(a) The Federal Drug Testing Custody and Control Form (CCF) must be used to document every collection required by the DOT drug testing program. You may view this form on the Department's website (https://www.transportation.gov/odapc) or the HHS website (https://www.workplace.samhsa.gov).

(b) You must not use a non-Federal form or an expired CCF to conduct a DOT collection. As a laboratory, C/TPA or other party that provides CCFs to employers, collection sites, or other customers, you must not provide copies of an expired CCF to these participants. You must also affirmatively notify these participants that they must not use an expired CCF.

(c) As a participant in the DOT drug testing program, you are not permitted to modify or revise the CCF except as follows:

(1) You may include, in the area outside the border of the form, other information needed for billing or other purposes necessary to the collection process.

(2) The CCF must include the names, addresses, telephone numbers and any other appropriate contact information (e.g., an email address of the employer and the MRO), including the DER's name and contact information. All of this information must be preprinted, typed, or handwritten. Fax numbers may be included but are not required. The MRO information must include the physician's name and address, as opposed to only a generic clinic, health care organization, company name, or post office box. This information is required, and an employer, collector, service agent or any other party is prohibited from omitting it. In addition, a C/TPA's name, address, telephone and fax numbers, and any other appropriate contact information should be included, but is not required. The employer may use a C/TPA's address in place of its own, but must continue to include its name, telephone and fax numbers, and any other appropriate contact information.

(3) As an employer you may preprint the box in Step 1-D of the CCF for the DOT agency under whose authority the test will occur.

(4) As a collector, you may use a CCF with your name, address, telephone number, and fax number preprinted, but under no circumstances may you sign the form before the collection event. If a collection takes place at a clinic, the actual address of the clinic should be used, not a corporate address of the collection company. If the collection takes place onsite at the employer, the employer's address must be noted as the collection site address. If the collection takes place in a “mobile unit” or at an accident site, the collector must enter the actual location address of the collection or as near an approximation as possible. The collector must ensure that the required collector telephone number is the number that the laboratory, MRO, or employer may use to directly contact the individual collector and/or the collector's supervisor during the collection site's business hours. The collector must not provide a number for a call center.

(5) When using an electronic CCF, you must establish adequate confidentiality and security measures to ensure that confidential employee records are not available to unauthorized persons. This includes protecting the physical security of records, access controls, and computer security measures to safeguard confidential data in electronic form.

(d) Under no circumstances may the CCF transmit personal identifying information about an employee (other than a SSN or Employee ID No.) to a laboratory.

(e) As an employer, you may use an equivalent foreign-language version of the CCF approved by ODAPC. You may use such a non-English language form only in a situation where both the employee and collector understand and can use the form in that language.

(f) An employer who uses an electronic CCF must ensure that the collection site, the primary and split laboratories, and MRO have compatible systems, and that the employee and any other program participants in the testing process will receive a legible copy of the CCF.