Drug Testing Compliance Guide for HR Professionals

by Stephanie July 17, 2026

TL;DR:

Workplace drug testing must comply fully with federal regulations, including DOT, SAMHSA, and OSHA standards. Proper policies, designated roles, chain-of-custody procedures, and annual audits help maintain legal compliance and prevent liabilities. Regular review and strict documentation are essential for programs to withstand scrutiny and support employee rights.

Drug testing compliance is defined as the structured process of conducting workplace substance screening in full accordance with federal regulations, including DOT 49 CFR Part 40, SAMHSA guidelines, and OSHA requirements. A step by step drug testing compliance guide gives compliance officers and HR professionals the exact framework to build, execute, and sustain a legally defensible program. Skipping any phase, whether policy drafting, chain-of-custody documentation, or Medical Review Officer verification, creates direct legal exposure. This guide covers every stage from program setup through ongoing audits, with the specificity your role demands.

What policies and prerequisites must be in place before testing?

A written policy is the legal foundation of every compliant employer drug testing workflow. DOT alcohol and drug testing programs require clear, comprehensive written policies that explicitly state purpose, scope, and testing circumstances. That requirement means your policy must name every test type: pre-employment, random, post-accident, reasonable suspicion, return-to-duty, and follow-up.

Roles every program requires

Two roles are non-negotiable under federal rules. The Designated Employer Representative (DER) is the internal point of contact authorized to receive test results and take immediate action. The Medical Review Officer (MRO) is a licensed physician who reviews all positive results before they reach the employer. DERs must maintain direct communication with collectors, laboratories, and service agents per federal protocols. Appointing both roles before the first test is collected protects the program from day one.

Supervisor training is equally critical. Supervisors must be able to identify reasonable suspicion, document observations accurately, and follow referral procedures without personal bias. Untrained supervisors are the most common source of program breakdowns in reasonable-suspicion cases.

Legal prerequisites checklist

Before any testing begins, confirm each of the following:

Written policy reviewed by legal counsel and distributed to all employees
Signed employee acknowledgment forms on file
ADA and state cannabis law review completed
HIPAA compliance procedures in place for record handling
DER and MRO formally designated and trained
Consent forms prepared for applicable test types

Drug testing programs must protect employee rights under the Americans with Disabilities Act and state cannabis laws, which adds real complexity to policy drafting. An MRO and a clear written policy together form the most effective defense against ADA non-compliance claims.

Pro Tip: Have your legal counsel review the policy annually, not just at launch. State cannabis laws changed in multiple jurisdictions in 2025 alone, and outdated policies create immediate liability.

Which specimen types and testing methods meet compliance standards?

Specimen selection determines detection windows, invasiveness, and regulatory acceptance. Urine is the most common specimen type in workplace drug testing, with a detection window of 1–3 days for many substances. It is also the only specimen type currently accepted for federally mandated DOT testing.

Specimen type	Detection window	Invasiveness	Primary use case
Urine	1–3 days	Low	Federal and most employer programs
Saliva	Up to 24 hours	Very low	Post-accident, reasonable suspicion
Hair	Up to 90 days	Low	Pre-employment, long-term history
Blood	Hours	High	Post-accident, legal proceedings
Breath (alcohol)	Minutes	None	DOT alcohol screening

Each specimen type serves a different compliance purpose. Hair testing covers a 90-day window, making it useful for pre-employment screening where long-term history matters. Saliva testing is non-invasive and detects very recent use, which makes it a strong fit for post-accident and reasonable-suspicion scenarios. The QuickScreen 10 Panel Saliva Drug Test from Countrywidetesting is one example of a rapid oral fluid option suited for workplace use.

Alcohol testing follows its own compliance path. DOT alcohol testing requires an initial screening by a certified Breath Alcohol Technician, and a confirmation test must follow within two hours if the initial result is positive. Results below 0.02% BAC are classified as negative under federal rules.

All collection procedures must follow chain-of-custody documentation regardless of specimen type. Collectors inspect specimens for adulteration or substitution and document every step. A single break in that chain can invalidate a result in a legal proceeding.

How do you execute the collection and analysis process?

The step by step employer drug screening process has six distinct phases. Each phase has specific compliance requirements that cannot be reordered or skipped.

Pre-collection preparation. Provide the employee with written instructions on the collection process. Verify identity with a government-issued photo ID. Complete the Federal Custody and Control Form (CCF) before any specimen is collected.
Specimen collection. Direct the employee to the collection site. The collector secures the area, checks the temperature of the specimen immediately after collection, and inspects for signs of adulteration or substitution. Every observation is recorded on the CCF.
Sealing and labeling. The employee watches the collector seal the specimen bottle and apply the tamper-evident label. Both parties sign the CCF. This step is the legal record of an unbroken chain of custody.
Laboratory analysis. The specimen ships to a SAMHSA-certified laboratory. The lab runs an initial immunoassay screen. Any non-negative result triggers a confirmatory GC-MS (gas chromatography-mass spectrometry) test.
MRO review. The MRO receives the confirmed positive result from the lab. The MRO contacts the employee directly to review any legitimate medical explanation, such as a valid prescription. MRO involvement prevents false positives from triggering ADA violations by giving employees a fair review before results reach the employer.
Result reporting and action. The MRO reports the final verified result to the DER. The DER takes the required action per the written policy, whether that is removal from a safety-sensitive position, referral to a Substance Abuse Professional (SAP), or return-to-duty testing.

