Build a compliant FMCSA drug-and-alcohol recordkeeping system with the correct one-, two-, three- and five-year retention periods, controlled access, driver requests and release rules.
Recordkeeping is part of the testing program
A compliant DOT testing program does not end when a laboratory or breath-alcohol technician reports a result. Employers covered by 49 CFR Part 382 must preserve specified testing, collection, training, policy and program-administration records. The files must be secure, available when lawfully requested and retained for the period assigned to each record type.
Use Part 382 and Part 40 together
Part 382 contains the FMCSA-specific record schedule for commercial drivers, while Part 40 supplies DOT-wide requirements for test records, confidentiality, releases and service agents. A carrier should classify a record under both rules before setting a destruction date. When obligations overlap, do not discard a record merely because the shorter period in one provision has passed.
Five years covers the highest-risk FMCSA records
Section 382.401 requires at least five years for alcohol results of 0.02 or greater, verified positive drug results, refusals, driver evaluations and referrals, evidential-breath-testing calibration documentation, records of Part 382 violations, program-administration records and required annual calendar-year summaries.
SAP and follow-up records also carry a five-year minimum
Part 40 requires five-year retention for substance abuse professional reports and every follow-up test and follow-up testing schedule. Store the SAP plan where authorized program staff can execute it without exposing its timing to the driver. A return-to-duty result does not end the follow-up record obligation.
Prior-employer information has a three-year Part 40 period
Information obtained from previous employers under 49 CFR 40.25 concerning an employee's drug and alcohol test results must be kept for three years. Keep the request, consent or authorization process and the response together so the file shows what information was sought, what was received and when.
Collection-process records generally stay for two years
Part 382 requires a minimum two years for records related to the alcohol and controlled-substances collection process, except the separately listed evidential-breath-testing calibration documentation. Examples include collection logbooks if used, random-selection documents, reasonable-suspicion decision records, post-accident testing decision records and medical documentation for an inability to provide a sufficient specimen.
Negative and cancelled results generally stay for one year
The FMCSA schedule requires one year for negative and cancelled controlled-substances results, an MRO reversal of a cancelled controlled-substances result, and alcohol results below 0.02. Part 40 likewise assigns one year to negative and cancelled drug results and alcohol results below 0.02.
Training records use a role-based clock
Records related to the education and training of breath-alcohol technicians, screening-test technicians, supervisors and drivers must be maintained while the individual performs the function requiring that training and for two years after the individual stops performing it. That is not a simple two-year clock beginning on the training date.
Know which documents belong in the collection file
Part 382 identifies random-pool selection records, alcohol and drug testing forms, chain-of-custody forms, MRO communications, refusal records, documents offered to dispute a result, reasonable-suspicion decisions and post-accident decisions. Keeping only the final result can leave the carrier unable to demonstrate why and how the test occurred.
Administrative records deserve their own index
The rule lists agreements with collection sites, laboratories, technicians, MROs, consortia and third-party administrators; the names and roles of program officials; required laboratory summaries; and the employer's testing policy and procedures. Maintain a current vendor and responsibility index so an auditor can trace each part of the program.
Secure location and controlled access are mandatory
Sections 382.401 and 40.333 require controlled access. Limit permissions to people who administer the program or have another lawful need, use individual accounts, protect paper files, log sensitive exports and remove access promptly when duties change. A shared dispatch folder or unrestricted personnel drive is not an appropriate home for individual results.
A service agent may store records, but the employer remains responsible
Part 40 permits a service agent to maintain testing records for an employer. The employer must still ensure the records can be produced at its principal place of business within the FMCSA deadline. Contracts should address access, export format, retention, incident response and transfer of records if the vendor relationship ends.
FMCSA records must be produced within two business days
Under section 382.401, required records must be maintained as specified in section 390.29 and made available at the employer's principal place of business within two business days after an authorized FMCSA representative requests them. Remote vendor storage is therefore useful only when retrieval is dependable.
Drivers can request their own records in writing
Section 382.405 gives a driver the right, upon written request, to obtain copies of records about the driver's alcohol or controlled-substances use and testing. The employer must provide the requested records promptly. Access may not be conditioned on payment for records other than those specifically requested.
A subsequent employer needs the driver's written request
A carrier must make records available to a subsequent employer after receiving a written request from the driver. The recipient may disclose the information only as authorized by the request. Keep the driver's request with the disclosure log and release only the information within its scope.
Third-party disclosure usually needs specific written consent
Part 40 generally bars an employer or service agent from releasing an individual's test results or medical information to a third party without the employee's specific written consent, unless another rule expressly permits or requires the release. The consent must identify the particular information, recipient and time; blanket releases covering categories of information or future employers are prohibited.
Regulators and specified proceedings have separate access rules
Employers and service agents must provide required program information to DOT agencies and authorized state or local regulators. Section 382.405 also addresses NTSB crash investigations and disclosures in certain lawsuits, grievances or administrative proceedings. Do not treat those defined exceptions as general permission to circulate records.
Clearinghouse reports do not replace the underlying files
Required Clearinghouse queries and reports are one part of FMCSA compliance. They do not eliminate the employer's duty to retain alcohol testing forms, custody-and-control forms, MRO communications, refusal documents, SAP materials, follow-up records or the decision records that support a particular test.
Use a retention matrix and destruction hold
Assign every record a category, driver, test reason, event date, minimum destruction date, location, owner and access group. Apply a hold when litigation, a grievance, an audit, an investigation or another legal requirement calls for preservation beyond the normal schedule. Destroy only after both the retention period and every hold have ended, using a secure method.
Audit retrieval, not just storage
Quarterly or periodic quality checks should sample each major category, confirm the record is readable, verify access permissions, reconcile vendor inventories and test whether a complete file can be produced inside two business days. Fix misclassified, missing or duplicate records before an inspection or driver request exposes the gap.
Use current rules for each real case
State privacy and employment laws, collective-bargaining terms, litigation duties and other DOT modes can add requirements. This guide is an educational FMCSA framework, not legal advice. For a specific release, dispute or destruction decision, use the current regulation, the carrier's authorized compliance process and qualified advice.
Continue with CDL Truck Pro
Official sources
49 CFR 382.401: FMCSA retention schedule49 CFR 382.405: Access and release of records49 CFR 40.333: DOT employer record requirements49 CFR 40.321: Confidentiality and specific written consentCDL Truck Pro provides educational information. Confirm licensing, safety, tax, and regulatory requirements through current official sources and qualified professionals.