49 CFR Part 40 is the U.S. Department of Transportation regulation that dictates how safety-sensitive transportation employees get drug and alcohol tested, how results get reported, and how long records stay on file. It applies to any employer covered by FMCSA, FAA, FTA, or another DOT operating administration. The immediate priorities: confirm whether your workforce falls under Part 40, follow the collection and reporting procedures exactly as written, and keep records for the retention period each document requires.

TL;DR:

  • Employers must strictly follow the specific collection, handling, and reporting procedures outlined in Part 40 to prevent test invalidation or disqualification.
  • Accurate record keeping is critical, requiring retention of verified positive tests, refusals, SAP reports, and calibration logs for up to five years.
  • Testing staff such as collectors, MROs, and SAPs must be properly trained and credentialed, with responsibilities clearly defined to avoid compliance failures.
  • False negatives or procedural errors, like skipped chain-of-custody steps or uncalibrated devices, can lead to test cancellations or legal challenges.
  • Employers should establish organized, indexed electronic or physical record systems to ensure quick, audit-ready access within two business days.

Table of Contents

What 49 CFR Part 40 Covers and Who Must Comply

Part 40 is the procedural rulebook underneath every DOT drug and alcohol testing program. It does not decide who gets tested. That job belongs to the individual operating administrations: the Federal Motor Carrier Safety Administration (FMCSA) for commercial drivers, the Federal Aviation Administration (FAA) for flight crews and aviation maintenance staff, the Federal Transit Administration for transit workers, and similar agencies for pipeline and rail employees. Each agency writes its own rule about who is safety-sensitive and when testing is required. Part 40 then supplies the single, shared playbook for how every one of those tests actually gets performed.

That structure matters because employers sometimes confuse the two layers. A trucking company’s obligations under 49 CFR 382 (FMCSA’s testing rule) tell it who to test and under what circumstances. Part 40 tells the collector how to fill out the chain-of-custody form, how the lab must handle the specimen, and how the Medical Review Officer reports results back to the employer. Get the agency rule wrong and you test the wrong person. Get Part 40 wrong and even a properly ordered test can get thrown out on a technicality.

The regulation is organized into subparts that roughly track the testing lifecycle: general provisions and definitions, urine and oral fluid specimen collection, laboratory and instrumented testing, MRO review and reporting, alcohol testing devices and procedures, problems and their resolution (Subpart H), and return-to-duty and follow-up testing. The eCFR’s current version of Part 40 lays out every section for direct citation, which matters when you’re writing internal policy and need to point to exact regulatory language rather than paraphrase it.

One detail employers often miss: Part 40 governs regulated testing only. If your company also runs a non-DOT drug-free workplace policy for employees outside safety-sensitive roles, those tests can follow a different, less rigid process. Mixing the two policies without clearly separating documentation is one of the fastest ways to create audit confusion.

Who Runs the Test: MROs, SAPs, Collectors, and Service Agents

Part 40 assigns specific duties to specific people, and knowing who does what prevents the most common compliance breakdowns.

The Medical Review Officer (MRO) is a licensed physician who reviews every laboratory-confirmed positive, refusal, or problem result before it reaches the employer. The MRO interviews the employee, checks for legitimate medical explanations, and only then verifies the result as positive, negative, or refused. No employer should learn of a positive test before the MRO has completed that review.

The Substance Abuse Professional (SAP) evaluates employees after a violation and determines what education or treatment they need before returning to safety-sensitive duty. SAPs must meet specific credentialing and continuing-education requirements under Part 40, and their written recommendations become the backbone of the return-to-duty file.

Collectors and Breath Alcohol Technicians (BATs) or Screening Test Technicians (STTs) are the people physically present for specimen collection or breath testing. They must complete qualification training and, for oral fluid and breath testing specifically, hands-on proficiency demonstrations before conducting tests unsupervised. A collector who skips a chain-of-custody step doesn’t just make a clerical error. It can void the test entirely.

Designated Employer Representatives (DERs) are the company employees authorized to receive test results, make removal decisions, and act on refusals. Every covered employer needs at least one.

Many employers outsource collection, lab work, and MRO services to Consortium/Third-Party Administrators (C/TPAs). That’s allowed and common, but Part 40 makes the employer, not the service agent, legally responsible for the program’s compliance. If your C/TPA loses a form or misses a retention deadline, the citation lands on your company.

