(a)A medical review officer or third-party administrator shall maintain all dated records and notifications, identified by individual, for a minimum of five years for verified positive controlled substances test results.
(b)A medical review officer or third-party administrator shall maintain all dated records and notifications, identified by individual, for a minimum of one year for negative and canceled controlled substances test results and MRO reversal of cancelled controlled substances test results.
(c)No person may obtain the individual controlled substances test results retained by a medical review officer (MRO as defined in § 40.3 of this title) or a consortium/third-party administrator (C/TPA as defined in § 382.107), and no MRO or C/TPA may release the individual controlled substances test results of any driver to any person, without first obtaining a specific, written authorization from the tested driver. Nothing in this paragraph (c) shall prohibit a MRO or a C/TPA from releasing to the employer, the Clearinghouse, or to the Secretary of Transportation, any DOT agency, or any State or local officials with regulatory authority over the controlled substances and alcohol testing program under this part, the information delineated in part 40, subpart G, of this title.