(a) As a service agent, the services you provide to transportation employers must meet the requirements of this part and the DOT agency drug and alcohol testing regulations.

(b) If you do not comply, DOT may take action under the Public Interest Exclusions procedures of this part (see Subpart R of this part) or applicable provisions of other DOT agency regulations.

(a) As a C/TPA or other service agent, you may act as an intermediary in the transmission of drug and alcohol testing information in the circumstances specified in this section only if the employer chooses to have you do so. Each employer makes the decision about whether to receive some or all of this information from you, acting as an intermediary, rather than directly from the service agent who originates the information (e.g., an MRO or BAT).

(b) The specific provisions of this part concerning which you may act as an intermediary are listed in Appendix F to this part. These are the only situations in which you may act as an intermediary. You are prohibited from doing so in all other situations.

(c) In every case, you must ensure that, in transmitting information to employers, you meet all requirements (e.g., concerning confidentiality and timing) that would apply if the service agent originating the information (e.g., an MRO or collector) sent the information directly to the employer. For example, if you transmit drug testing results from MROs to DERs, you must transmit each drug test result to the DER in compliance with the MRO requirements set forth in § 40.167 .

(a) You may operate random testing programs for employers and may assist (i.e., through contracting with laboratories or collection sites, conducting collections) employers with other types of testing (e.g., pre-employment, post-accident, reasonable suspicion, return-to-duty, and follow-up).

(b) You may combine employees from more than one employer or one transportation industry in a random pool if permitted by all the DOT agency drug and alcohol testing regulations involved.

(c) You may assist employers in ensuring that follow-up testing is conducted in accordance with the plan established by the SAP. However, neither you nor the employer are permitted to randomly select employees from a “follow-up pool” for follow-up testing.

(a) Except where otherwise specified in this part, as a service agent you may receive and maintain all records concerning DOT drug and alcohol testing programs, including positive, negative, and refusal to test individual test results. You do not need the employee's consent to receive and maintain these records.

(b) You may maintain all information needed for operating a drug/alcohol program (e.g., CCFs, ATFs, names of employees in random pools, random selection lists, copies of notices to employers of selected employees) on behalf of an employer.

(c) If a service agent originating drug or alcohol testing information, such as an MRO or BAT, sends the information directly to the DER, he or she may also provide the information simultaneously to you, as a C/TPA or other service agent who maintains this information for the employer.

(d) If you are serving as an intermediary in transmitting information that is required to be provided to the employer, you must ensure that it reaches the employer in the same time periods required elsewhere in this part.

(e) You must ensure that you can make available to the employer within two business days any information the employer is asked to produce by a DOT agency representative.

(f) On request of an employer, you must, at any time on the request of an employer, transfer immediately all records pertaining to the employer and its employees to the employer or to any other service agent the employer designates. You must carry out this transfer as soon as the employer requests it. You are not required to obtain employee consent for this transfer. You must not charge more than your reasonable administrative costs for conducting this transfer. You may not charge a fee for the release of these records.

(g) If you are planning to go out of business or your organization will be bought by or merged with another organization, you must immediately notify all employers and offer to transfer all records pertaining to the employer and its employees to the employer or to any other service agent the employer designates. You must carry out this transfer as soon as the employer requests it. You are not required to obtain employee consent for this transfer. You must not charge more than your reasonable administrative costs for conducting this transfer. You may not charge a fee for the release of these records.

(a) When you receive or maintain confidential information about employees (e.g., individual test results), you must follow the same confidentiality regulations as the employer with respect to the use and release of this information.

(b) You must follow all confidentiality and records retention requirements applicable to employers.

(c) You may not provide individual test results or other confidential information to another employer without a specific, written consent from the employee. For example, suppose you are a C/TPA that has employers X and Y as clients. Employee Jones works for X, and you maintain Jones' drug and alcohol test for X. Jones wants to change jobs and work for Y. You may not inform Y of the result of a test conducted for X without having a specific, written consent from Jones. Likewise, you may not provide this information to employer Z, who is not a C/TPA member, without this consent.

(d) You must not use blanket consent forms authorizing the release of employee testing information.

(e) You must establish adequate confidentiality and security measures to ensure that confidential employee records are not available to unauthorized persons. This includes protecting the physical security of records, access controls, and computer security measures to safeguard confidential data in electronic data bases.

