49 CFR 199.23
Recordkeeping.
(a) Each operator shall keep the following records for the periods specified and permit access to the records as provided by paragraph (b) of this section:
(1) Records that demonstrate the collection process conforms to this part must be kept for at least 3 years.
(2) Records of employee drug test results that show employees who had a positive test, and the type of test (e.g., post-accident), and records that demonstrate rehabilitation, if any, must be kept for at least 5 years, and include the following information:
(i) The function performed by each employee who had a positive drug test result.
(ii) The prohibited drug(s) that were used by an employee who had a positive drug test.
(iii) The disposition of each employee who had a positive drug test or refused a drug test (e.g., termination, rehabilitation, removed from covered function, other).
(3) Records of employee drug test results that show employees passed a drug test must be kept for at least 1 year.
(4) A record of the number of employees tested, by type of test (e.g., post-accident), must be kept for at least 5 years.
(5) Records confirming that supervisors and employees have been trained as required by this part must be kept for at least 3 years.
(b) Information regarding an individual's drug testing results or rehabilitation may be released only upon the written consent of the individual, except that such information must be released regardless of consent to the Administrator or the representative of a state agency upon request as part of an accident investigation. Statistical data related to drug testing and rehabilitation that is not name-specific and training records must be made available to the Administrator or the representative of a state agency upon request.
[53 FR 47096, Nov. 21, 1988, as amended at 58 FR 68260, Dec. 23, 1993]