If you operate even a single commercial motor vehicle with a CDL driver, 49 CFR Part 382 applies to you. Records retention is one of the most audited — and most misunderstood — areas of DOT drug and alcohol compliance. Getting it wrong is not a paperwork technicality. It is a federal violation that can shut down your operation.

This guide gives you a precise, actionable breakdown of what records to keep, how long to keep them, where to store them, and what the 2026 regulatory landscape means for your fleet. For the broader DOT drug and alcohol testing framework, see our guide on DOT drug and alcohol testing requirements for small fleets.

What Does 49 CFR 382.401 Actually Require?

49 CFR 382.401 requires every employer subject to Part 382 to maintain records of their alcohol and controlled substances testing program. Records must be kept in a secure location with controlled access, and must be made available to the FMCSA, DOT, or any state or local officials with regulatory authority upon request.

The regulation divides records into five categories, each with its own retention period. Understanding those categories is the foundation of a defensible recordkeeping program.

The Five Record Categories Under 49 CFR 382.401

What Records Do I Need to Keep for a Positive DOT Drug Test?

A positive DOT drug test triggers a 5-year retention requirement covering the MRO's verified positive report, any split specimen documentation, the driver's removal from safety-sensitive duty record, and all SAP evaluation and follow-up testing records. These documents form a chain of compliance that FMCSA auditors will reconstruct during an investigation.

Specifically, you must retain:

• The MRO verified positive result report (including the specific substance detected)
• Documentation of the driver's immediate removal from safety-sensitive function
• The SAP written evaluation and treatment or education referral
• The return-to-duty negative test result authorized by the SAP
• The follow-up testing schedule (minimum 6 unannounced tests in first 12 months per 49 CFR 382.605)
• Any split specimen retest documentation under 49 CFR Part 40 Subpart F

For a full breakdown of your obligations after a failed test, review our article on SAP return-to-duty employer obligations after a failed drug test.

Where Must DOT Drug and Alcohol Testing Records Be Stored?

Records must be stored in a secure location with controlled access per 49 CFR 382.401(b). This means a locked cabinet, a password-protected system, or a compliant third-party administrator (C/TPA) platform. Access must be limited to those with a legitimate need, and confidentiality must be maintained consistent with 49 CFR 382.405.

Key storage requirements include:

• Physical records: Locked, fireproof storage with access log preferred
• Electronic records: Must be tamper-evident, backed up, and retrievable within a reasonable timeframe for audit
• Third-party storage: C/TPAs may hold records on your behalf, but you remain legally responsible for their accuracy and availability
• Disclosure restrictions: Records may only be released with written driver consent, to the MRO, SAP, or authorized federal/state officials per 49 CFR 382.405

What Happens During a DOT Post-Accident Test — What Records Does That Generate?

A DOT post-accident test under 49 CFR 382.303 generates several records that must be retained under the 5-year rule if results are positive or there is a refusal. Even if results are negative, the accident documentation, decision rationale, and test chain-of-custody forms must be kept for at least 1 year.

Post-accident testing triggers records including the accident report, the employer's written decision about whether testing was required, the chain-of-custody form (CCF), and the MRO result. For a step-by-step decision guide, see our DOT post-accident drug test decision tree for trucking.

How Does the FMCSA Drug and Alcohol Clearinghouse Affect My Records Retention?

The FMCSA Drug and Alcohol Clearinghouse (established under 49 CFR Part 382 Subpart G) does not replace your internal records retention obligations — it supplements them. Employers must still maintain physical or digital records per 382.401 even though violations are also reported to and stored in the Clearinghouse.

Clearinghouse records of violations remain accessible for 5 years or until the driver completes the RTD process, whichever is later. Employers must run annual limited queries on all current CDL drivers and a full query before hiring. See our full breakdown of FMCSA Clearinghouse limited vs. full query requirements.

Important: if your records and Clearinghouse data conflict during an audit, FMCSA will investigate both. Keep them consistent.

What Is New in 2026 for DOT Drug and Alcohol Records Retention?

Several clarifications and enforcement trends took effect or gained momentum in 2026 that small fleet operators must understand. None of these alter the core retention periods, but they change how compliance is verified and what auditors look for.

