Employer Drug Testing — Frequently Asked Questions

Yes. We handle PEth blood testing, breath alcohol testing, and DOT drug screening for pilots enrolled in FAA HIMS(Human Intervention Motivational Study) monitoring programs. HIMS monitoring testing is separate from an employer's standard DOT random program — it is ordered by the pilot's HIMS AME or Independent Medical Sponsor and results route to the FAA medical certification pathway. We understand the documentation and chain of custody requirements for each track and handle them accordingly. Pilots and HIMS AMEs in the Chicago area can contact us directly to coordinate scheduling and specimen routing.

Yes — for most employers and most roles. Federal rescheduling from Schedule I to Schedule III affects the Controlled Substances Act classification, but it does not change your rights as an employer. Drug-free workplace policies that include THC remain legally enforceable in the vast majority of states and industries, including all DOT-regulated safety-sensitive positions.

What rescheduling does not do: it does not legalize recreational marijuana at the federal level, it does not override DOT rules, and it does not require employers to accommodate cannabis use. DOT issued guidance reaffirming that marijuana remains prohibited for safety-sensitive functions regardless of state laws or federal scheduling status.

What has changed — and what you need to check — is state law. Several states now restrict pre-employment testing for THC in non-safety-sensitive roles, or require employers to demonstrate current impairment rather than past use. Illinois, California, New York, New Jersey, Washington, and Minnesota are among the states with active limitations on employer THC testing. If you operate across multiple states, your policy needs to account for each one. A flat national policy works in some contexts but creates legal exposure in others.

Bottom line for hiring: talk to your employment counsel about your state's current rules before removing THC from your panel — or before leaving it on. The answer is almost never one-size-fits-all.

See our employer guide to marijuana and THC testing for state-level context.

Yes. That is one of the most misunderstood things about workplace THC testing. Standard urine drug screens detect metabolites — byproducts your body produces as it processes THC. Those metabolites can stay detectable in urine for days to weeks depending on frequency of use, body composition, and the test's cutoff level. The test does not tell you whether someone was impaired on the job or impaired at the time of collection. It tells you whether their body has processed THC recently.

This creates a real tension for employers: you may get a positive result from someone who used legally, in their own time, weeks ago — and who was not impaired at work at any point. Some states have tried to address this by restricting pre-employment testing or requiring current-impairment evidence. Oral fluid testing closes the window somewhat (detection typically within hours to a day or two rather than weeks), which is why some employers in cannabis-legal states are shifting to oral fluid for non-DOT programs.

For DOT-regulated positions: it does not matter. A verified positive is a verified positive. Prior legal use, medical cards, and state law are not defenses under FMCSA or other DOT modal agency rules.

Not automatically, and not in most cases. State recreational or medical marijuana laws do not require employers to stop testing for THC or to change what happens when someone tests positive. What some states do restrict is the employment action you can take based solely on a pre-employment positive for THC — particularly for non-safety-sensitive roles.

Examples worth knowing: California's AB 2188 restricts pre-employment discipline based on non-psychoactive THC metabolites (carboxy-THC) but permits testing for psychoactive metabolites and permits testing of safety-sensitive positions. New Jersey, New York, and Minnesota have similar nuances. Illinois has one of the more employer-friendly frameworks in a legal state: employers can still maintain a drug-free workplace and take action on a positive screen.

If you run a DOT-regulated program, there is no state carveout — federal rules control, and THC stays in the required panel. If you run a non-DOT program and you have employees in multiple states, the safest path is a state-specific policy addendum reviewed by employment counsel rather than a single blanket policy.

See our state-by-state marijuana and THC testing guide for employer context.

These three terms describe different points in the same process, and confusing them causes real problems for employers.

Non-negative: the initial lab screening came back reactive for a substance above the cutoff. This is not a final result. Labs are required to run a confirmation test (GC-MS) before reporting any positive. You do not take employment action on a non-negative screen result.

Positive (confirmed): the confirmation test verified the presence of the substance. For DOT specimens, this goes to the MRO before the employer ever sees a result. For non-DOT specimens, MRO review is optional but strongly recommended.

Verified positive: the MRO has reviewed the confirmed positive, spoken with the donor (to rule out a legitimate medical explanation), and issued a final verified positive to the employer or TPA. This is the result on which employment action is appropriate.

The step employers most often skip is waiting for MRO verification before acting. Taking action on a non-negative or a confirmed-but-not-verified result creates legal exposure. Let the process finish.