How Urine, Oral Fluid, and Breath Testing Actually Work

Urine collection remains the default method for DOT drug testing, and its procedure is the most detailed part of Part 40. The employee arrives at the collection site, presents photo ID, and the collector completes the top portion of the Custody and Control Form (CCF). The employee provides a specimen under direct or observed conditions depending on circumstances, and the collector splits it into two bottles on the spot: a primary specimen (Bottle A) and a split specimen (Bottle B). Both get sealed in the employee’s presence, and the employee initials the tamper-evident seals confirming the bottles are theirs. The collector then ships the sealed package to a certified laboratory, and the chain-of-custody documentation travels with it every step of the way.

Oral fluid collection, added more recently as an approved DOT method, uses a swab device instead of a cup. The core chain-of-custody principle is identical, direct observation, sealed sample, documented custody, but the device and the corresponding Alcohol Testing Form or oral fluid CCF differ from the urine paperwork. Employers running oral fluid programs need to confirm their collectors are trained specifically on that device, since urine-only certification doesn’t automatically cover it.

Breath testing for alcohol follows a separate track entirely, covered later, but the reporting principle is shared across all three specimen types: the lab or the device operator sends results to the MRO (for drug tests) or directly to the employer through the BAT (for alcohol tests), never straight to a supervisor or HR generalist without that review step. Confidentiality runs through the whole chain. Lab results identify the donor only by specimen ID number until the MRO’s verified report reaches the DER, and even then, Part 40 limits who inside the company can see the underlying medical details behind a verified result.

Alcohol Testing: Screening, Confirmation, and the 0.02 Threshold

DOT alcohol testing runs on a two-step model. A Screening Test Technician administers an initial test using either an Evidential Breath Testing device (EBT) or an Alcohol Screening Device (ASD), which can be a breath, saliva, or other approved device type. If that screening result comes back below 0.02, the test is negative and the process ends there.

A screening result of 0.02 or higher requires a confirmation test, and that confirmation must happen on an EBT, not an ASD, after a waiting period of at least 15 minutes to let any residual mouth alcohol dissipate. The confirmation number is the one that counts for determining consequences.

The action thresholds matter for employer response. A confirmed result above the threshold but below the violation limit requires the employee to be removed from safety-sensitive duty temporarily, though it isn’t treated as a DOT violation requiring SAP referral. A confirmed result of 0.04 or higher is treated the same as a positive drug test: immediate removal, mandatory SAP evaluation, and a return-to-duty process before the employee can resume safety-sensitive work.

EBTs themselves carry equipment standards. Devices must appear on the National Highway Traffic Safety Administration’s conforming products list, and employers or their service agents must maintain calibration and accuracy-check records for each device according to the manufacturer’s schedule and Part 40s requirements. An uncalibrated or improperly maintained EBT can undermine an otherwise valid confirmation result, which is exactly the kind of detail an auditor checks first.

Technician checking breath testing equipment calibration

Refusals, Adulteration, Cancellations, and Split-Specimen Rights

A refusal to test under Part 40 covers more than walking away from the collection site. Failing to provide a sufficient specimen without a valid medical explanation, failing to remain for the required observation period, refusing to sign required forms, or tampering with the collection process can all be treated as a refusal. Employers must treat a documented refusal exactly as they would a verified positive: immediate removal from safety-sensitive duties and referral for SAP evaluation.

Adulteration and substitution are laboratory findings, not collector judgment calls. A lab flags a specimen as adulterated when it detects a foreign substance that could interfere with testing, or substituted when the creatinine and specific gravity values fall outside the range consistent with human urine. The MRO still reviews these results, but because there’s rarely a legitimate medical explanation for a substituted specimen, these findings almost always resolve as a refusal to test.

Not every problem test becomes a violation. A cancelled test is one the MRO invalidates because of a procedural or documentation flaw, a missing signature, a broken seal, an insufficient specimen with a valid medical reason, and cancelled tests generally can’t be used against the employee, though a recollection is often required depending on the reason. That’s distinct from a corrected test, where an error on the paperwork gets fixed without invalidating the result itself.

Employees who receive a verified positive, adulterated, or substituted result have the right to request that the split specimen (Bottle B) be sent to a different certified lab for independent testing. The request must go through the MRO within 72 hours of being notified of the result. If the split confirms the primary result, the employer bears the cost; if it doesn’t reconfirm, the test is cancelled and the employer generally covers that testing cost as well, though the specifics of who initially pays can vary by program design.

