How Does 49 CFR Part 40 Drug Testing Work for Maritime? A Plain-English Walkthrough

Two regulations apply to maritime drug testing at once. 46 CFR Part 16 is the USCG rule for who needs testing and when. 49 CFR Part 40 is the DOT rule for how tests are conducted and records kept. You comply with both.

The terminology trips operators up first. When an inspector asks about your "MRO," "DER," and "consortium pool," half of them glaze over. Then they ask for the CG-4617 and the room goes quiet.

This post walks through how the rule actually works — what tests are required, who does what, what records you keep, and the five places I've watched operators get tripped up.

Why this rule applies to maritime

The DOT-wide framework lives in 49 CFR Part 40 — applying across aviation, rail, transit, trucking, pipeline, and maritime. The maritime overlay is 46 CFR Part 16.

The trigger is whether you employ a "covered employee" — someone in a safety-sensitive position. Per 46 CFR §16.110, that's mariners on safety-sensitive functions, watchkeeping duties, or hands-on responsibility for navigation, engineering, or safety equipment.

If your vessel requires a USCG-credentialed officer, you have covered employees. There's no minimum fleet size — a 3-crew charter is in scope just like a 50-vessel operator.

The 5 types of drug tests

Under 46 CFR §16.220, every D&A program must include five test types. You don't get to skip any of them.

1. Pre-employment

Before any new hire is assigned safety-sensitive duties, they must take a drug test and the result must be negative. The most common failure: hiring someone Friday and putting them on a vessel Monday before the result comes back. You may not assign safety-sensitive duties until you have a verified negative MRO result in hand.

2. Random testing (25% of pool, annually)

Per 46 CFR §16.230, every covered employer must conduct random tests on at least 25% of their pool of covered employees per calendar year. The pool includes every covered employee, not just officers.

Random means random. You — or your TPA — must use a scientifically valid random number generator. Selection cycles are typically quarterly. A 28-crew fleet would test ~7 employees per year, or roughly 2 per quarter.

3. Post-accident

If your vessel is involved in a "serious marine incident" per 46 CFR §4.03-2, every crew member directly involved must be tested within 32 hours. SMI triggers include death, injury beyond first aid, $200k+ in damage, total loss of any vessel, 10,000+ gallons of oil discharged, or a reportable quantity of hazardous substance released.

If the incident doesn't meet the SMI threshold, testing is not required — but document why you decided not to test. Inspectors will ask.

4. Reasonable suspicion

A supervisor with documented, articulable suspicion — based on observable behavior, speech, appearance, or odor — may direct an immediate test. Per 49 CFR §40.323, the suspicion must be documented in writing, signed by the supervising official, within 24 hours. Thin documentation after a termination invites unemployment claims and wrongful-termination suits.

5. Return-to-duty + follow-up

After a positive or refusal, the employee may return only after a Substance Abuse Professional (SAP) evaluation, any prescribed treatment, a negative return-to-duty test under direct observation, and a follow-up testing plan (typically 6-12 unannounced tests over 1-5 years). Operators who fire and never document the SAP/RTD process find their testing-rate reports come out wrong.

The terminology — who does what

The rule's vocabulary is the second thing operators tangle up. The cast:

Designated Employer Representative (DER)

You — the operator — must designate one person (or a small number of named people) as the DER. The DER receives MRO results, communicates with the SAP, documents reasonable-suspicion observations, and represents the operator in audits. Per 49 CFR §40.3, the DER must be available 24/7. Many small operators name the owner or port captain.

Medical Review Officer (MRO)

A licensed physician with substance-abuse training. The MRO reviews lab results, validates positives, and may interview donors about prescriptions that could explain a positive. Per 49 CFR §40.121, the MRO must be a physician — no non-physician substitutes.

The MRO sees the lab numbers. You — the operator — only see the verified result (negative, positive, refusal, dilute). You never see the underlying lab data. This is a privacy boundary that matters.

Service Agent

Any third party that performs functions in your program — labs, collectors, Binnacle AI for records and audit-ready reports.

Consortium / Third-Party Administrator (TPA / C/TPA)

A consortium is a pool of multiple employers' covered employees combined for random testing. A TPA administers it — selects subjects, schedules tests, files annual reports.

Most small operators use a TPA. A 3-vessel charter can't easily run a defensible 25%-random program across just 9 crew. Pooling with 100 other small operators creates a credible random pool. Not every TPA is equal — see gotcha #1.

