10 C.F.R. § 707.16 – Records.

(a) Confirmed positive test results shall be provided to the Medical Review Officer and other contractor and DOE officials with a need to know. Any other disclosure may be made only with the written consent of the individual.
(b) Contractors shall maintain maximum confidentiality of records related to illegal drug use, to the extent required by applicable statutes and regulations (including, but not limited to, 42 U.S.C. 290dd-3, 42 U.S.C. 290ee-3, and 42 CFR part 2). If such records are sought from the contractor for criminal investigations, or to resolve a question or concern relating to the Personnel Assurance Program certification or access authorization under 10 CFR part 710, any applicable procedures in statute or regulation for disclosure of such information shall be followed. Moreover, owing to DOE's express environmental, public health and safety, and national security interests, and the need to exercise proper contractor oversight, DOE must be kept fully apprised of all aspects of the contractor's program, including such information as incidents involving reasonable suspicion, occurrences, and confirmed test results, as well as information concerning test results in the aggregate.
(c) Unless otherwise approved by DOE, the contractors shall ensure that all laboratory records relating to positive drug test results, including initial test records and chromatographic tracings, shall be retained by the laboratory in such a manner as to allow retrieval of all information pertaining to the individual urine specimens for a minimum period of five years after completion of testing of any given specimen, or longer if so instructed by DOE or by the contractor. In addition, a frozen sample of all positive urine specimens shall be retained by the laboratory for at least six months, or longer if so instructed by DOE.
(d) The contractor shall maintain as part of its medical records copies of specimen chain of custody forms.
(e) The specimen chain of custody form will contain the following information:
1. (1) Date of collection;
2. (2) Tested person's name;
3. (3) Tested employee/applicant's social security number or other identification number unique to the individual;
4. (4) Specimen number;
5. (5) Type of test (random, applicant, occurrence, reasonable suspicion, follow-up, or other);
6. (6) Temperature range of specimen;
7. (7) Remarks regarding unusual behavior or conditions;
8. (8) Collector's signature; and
9. (9) Certification signature of specimen provider certifying that specimen identified is in fact the specimen the individual provided.