Read our employer decision guide after a non-negative result for the full pipeline.

A dilute specimen is one where the creatinine and specific gravity fall within ranges that suggest the sample was diluted — either by drinking excessive fluids before the test or, in some cases, by adding water to the sample. Labs flag dilutes as either 'negative dilute' or 'positive dilute.'

Negative dilute means the confirmation came back negative, but the specimen was too dilute to be a reliable result. DOT has a defined protocol for this: employers may — but are not required to — request an immediate recollection under direct observation. Your written policy should state what your company does with negative dilutes so the decision is not made case-by-case.

Positive dilute means the specimen was dilute and still came back positive. DOT protocol treats this as a positive. The MRO reports it verified positive.

What you cannot do: tell a donor in advance that a dilute will trigger a retest. That defeats the purpose. Your policy should document your dilute protocol, and supervisors should apply it consistently regardless of which employee is involved.

Under DOT rules, yes — a refusal to test carries the same consequences as a verified positive. The donor is immediately removed from safety-sensitive duties, and the violation must be reported to the FMCSA Clearinghouse.

What counts as a refusal goes beyond simply saying 'no.' DOT defines refusal to include: failing to appear for a collection within a reasonable time, leaving the collection site before the process is complete, refusing to empty pockets when asked, failing to provide a sufficient specimen without a valid medical explanation (shy bladder protocol applies here), tampering with the specimen, and providing a specimen that comes back adulterated or substituted.

For non-DOT programs, your written policy defines what constitutes refusal and what the employment consequence is. The policy needs to be clear and consistently applied. A refusal that is handled differently for different employees creates discrimination risk.

For DOT-covered testing: the MRO reports verified results to the DER (Designated Employer Representative). That is a specific role, not just anyone in management. The Clearinghouse receives violation results. The employee's direct supervisor should not be receiving raw results.

For non-DOT programs: the employer designates who receives results — typically someone in HR or a specific TPA contact. Results should not flow to hiring managers, direct supervisors, or anyone outside the designated recipient chain unless there is a defined business reason and your policy documents it.

Why this matters: drug test results are treated as confidential medical-adjacent information. Employees have reasonable expectations that their test outcome will not be discussed outside the process. SAMHSA guidance, state privacy laws, and ADA considerations all point to need-to-know access as the appropriate standard. Document who your designated result recipient is. Keep results in a separate, secure file — not in the general personnel file in most cases.

Yes, and not just as a best practice — in many states and under DOT regulations, a written policy is a requirement, not a nicety. DOT 49 CFR Part 40 requires covered employers to have a written policy explaining the testing program, prohibited conduct, and consequences. Many state drug-free workplace laws (which may offer premium discounts or other benefits) also require a written, distributed policy.

More practically: without a written policy, you cannot enforce consequences consistently. If one employee is terminated for a positive test and another is sent to an EAP for the same result, the difference needs to be explained by the policy — not by who the supervisor liked better. Inconsistent enforcement is one of the most common drivers of employment claims after a drug test.

Your policy should cover at minimum: the testing reasons (pre-employment, random, post-accident, reasonable suspicion, return-to-duty), which positions are covered, what substances are tested, what the consequences are for a positive, refusal, or dilute, and how results are handled confidentially. Get it in writing, get employee signatures acknowledging receipt, and review it when state law changes.

See what a drug-free workplace policy should include before your first collection.

Multistate testing programs are where most employer compliance problems originate. The federal baseline — DOT rules, ADA, Title VII — applies everywhere. But state law adds a layer of requirements and restrictions that varies significantly, and in some cases changes how and when you can test, what you can do with the result, and what accommodations you may need to offer.

Key pressure points to review by state: (1) Pre-employment testing — several states restrict testing for THC specifically, or require conditional offers before testing. (2) Random testing for non-regulated employees — some states limit or prohibit random testing outside of safety-sensitive, regulated, or federal-contract contexts. (3) Medical marijuana accommodations — states like New York, New Jersey, Arizona, and others have varying requirements around how employers handle employees with medical marijuana certifications. (4) Off-duty conduct protections — some states restrict employer action based on legal off-duty activity. (5) Positive test consequences — a handful of states limit termination for a first positive if the employee agrees to rehabilitation.

The honest answer is that a national policy with state-specific addenda reviewed by local employment counsel is the only reliable approach. A policy drafted for Illinois may create legal exposure in California or Pennsylvania. Review it before you expand to a new state, not after the first lawsuit.

