49 CFR Part 40 governs drug and alcohol testing—here's what goes in your driver file

You will retain drug and alcohol test results for five years under 49 CFR § 382.401, but auditors will also pull your pre-employment consent forms, clearinghouse query logs, and return-to-duty documentation—and if you can't produce them from your own files within two business days, it's a violation.

Part 40 applies to all your drivers, not just those with failed tests

49 CFR Part 40 is DOT-wide. It covers pre-employment, random, post-accident, reasonable-suspicion, and return-to-duty testing across all modes—FAA, FRA, PHMSA, FMCSA. Your responsibility is non-delegable. You can hire collectors, labs, and Medical Review Officers, but you own the compliance. If a service agent loses a form or misfiles a result, it's your violation.

Pre-employment history: the consent form and two-year lookback auditors always check first

Before a driver starts, you must obtain written consent and query all previous DOT employers for the past two years of drug and alcohol test history. You need the signed authorization, your documented good-faith efforts to contact each prior employer, and copies of what you received back. Clearinghouse queries alone are not audit evidence—auditors want to see your local records.

A driver who refuses the consent cannot operate a CMV. If you hire a driver and later discover you never got the signed form, you have no defense. An auditor will ask to see the consent dated before hire, the list of employers you contacted, and your records of their responses. Missing or incomplete inquiry documentation is one of the most common audit findings in 15 years of safety management.

Five-year retention clock starts at the test date, not the violation date

49 CFR § 382.401 requires five-year retention for positive tests, refusals, and alcohol results of 0.02 or higher, starting from the test date itself. A driver who fails a test on September 18, 2026, and completes return-to-duty in December 2026 still keeps that file until September 18, 2031—not five years from the RTD test, not five years from today.

Negative pre-employment results and alcohol tests below 0.02 are kept one year only. Pre-employment history inquiry consent forms are kept three years. Collection and processing records are kept two years. Many small carriers purge files on calendar year instead of test-date anniversary, creating gaps that auditors find.

What the Custody and Control Form and MRO report actually contain

The CCF (five-part paper or electronic) is the legal chain of custody from collector to lab to Medical Review Officer. It documents who handled the specimen, when, where it went, and any irregularities. The MRO's written report to your Designated Employer Representative documents why any test was cancelled or confirms the verified positive. If there's a split-sample result (the driver requested the lab retest the same specimen at a different facility), that goes in the file too.

Auditors compare your local file to lab records and Clearinghouse entries to verify nothing is missing or mismatched. If your file has the CCF but you can't produce the MRO's report, that's incomplete. If you have the report but the signature doesn't match the MRO's records, that's a discrepancy.

A 50-driver carrier's typical pre-employment batch: what stays in the file

You hire 50 drivers in 2026. All 50 require pre-employment testing and history inquiry.

All 50 consent forms are retained until 2029 (three years from date of inquiry per § 40.333). All 50 negative pre-employment results expire one year from test date. Now add random and reasonable-suspicion tests: same one-year retention for negatives.

Then Smith fails a random test on June 10, 2026 (positive for methamphetamine). His positive test CCF and MRO report now stay in the file until June 10, 2031 (five years). He completes SAP evaluation and a return-to-duty test passes December 20, 2026. That RTD result is negative, so it expires December 20, 2027 (one year).

An auditor pulls Smith's file in 2028. They ask for:

1. The signed pre-employment consent (you produce it—dated 2026-03-15)
2. Your records of which prior employers you contacted (you produce the list and documentation of good-faith efforts)
3. The pre-employment test result (you produce it—dated 2026-03-20, negative, expires 2027-03-20—still valid in 2028, so no violation)
4. The positive test CCF and MRO report from June 2026 (you produce both—both required, both still valid until 2031)
5. The SAP evaluation report (you produce it—required, retained five years from date of SAP evaluation)
6. The RTD test result (you produce it—dated 2026-12-20, expires 2027-12-20—still valid in 2028)

If you can't find any of these in your local files within two business days, it's a citation. If you can only produce the Clearinghouse entry but not the actual CCF or MRO report from your own records, it's a violation.

Return-to-duty and SAP referral documentation: the second place auditors look for gaps

A verified positive, a refusal, or an alcohol result of 0.04 or higher triggers mandatory return-to-duty. The driver cannot work again until they complete an SAP (Substance Abuse Professional) evaluation. The SAP provides a written report directly to your DER, and that report is part of the driver's file and must be retained for five years. The SAP's report includes recommendations for education, treatment, or follow-up testing. Your proof that the driver completed those recommendations—certificates of completion, treatment facility records, follow-up test results—must be documented locally. The Clearinghouse shows that RTD testing occurred, but it does not show what the driver actually did to satisfy the SAP's recommendations.

Auditors ask to see the SAP report. If you say "the Clearinghouse shows he took a return-to-duty test," that's not enough. Where is the SAP's actual written report? If you don't have it, that's a finding. Where is the documentation that he completed the SAP's education requirement? If treatment was recommended and you have no certificate of completion, that's a violation. This is where many carriers get caught: they focus on the RTD test result and ignore the SAP paper trail.

Electronic storage is allowed, but it must be organized and accessible within two business days

§ 40.333 permits electronic filing if records are legible, organized, and easily retrievable. An FMCSA inspector's request requires production within two business days. Scattered PDFs, missing index, or no system for tracking who accessed which driver's records will cost you time and credibility.

A spreadsheet-based file tracker is audit gold. Driver name, test date, test type (pre-employment, random, post-accident, etc.), result (negative, positive, refusal, cancelled), file location (local folder, scanner ID, cloud storage path), MRO report on file (yes/no), SAP report on file (yes/no), expiration date. This takes 15 minutes to set up and saves you hours during an audit. Controlled access means you can prove who accessed which records and when. If you use cloud storage or a HRIS system with audit logs, those logs are themselves audit evidence. Do not grant every office manager access to every driver's file.

Confidentiality and driver access rights: what drivers can demand from your file

Drivers have a right to copies of their own test records upon written request. You cannot share one driver's results with another driver, and you cannot share a driver's results with another carrier without the driver's written consent. Violation of privacy can trigger regulatory action separate from recordkeeping failures.

Your file system must support quick, accurate retrieval and redaction. If a driver requests a copy of his file and you send it with another driver's test results included, you've violated privacy. If you refuse a driver's request or deliberately delay it, you've violated his rights. Keep a log of every driver-initiated records request and your response date. This protects you and proves good faith.