• Electronic recordkeeping guidance: FMCSA's 2025-2026 guidance updates confirm that electronic records are acceptable if they meet audit-trail and tamper-evidence standards. Paper alone is no longer the default expectation.
• Clearinghouse cross-referencing: Auditors now routinely cross-reference employer retained records against Clearinghouse data. Discrepancies trigger expanded investigations.
• Oral fluid testing rollout: DOT's final rule permitting oral fluid drug testing (published May 2023, phased implementation through 2025-2026) means employers must now understand which chain-of-custody forms apply to oral fluid specimens and retain them under the same 49 CFR 382.401 schedule.
• Increased audit frequency for small fleets: FMCSA's 2026 Safety Measurement System (SMS) prioritization continues to flag small carriers with incomplete testing records for compliance reviews.
• Penalty inflation adjustments: Civil monetary penalties for recordkeeping violations remain up to $1,584 per day with a maximum of $15,846 per violation, and falsification of records carries up to $15,846 per instance under current FMCSA tables.

What Are the Penalties for DOT Drug Testing Recordkeeping Violations?

Recordkeeping failures under 49 CFR 382.401 are treated as independent violations separate from any underlying testing failure. FMCSA can assess civil penalties even if your drivers have never tested positive — incomplete or missing records alone are sufficient for a violation finding.

How Do I Build a Compliant DOT Drug Testing Records Retention System for a Small Fleet?

Small fleets — those operating under 20 trucks — often lack dedicated HR staff, which makes a structured retention system even more critical. A system does not need to be expensive, but it must be deliberate, documented, and auditable.

1. Categorize records at the point of creation — label each document with the driver name, test date, test type, and required retention date before filing.
2. Use a C/TPA with documented retention capabilities — verify contractually that they retain records per 49 CFR 382.401 and will provide copies on demand.
3. Maintain a master log — a simple spreadsheet or HR platform entry tracking every test event, result category, and retention expiration date.
4. Conduct an annual internal audit — review records every 12 months to identify gaps before FMCSA does. See our DOT recordkeeping retention schedule for trucking fleets for an audit-ready checklist.
5. Set calendar alerts for destruction dates — records must not be destroyed before the retention period expires. Premature destruction is itself a violation.
6. Train the person responsible — if you handle HR yourself, document that you completed review of 49 CFR 382.401 and your retention system. This creates a defensible record.

Trucking HR compliance — including DOT recordkeeping — is one of the core functions automated through HRForge's trucking HR compliance platform, purpose-built for small and mid-size fleets.

Frequently Asked Questions

Q: Does 49 CFR 382.401 apply to owner-operators?

Yes. Owner-operators who operate under their own DOT authority and employ themselves as CDL drivers are subject to 49 CFR Part 382, including records retention. They must enroll in a DOT-compliant random testing consortium and retain all applicable records per 382.401, even if they are the only driver in their operation.

Q: Can I store DOT drug testing records in the cloud?

Yes, cloud storage is permitted under 49 CFR 382.401 as long as the system is tamper-evident, access-controlled, and capable of producing records promptly during an audit. You should be able to demonstrate who accessed records and when. Consult with your C/TPA or legal counsel to verify your specific platform meets FMCSA's electronic recordkeeping expectations.

Q: What happens if a driver leaves my company — do I still have to keep their records?

Yes. The retention clock runs from the date the record was created, not from the date of employment termination. A positive test result from a driver who left your fleet yesterday must still be retained for 5 years from the test date. Former employee records must be stored with the same security and confidentiality requirements as active employee records.

Q: Do I have to give drivers copies of their drug test results?

Under 49 CFR 382.405(b), a driver has the right to request copies of records pertaining to their own tests. You must provide those copies within a reasonable time. However, you may not release a driver's records to a third party — including a prospective employer — without the driver's written consent, except to authorized federal or state officials.

Q: What is the difference between records I keep versus what goes into the FMCSA Clearinghouse?

The FMCSA Drug and Alcohol Clearinghouse receives reports of violations — positive tests, refusals, and actual knowledge reports — from employers, MROs, and C/TPAs. Your internal records retention under 49 CFR 382.401 includes all test results, including negatives, SAP records, and training docs, which are never reported to the Clearinghouse. Both systems must be maintained in parallel.

Q: How long do I keep supervisor reasonable suspicion training records?

Supervisor reasonable suspicion training documentation must be retained for a minimum of 2 years under 49 CFR 382.401(b)(4). This includes the training completion date, the supervisor's name, the topics covered, and the name of the trainer or training provider. FMCSA auditors routinely request these during compliance reviews, particularly following a reasonable suspicion test event.

Manage DOT Records Retention Without the Paper Chase

HRForge automates DOT drug and alcohol records tracking, retention scheduling, and audit-readiness for small trucking fleets that cannot afford a full-time compliance team. From pre-employment test documentation through SAP follow-up records, HRForge keeps your files organized, date-stamped, and ready for any FMCSA review. Visit HRForge's trucking HR compliance platform to see how small fleet operators are staying audit-ready in 2026 without adding headcount.

This content is for informational purposes only and does not constitute legal or compliance advice.