(a) You may provide MRO services to employers, directly or through contract, if you meet all applicable provisions of this part.

(b) If you employ or contract for an MRO, the MRO must perform duties independently and confidentially. When you have a relationship with an MRO, you must structure the relationship to ensure that this independence and confidentiality are not compromised. Specific means (including both physical and operational measures, as appropriate) to separate MRO functions and other service agent functions are essential.

(c) Only your staff who are actually under the day-to-day supervision and control of an MRO with respect to MRO functions may perform these functions. This does not mean that those staff may not perform other functions at other times. However, the designation of your staff to perform MRO functions under MRO supervision must be limited and not used as a subterfuge to circumvent confidentiality and other requirements of this part and DOT agency regulations. You must ensure that MRO staff operate under controls sufficient to ensure that the independence and confidentiality of the MRO process are not compromised.

(d) Like other MROs, an MRO you employ or contract with must personally conduct verification interviews with employees and must personally make all verification decisions. Consequently, your staff cannot perform these functions.

(a) You must not require an employee to sign a consent, release, waiver of liability, or indemnification agreement with respect to any part of the drug or alcohol testing process covered by this part (including, but not limited to, collections, laboratory testing, MRO, and SAP services). No one may do so on behalf of a service agent.

(b) You must not act as an intermediary in the transmission of drug test results from the laboratory to the MRO. That is, the laboratory may not send results to you, with you in turn sending them to the MRO for verification. For example, a practice in which the laboratory transmits results to your computer system, and you then assign the results to a particular MRO, is not permitted.

(c) You must not transmit drug test results directly from the laboratory to the employer (by electronic or other means) or to a service agent who forwards them to the employer. All confirmed laboratory results must be processed by the MRO before they are released to any other party.

(d) You must not act as an intermediary in the transmission of alcohol test results of 0.02 or higher from the STT or BAT to the DER.

(e) Except as provided in paragraph (f) of this section, you must not act as an intermediary in the transmission of individual SAP reports to the actual employer. That is, the SAP may not send such reports to you, with you in turn sending them to the actual employer. However, you may maintain individual SAP summary reports and follow-up testing plans after they are sent to the DER, and the SAP may transmit such reports to you simultaneously with sending them to the DER.

(f) As an exception to paragraph (e) of this section, you may act as an intermediary in the transmission of SAP report from the SAP to an owner-operator or other self-employed individual.

(g) Except as provided in paragraph (h) of this section, you must not make decisions to test an employee based upon reasonable suspicion, post-accident, return-to-duty, and follow-up determination criteria. These are duties the actual employer cannot delegate to a C/TPA. You may, however, provide advice and information to employers regarding these testing issues and how the employer should schedule required testing.

(h) As an exception to paragraph (g) of this section, you may make decisions to test an employee based upon reasonable suspicion, post-accident, return-to-duty, and follow-up determination criteria with respect to an owner-operator or other self-employed individual.

(i) Except as provided in paragraph (j) of this section, you must not make a determination that an employee has refused a drug or alcohol test. This is a non-delegable duty of the actual employer. You may, however, provide advice and information to employers regarding refusal-to-test issues.

(j) As an exception to paragraph (i) of this section, you may make a determination that an employee has refused a drug or alcohol test, if:

(k) You must not act as a DER. For example, while you may be responsible for transmitting information to the employer about test results, you must not act on behalf of the employer in actions to remove employees from safety-sensitive duties.

(l) In transmitting documents to laboratories, you must ensure that you send to the laboratory that conducts testing only Copy 1 of the CCF. You must not transmit other copies of the CCF or any ATFs to the laboratory.

(m) You must not impose conditions or requirements on employers that DOT regulations do not authorize. For example, as a C/TPA serving employers in the pipeline or motor carrier industry, you must not require employers to have provisions in their DOT plans that PHMSA or FMCSA regulations do not require.

(n) You must not intentionally delay the transmission of drug or alcohol testing-related documents concerning actions you have performed, because of a payment dispute or other reasons.

(o) While you must follow the DOT agency regulations, the actual employer remains accountable to DOT for compliance, and your failure to implement any aspect of the program as required in this part and other applicable DOT agency regulations makes the employer subject to enforcement action by the Department.