Does an MRO Need an Employee's Consent to Share Medical Information?

Generally yes, with exceptions set out in Part 40. Under 49 CFR 40.321, service agents, including MROs, are prohibited from releasing individual test results or medical information about an employee to third parties without the employee's specific written consent, except as Part 40 provides. Under 49 CFR 40.327(a), the MRO must report drug test results and medical information learned during verification to third parties without the employee's consent if, in the MRO's reasonable medical judgment, the information is likely to result in the employee being found medically unqualified under an applicable DOT agency regulation, or indicates that continued performance of safety-sensitive functions is likely to pose a significant safety risk.

Under 40.327(b), the third parties who may receive this information include the employer, a physician or other health care provider responsible for determining the employee's medical qualifications under a DOT agency safety regulation, a Substance Abuse Professional (SAP) evaluating the employee in the return-to-duty process, a DOT agency, and the National Transportation Safety Board in the course of an accident investigation.

Under 40.327(c), the MRO must not report this information on the Federal Drug Testing Custody and Control Form (CCF). It goes in a separate written communication, such as a letter or secure email, which must state the specific nature of the MRO's safety concern. The rule's examples are the effects of a medication the employee is taking and an underlying medical condition the employee disclosed to the MRO. Under 40.327(d), an MRO may comply with the law of a foreign country, such as Canada, that prohibits giving medical information to the employer.

Under 49 CFR 40.135(d), the MRO must warn the employee about these reporting duties before obtaining any medical information during verification. Under 40.135(e), the MRO must also tell the employee that, before informing a third party about a medication used under a legally valid prescription, the MRO will allow 5 business days from reporting the verified negative result for the prescribing physician to contact the MRO about whether the medication can be changed.

Recipients of test results are covered in Who Can Receive an Employee's DOT Drug Test Results?. Prescription reviews are covered in Can a Prescription Explain a Positive DOT Drug Test?, and MRO review of negative results in Does an MRO Review Negative DOT Drug Test Results?.

MyDrugTesting.com listings show a provider's category and address, not test results or medical information.