Record Retention: What to Keep and for How Long

Section 40.333 sets four separate retention clocks, and mixing them up is one of the most common findings in DOT compliance audits.

Retention period Records covered Common employer mistake
5 years Verified positive drug tests, refusals to test, alcohol results of 0.02 or higher, SAP evaluation reports, follow-up testing plans, annual MIS reports Deleting employee files entirely at termination instead of preserving test records separately
5 years Records of prior employer drug and alcohol testing history obtained for new hires Skipping the check because the new hire “seemed fine” in the interview
2 years Collector, BAT/STT training and qualification files, and calibration/maintenance records for EBTs and screening devices Letting the C/TPA hold these with no internal copy or access log
2 years Negative drug test results and cancelled tests Purging negatives too early, before an internal audit cycle closes

A practical retention checklist looks like this:

  • Tag every verified positive, refusal, adulterated, or substituted result for the full 5-year clock the moment the MRO’s report arrives.
  • File SAP evaluation reports and follow-up testing schedules together, since auditors typically request them as a set.
  • Keep collector and BAT/STT training certificates on a rolling 2-year update schedule, not just at hire.
  • Store EBT and ASD calibration logs in a format that timestamps every check, not just a pass/fail note.
  • Confirm your C/TPA contract states explicitly that records remain retrievable at your principal place of business within the timeframe a DOT agency inspector requests.

Confidentiality rules apply throughout. Test records must be stored separately from general personnel files, with access limited to people who have a legitimate need to know, and service agents who hold records on your behalf don’t relieve you of that responsibility under §40.333’s employer accountability language.

None of this connects directly to the FMCSA Drug and Alcohol Clearinghouse, which is a separate national database of violations for CDL holders. Clearinghouse reporting is an additional obligation on top of, not instead of, your internal §40.333 recordkeeping.

Employer Responsibilities After a Test Result

The moment an MRO verifies a positive result or reports a refusal, the clock starts on a specific sequence of employer actions. The employee must be removed from safety-sensitive duties immediately. The DER documents the removal date and time. The employee gets a list of qualified SAPs. And the entire chain gets logged, because a gap in that timeline is exactly what an auditor flags first.

Pre-employment due diligence matters just as much as post-incident response. Before putting a new hire behind the wheel or into any other safety-sensitive role, employers covered by FMCSA rules must query the Clearinghouse and, in most cases, request drug and alcohol testing history from the applicant’s previous DOT-regulated employers going back two years.

Management Information System (MIS) reporting is an annual obligation for many employers, summarizing testing volumes, positive rates, and refusals for the year. It’s a paperwork task that’s easy to deprioritize until an agency asks for the underlying data behind the summary numbers.

When you outsource collection, lab work, or MRO services to a C/TPA, your contract should spell out exactly how fast that service agent can produce records on request; verbal assurances don’t hold up during an inspection. Common audit triggers include missing calibration logs, SAP reports that don’t match the follow-up testing schedule actually performed, and negative test results kept past their one-year window in a way that suggests sloppy recordkeeping rather than a real reason for retention.

The Return-to-Duty Process and Follow-Up Testing

An employee who tests positive, refuses a test, or registers a confirmed alcohol result of 0.04 or higher cannot return to safety-sensitive duty on their own timeline. The path back runs through a fixed sequence.

First, the employee meets with a SAP, who conducts a face-to-face evaluation and issues a written report recommending education, treatment, or both. This report should specify exactly what the employee needs to complete and why, not just a generic referral.

Second, once the SAP determines the employee has complied with that recommendation, a follow-up SAP evaluation confirms readiness, and the employee takes a return-to-duty (RTD) test. Only a verified negative drug test, or an alcohol test below 0.02, allows the employee back into a safety-sensitive role.

Third, the SAP establishes a follow-up testing plan: a minimum of six tests over the first 12 months back on duty, though the SAP can extend that schedule up to 60 months if warranted. Employers are responsible for actually administering those tests on schedule, not just filing the plan and forgetting it.

Return-to-duty testing process and timeline

Every step generates paperwork that belongs in the 5-year retention bucket: the initial SAP report, the RTD test result, the follow-up SAP evaluation, and the follow-up testing schedule itself. Keeping these four documents in one indexed file, rather than scattered across HR, safety, and the C/TPA’s portal, is the single biggest time-saver when an inspector asks to see the full RTD history for an employee.