It depends on the substance and the program. For DOT testing: the MRO contacts the donor after a confirmed positive and gives them an opportunity to provide documentation of a valid prescription. If the MRO determines the prescription is legitimate and the drug is being used as prescribed, the result can be reported as negative (or in some cases, cancelled). However — and this is important — certain medications are disqualifying for safety-sensitive DOT positions regardless of prescription status. A valid prescription for methadone, for example, does not automatically clear a CDL driver.

For non-DOT programs: there is no regulatory requirement for MRO review, but it is strongly recommended for exactly this reason. Without MRO review, employers can end up taking action on a positive that would have been explained by a legitimate prescription — creating ADA exposure if the underlying condition is a disability.

What employers should not do: ask applicants or employees to disclose prescription medications before the test. That creates a risk of learning about protected medical conditions before a conditional offer is made. Let the MRO handle the prescription conversation after the result, not HR before the test.

Learn more about the MRO's role in DOT testing.

Yes, and this comes up more than employers expect. CBD products are not federally regulated for purity or labeling accuracy, and some contain more THC than the label indicates. Standard urine drug tests detect THC metabolites — they do not distinguish between THC from hemp-derived CBD, recreational marijuana, or medical marijuana. A donor who uses CBD products, particularly full-spectrum products, can produce a urine result above the cutoff.

From an employer and MRO standpoint: CBD is not a valid medical explanation for a positive THC result. The MRO cannot verify the THC source, and the positive stands. Some donors argue CBD was the cause, but labs have no way to confirm that, and the MRO cannot report negative based on a CBD explanation alone.

The practical implication for employers: employees and applicants using CBD products should understand that those products can generate a positive drug test. If you communicate your drug testing policy to employees (which you should), it is reasonable to include a note that CBD products do not provide a defense against a positive THC result.

Yes, if you employ CDL drivers in FMCSA-regulated commerce. The Clearinghouse is a federal database — mandatory since January 2020 — that tracks drug and alcohol program violations for commercial motor vehicle operators. Before a driver performs any safety-sensitive function for you, you are required to run a pre-employment full query. Annually, you must run a limited query (or full query if consent is on file) for every current driver.

The Clearinghouse also requires employers to report violations: verified positive test results, refusals to test, and return-to-duty status once a driver completes the SAP/RTD process. This is not optional and not delegatable to the driver — the employer (or C/TPA acting on the employer's behalf) must report violations within two business days.

Common mistakes: running only the limited annual query and missing a violation because the driver has not provided electronic consent for a full query; not reporting your own violations because you assumed the MRO or lab handles that; and not querying before putting a rehire back in a safety-sensitive seat.

Read our FMCSA Clearinghouse employer guide for registration and query steps.

A full query returns all violation information in the Clearinghouse for that driver. It requires the driver's electronic consent. You must run a full query before hiring or using a CDL driver for the first time — no exceptions.

A limited query returns only whether a violation record exists (yes or no), without the details. It does not require electronic consent. It satisfies the annual query requirement if you have an ongoing consent arrangement with the driver. If the limited query comes back with a record, you must then run a full query (which does require consent) to see the details before the driver continues in safety-sensitive duty.

The practical issue: if a driver refuses to provide consent for a full query, FMCSA treats that refusal as a violation. You cannot proceed with the hire or continue the driver in safety-sensitive work.

Yes. Owner-operators who drive their own CMV in FMCSA-regulated commerce are subject to Clearinghouse requirements just like any other covered employer. Because an owner-operator is both the employer and the covered employee, they must register in the Clearinghouse, designate a C/TPA (or themselves, where permitted) to conduct queries, and comply with all pre-employment and annual query requirements — including querying themselves.

In practice, most owner-operators handle Clearinghouse obligations through their consortium or C/TPA. The consortium keeps track of query deadlines and assists with reporting. If you are operating without a C/TPA and managing your own Clearinghouse account, make sure you have a system for the annual self-query and for reporting any violations that occur.

See our owner-operator DOT compliance guide for consortium and Clearinghouse basics.

If you are an owner-operator with no employees, yes — FMCSA requires you to participate in a consortium for random testing. An owner-operator cannot be their own random pool; there is no valid way to randomly select yourself if you are the only person in the pool.

