What Confidentiality Rules Apply to a C/TPA?

Under 49 CFR 40.351(a), a service agent such as a C/TPA that receives or maintains confidential information about employees, such as individual test results, must follow the same confidentiality regulations as the employer for the use and release of that information. Section 40.351(b) adds that it must follow all confidentiality and records retention requirements that apply to employers.

Under 40.351(c), a C/TPA "may not provide individual test results or other confidential information to another employer without a specific, written consent from the employee." The rule gives the example of a C/TPA that serves two employers. When an employee of one employer applies to work for the other, the C/TPA may not tell the second employer about the first employer's test results without the employee's specific written consent. Under 40.351(d), a service agent must not use blanket consent forms.

Section 40.351(e) requires adequate confidentiality and security measures to keep confidential employee records from unauthorized persons, including physical security of records, access controls and computer security for electronic databases.

Release of results is also covered in Who Can Receive an Employee's DOT Drug Test Results?.

A listing in the MyDrugTesting.com directory is not an endorsement of the provider.