, and formatted and stored in an organized manner. If electronic records do not meet these criteria, you must convert them to printed documentation in a rapid and readily auditable manner, at the request of DOT agency personnel.