What does 49 CFR 40.351 (What confidentiality requirements apply to service agents?) require?

Based on 49 CFR 40.351, as a service agent, you must follow these specific confidentiality and security requirements:

* Follow Employer Rules: You must follow the exact same confidentiality regulations as employers regarding how you use and release confidential employee information, such as individual test results, as well as all applicable records retention requirements.

* Require Written Employee Consent: You cannot share an employee's individual test results or other confidential information with another employer (or any other party not covered by a specific exception) without getting a specific, written consent from that employee first. For example, if an employee leaves one client employer for another, you cannot share their past test results with the new employer without their written permission.

* Prohibit Blanket Consents: You are strictly forbidden from using blanket consent forms to authorize the release of employee testing information.

* Establish Security Measures: You must set up adequate security measures to keep confidential employee records out of the hands of unauthorized persons. This includes protecting the physical security of paper files, setting up access controls, and using computer security measures to safeguard electronic databases.