Staying Audit-Ready: Practical Systems That Hold Up Under Inspection

“Readily auditable” is a specific standard, not a vague aspiration. If your records live electronically, FAA guidance and Part 40 both require that you can convert them to a printed, organized format on short notice. A folder of scanned PDFs with no index doesn’t meet that bar if it takes three days to assemble a single employee’s file.

Inspectors move fast. FMCSA field staff commonly expect motor carriers to produce requested records within about two business days, and other DOT agencies work on similarly tight windows. Waiting until an audit letter arrives to figure out where your SAP reports are filed is already too late.

A few systems separate the employers who breeze through inspections from the ones who scramble:

  • Build a single indexed export, CCF, MRO report, SAP report, and follow-up schedule bundled per employee, rather than four separate files an inspector has to hunt down.
  • Group records by category (positive/refusal, RTD, cancelled, negative) since auditors typically request them that way, not chronologically.
  • Log every access to confidential test records, not just their storage location.
  • Put C/TPA record-production timeframes in writing as a contract term, not a verbal understanding.

Pro Tip: Tag every RTD and SAP file with a color code or folder prefix the moment it’s created, since practitioners consistently find that employers who wait until termination to organize these records lose track of what’s actually in the file.

Where to Read the Regulation and Official Guidance

Bookmark the primary sources instead of relying on secondhand summaries, since Part 40 gets amended periodically and interpretations shift.

  • The eCFR’s Part 40 text is the current, official regulatory language, organized by subpart and section for direct citation.
  • The DOT ODAPC Part 40 hub organizes the same regulation alongside official Q&As that interpret gray areas the bare text doesn’t fully resolve.
  • Cross-reference FMCSA’s employer overview for trucking-specific obligations, and check the FAA or FTA equivalents if your workforce falls under aviation or transit rules instead.

When citing Part 40 in your own policy documents, reference the specific section number, such as §40.1 for the regulation’s purpose or §40.333 for recordkeeping, rather than citing “Part 40” broadly. It reads as more precise and it’s easier for your own staff to locate later.

What Ten Years of Audit Prep Has Taught Us

Most employers don’t fail DOT audits because they skipped a test. They fail because the paperwork proving the test happened correctly wasn’t where it needed to be when someone asked for it. That’s the pattern Total Tox has watched play out across construction firms, transportation companies, and healthcare employers for over a decade of DOT compliance work.

The recurring documentation error isn’t exotic. It’s a missing collector signature on a CCF, a calibration log with gaps, or a SAP follow-up schedule that doesn’t match what was actually administered. Every one of these is fixable in minutes if caught early, and catastrophic if discovered mid-inspection.

The uncomfortable truth about Part 40 compliance is that most employers treat it as a testing problem when it’s really a records-management problem. The test itself takes fifteen minutes. Proving, two years later, that the test happened exactly the way the regulation required, that’s the part that actually gets audited. Fast turnaround and MRO-reviewed reporting matter less because speed is convenient and more because a same-day, digitally logged result leaves a cleaner trail than a paper form sitting in someone’s desk drawer for a week before it gets filed.

Compliance built around instant, well-documented reporting isn’t a nice add-on to a testing program. It’s the actual product an employer is paying for.

— Total Tox

Fast, Compliant Testing Without the Documentation Guesswork

There are walk-in alternatives to scheduling a test through a clinic that takes days to return results and longer to hand you a usable compliance record. Tests can be completed quickly, and results often come back within 24 hours, reviewed by a Medical Review Officer and ready to file.

Total Tox

That speed matters most when you’re dealing with a random pool selection, a post-accident test, or a new-hire deadline you can’t push back. Results from testing providers often come with audit-ready documentation designed to meet the retention and format standards required by regulations, helping employers avoid reconstructing paperwork later. Total Tox’s DOT testing and physical services cover urine, oral fluid, and breath alcohol testing for employers across transportation, construction, healthcare, and manufacturing throughout the Bronx, New York County, Westchester, and Queens.

Employers are generally advised to bring valid photo ID for employees and any prior testing history documentation required. Results often transfer electronically to help protect confidentiality and reduce the risk of lost paperwork. To schedule a walk-in test or set up an ongoing employer account, contact Total Tox or visit the main services page to see current availability.

Sources