If you have two or more covered employees, you can manage your own random testing program without a consortium — but most small fleets use a C/TPA (consortium/third-party administrator) anyway because they handle pool management, random selections, Clearinghouse queries, and record retention. The administrative burden of doing it in-house is rarely worth it below 20-30 covered employees.

What a consortium does not replace: your obligations as the employer. You are still responsible for making sure the collection happens, for DER response when someone is selected, for keeping the required records, and for Clearinghouse reporting. The C/TPA handles logistics; you own the compliance.

OnSite can enroll you in a DOT consortium and act as your C/TPA — see DOT Consortium & C/TPA services.

Yes. OnSite Employer Testing is a registered FMCSA Drug and Alcohol Clearinghouse C/TPA. We can enroll your drivers in a DOT consortium random pool and manage Clearinghouse queries and reporting.

Start here: DOT Consortium & C/TPA services.

These windows matter — missing them turns a required test into a documentation problem and potentially a violation.

Alcohol testing: must be completed within two hours of the accident. If not completed within two hours, document why. If not completed within eight hours, stop attempting and document. Do not test after eight hours.

Drug testing: must be completed as soon as possible. If not completed within 32 hours, stop attempting and document why. Document every attempt made during those 32 hours.

These are not suggestions — FMCSA auditors look specifically at post-accident test completion and documentation. A missed window without documentation is a recordkeeping violation. A missed window with documentation is at least defensible.

What triggers the requirement: a CMV accident that involves a fatality, a citation for a moving traffic violation and a bodily injury requiring medical treatment away from the scene, or a citation for a moving traffic violation and a vehicle being towed. If none of those apply, you still have the right to test under a non-DOT reasonable suspicion or post-incident policy — but the DOT-mandatory test is tied to those specific triggers.

See DOT post-accident testing rules for employers for trigger detail.

Before a new CDL driver performs any safety-sensitive function, FMCSA requires you to obtain drug and alcohol testing history from every DOT-regulated employer the driver worked for in the past three years. This is separate from the Clearinghouse query — it covers the period before the Clearinghouse was fully operational and any information that may not yet be in the Clearinghouse.

The process: you send a written request to previous employers asking for the driver's DOT drug and alcohol test history, including positive results, refusals, and whether the driver was in the return-to-duty process when they left. Previous employers have 30 days to respond. You keep the response — or a record of non-response — in the driver's qualification file.

Common mistake: assuming the Clearinghouse covers this entirely. The Clearinghouse only goes back to January 2020 and only includes violations that were reported. Prior employer checks capture violations that predate the Clearinghouse or were not properly reported. Both steps are required.

DOT recordkeeping requirements are specific and auditors know exactly what to look for. Here is the retention minimum by record type:

Five years: alcohol test results above 0.02, verified positive drug test results, refusals to test, documentation of pre-employment queries, SAP evaluations, and follow-up testing records.

Two years: records related to the random selection process and random test results (negative).

One year: negative and cancelled drug test results and alcohol results below 0.02.

Indefinite: the employer's written testing policy.

Additionally, keep copies of all Clearinghouse queries, all prior employer history request records, and all chain-of-custody forms. Auditors often request random selection documentation, CCFs for tests conducted in the period under review, and evidence that the annual random rate was met. A missing CCF or a gap in random selection records is a common audit finding. Keep everything in a separate, secured file — not commingled with the general personnel file.

Read our DOT recordkeeping and audit prep guide for organization tips.

It can — if the policy is written or applied in a way that looks retaliatory or discourages injury reporting. OSHA's 2016 recordkeeping rule clarified that blanket post-incident drug testing (testing everyone involved in any workplace incident regardless of whether drug or alcohol use could have contributed) may violate anti-retaliation provisions if it is used to discourage employees from reporting injuries.

What OSHA actually looks for: whether the employer has a legitimate, safety-based reason to believe substance use may have contributed to the incident before ordering the test. A slip-and-fall on a wet floor is a different situation than an equipment operation incident where impairment is a plausible contributing factor.

What protects you: a written policy with defined, objective triggers for post-incident testing. If your policy says 'we test after incidents involving lost-time injury, property damage above $X, or near-misses involving powered equipment,' you have a defined safety rationale. If your policy says 'we test after any workplace injury,' OSHA may view that as a mechanism to suppress injury reporting.

For DOT employers: the FMCSA post-accident testing triggers are federal and comply with the underlying safety rationale. Following those triggers with documentation does not create an OSHA problem.