49 CFR § 40.349 - What records may a service agent receive and maintain?
(a) Except where otherwise specified in this part, as a service agent you may receive and maintain all records concerning DOT drug and alcohol testing programs, including positive, negative, and refusal to test individual test results. You do not need the employee's consent to receive and maintain these records.
(b) You may maintain all information needed for operating a drug/alcohol program (e.g., CCFs, ATFs, names of employees in random pools, random selection lists, copies of notices to employers of selected employees) on behalf of an employer.
(c) If a service agent originating drug or alcohol testing information, such as an MRO or BAT, sends the information directly to the DER, he or she may also provide the information simultaneously to you, as a C/TPA or other service agent who maintains this information for the employer.
(d) If you are serving as an intermediary in transmitting information that is required to be provided to the employer, you must ensure that it reaches the employer in the same time periods required elsewhere in this part.
(e) You must ensure that you can make available to the employer within two business days any information the employer is asked to produce by a DOT agency representative.
(f) On request of an employer, you must, at any time on the request of an employer, transfer immediately all records pertaining to the employer and its employees to the employer or to any other service agent the employer designates. You must carry out this transfer as soon as the employer requests it. You are not required to obtain employee consent for this transfer. You must not charge more than your reasonable administrative costs for conducting this transfer. You may not charge a fee for the release of these records.
(g) If you are planning to go out of business or your organization will be bought by or merged with another organization, you must immediately notify all employers and offer to transfer all records pertaining to the employer and its employees to the employer or to any other service agent the employer designates. You must carry out this transfer as soon as the employer requests it. You are not required to obtain employee consent for this transfer. You must not charge more than your reasonable administrative costs for conducting this transfer. You may not charge a fee for the release of these records.