Pro Tip: Keep a copy of every completed CCF in a secure, access-controlled file. Documentation gaps are the leading cause of failed regulatory audits. A drug testing compliance checklist reviewed at each collection event reduces errors significantly.

All drug and alcohol testing records must be kept confidential, shared only with authorized individuals per HIPAA and DOT privacy regulations. Build access controls into your recordkeeping system before the first test is run.

How do you maintain compliance through audits and ongoing monitoring?

A program that passes its first audit can still fail two years later. Compliance is not a one-time setup. Internal audits are crucial and often overlooked. Annual formal reviews of policy accuracy, documentation completeness, and vendor performance prevent non-compliance issues before a regulatory inspection finds them.

“Regular reviews identify gaps in testing protocols and documentation completeness before regulatory inspections. A proactive audit cycle is the single most effective tool for sustaining a compliant program year over year.”

Your annual audit should cover these areas:

Policy currency. Confirm the written policy reflects current federal rules and any state law changes.
Random selection integrity. Random selection must use scientifically valid methods and meet the annual test rate percentages set by federal authorities. Document every selection draw.
Vendor performance. Verify your collection sites and laboratory hold current certifications. SAMHSA, CAP, and CLIA certifications have renewal cycles that lapse without notice.
Recordkeeping completeness. Pull a sample of CCFs and verify every field is complete and signed. Incomplete forms are a common audit finding.
Training records. Confirm DER, supervisor, and collector training is current and documented.

A step-by-step drug screening workflow reviewed against your audit findings each year closes gaps before they become violations. Schedule the audit on a fixed calendar date so it never gets deferred.

Key Takeaways

A compliant workplace drug testing program requires written policy, designated roles, chain-of-custody collection, MRO verification, and annual internal audits working together as a single system.

Point	Details
Written policy is the foundation	Cover all six test types and distribute to every employee before testing begins.
DER and MRO are both required	Appoint and train both roles before collecting the first specimen.
Chain of custody cannot be broken	Document every collection step on the CCF and have both parties sign the seal.
MRO review prevents ADA violations	The MRO must contact the employee before any positive result reaches the employer.
Annual audits sustain compliance	Audit policy, vendor certifications, random selection records, and CCF completeness every year.

What I’ve learned from programs that actually hold up under scrutiny

Most compliance failures I’ve seen don’t happen at the collection site. They happen in the weeks before the first test, when leadership treats policy drafting as a checkbox rather than a legal document. A policy that doesn’t explicitly name every test circumstance, or that hasn’t been reviewed against current state cannabis law, is a liability waiting to surface.

The MRO is the most undervalued role in the entire program. HR teams often treat MRO review as a formality. It isn’t. The MRO is the reason a legitimate prescription doesn’t end a career, and the reason a positive result holds up in a termination hearing. Cutting corners on MRO selection, choosing the cheapest option without verifying credentials, is the kind of decision that costs far more later.

The programs that hold up under DOT or OSHA scrutiny share one trait: they treat the audit cycle as a management priority, not a compliance burden. The teams that schedule their annual audit in january and actually run it by march find problems early. The teams that defer it until a regulatory inspection forces the issue find problems at the worst possible time.

My advice is to build the audit into your compliance calendar the same way you build in random testing draws. Compliance is a system. Every part of it needs regular maintenance.

— Alan

How Countrywidetesting supports your compliance program

Compliance officers and HR professionals need a testing partner with certified laboratory infrastructure, not just a product catalog.

Countrywidetesting connects employers to laboratory drug testing services backed by SAMHSA, CLIA, CAP, and ISO-certified labs, covering urine, saliva, and multi-panel screening options. Whether you need lab-confirmed results for federal programs or rapid point-of-collection tools for reasonable-suspicion situations, Countrywidetesting provides compliant options built for HR and compliance teams. The platform supports both one-time orders and ongoing employer accounts, with educational resources to support your employer drug testing workflow at every stage.

FAQ

What is a Designated Employer Representative?

A Designated Employer Representative (DER) is the employer-appointed individual authorized to receive drug and alcohol test results and take immediate required action. The DER must maintain direct communication with collectors, laboratories, and service agents per federal DOT protocols.

How long must employers retain drug testing records?

Retention periods vary by test type and regulation. DOT rules require employers to retain verified positive results for five years and negative results for one year, with alcohol test records following similar timelines.

What does an MRO do with a positive result?

The MRO contacts the employee directly to review any legitimate medical explanation before reporting the result to the employer. This step protects employees from false positives and shields employers from ADA non-compliance claims.

Which specimen type is required for DOT-regulated testing?

Urine is the only specimen type currently accepted for federally mandated DOT drug testing. Other specimen types such as saliva or hair may be used for non-federally mandated employer programs.

How often must random drug testing pools be drawn?

Federal authorities set annual minimum test rate percentages that employers must meet. Each random selection draw must use a scientifically valid method, and employers must document every draw to demonstrate fairness and compliance during audits.