Records you must keep

Per 49 CFR §40.333, retention varies by record type: negatives are 1 year; random-selection, MIS, and training records are 2 years; positives, refusals, SAP, return-to-duty, reasonable-suspicion, and pre-employment (when hired) are 5 years. These are minimums — most operators keep everything for 5 years. Either way: store them in a secure system with access logs, not a filing cabinet.

Records must be available for Coast Guard inspection on two business days' notice under 46 CFR §16.250. If your records are scattered across email, a former HR manager's laptop, and a TPA portal you don't have credentials to, you have a problem.

Confidentiality

Per 49 CFR §40.321, results and related information are confidential. They may be released only to the donor, the DER, the MRO/SAP, in response to subpoena, to DOT/USCG officials in investigations, or to a subsequent employer with the donor's written consent.

You may not discuss an employee's positive with their spouse, their other supervisor, the rest of the crew, or your buddy at the next operator. This is a frequent inadvertent violation in small-fleet contexts where everybody knows everybody.

Inspectors generally see roll-up data — counts by test type, overall positive rate, did you hit 25% random, did pre-employment cover every hire — not individual MRO verdicts. Individual results surface only in specific investigations, and through the DER.

The annual MIS (CG-4617)

If your covered-employee count averages 50 or more during the calendar year, you must file an annual Management Information System (MIS) report on form CG-4617 by March 15 of the following year. The form summarizes tests by type, positives/refusals/adulterations, random testing rate (must be ≥25%), and pool size.

It goes to the USCG. Not filing — when you cross the 50-employee threshold — is a documented compliance gap. If you're at 45 covered employees and growing, get the forms ready. Sub-50 operators don't file but should keep equivalent records internally.

What goes wrong (5 gotchas)

1. Hiring a TPA that doesn't file your MIS

Some TPAs do random selection, schedule tests, and stop there. They don't file the annual MIS — they assume you are. If you assumed they were, the form doesn't get filed. Year goes by. Inspector asks. Fix: Every spring, confirm in writing whether your TPA files. If you've never seen a CG-4617 with your name on it, it's on you.

2. Pre-employment test not completed before assignment

Hiring Friday, vessel Monday, before the result returns. The rule is unambiguous: safety-sensitive assignment requires a verified negative in hand. Fix: Build a 1-week startup gap into onboarding. Or assign non-safety-sensitive work (deck cleaning, paperwork) until cleared.

3. Random pool that excludes vessels "at sea"

Telling your TPA "skip the boats out on long tows — we'll test when they get back" breaks randomization. Every covered employee must have equal probability on every draw. Fix: Test on first port call. Test at the dock when they rotate off. Have the collection supplies aboard. Don't skip — defer with a documented protocol.

4. Failing to test after a fender-bender

Not every accident is an SMI. A barge bump that scratches paint may not trigger testing — but you must document why you decided not to test. A note with the date, incident description, and the regulatory analysis (no death, no injury beyond first aid, no $200k damage) is sufficient. Fix: Build a 5-minute post-incident worksheet into your incident response.

5. Mixing CDL drivers and seamen in one consortium

Operators running tugboats and company trucks sometimes pool CDL drivers and mariners "for simplicity." DOT requires separate randomization pools per mode — FMCSA (drivers), USCG (mariners), FAA (pilots) are each separate covered groups under 49 CFR §40. A combined consortium is allowed only if the TPA randomizes within mode, and many don't. Fix: Ask your TPA in writing how they segment by mode.

What Binnacle does

Binnacle AI tracks every test per crew member, alerts the DER before random-pool deadlines, generates audit-ready CG-4617 data with one-click export, retains records 5 years per 49 CFR §40.333, and includes a consent gate so reasonable-suspicion entries require a signed disclosure on file. The training matrix shows D&A history alongside TWIC, MMC, and medical-cert tracking — one place to answer the inspector's questions. All for $99/month per organization.

Real example: switching TPAs after an acquisition

A 4-vessel charter I work with had 18 covered employees. Last year they acquired a second 4-vessel charter with 10 more — now at 28. Each operator had its own TPA. Keep both, or consolidate?

• Two TPAs = two random pools. Allowed, but smaller pools are statistically lumpier — a quarter could pick 4 from one boat and 0 from another.
• One TPA = one pool. Cleaner, but requires reissuing MRO/lab paperwork through one provider.
• Cost was roughly equal (~$45-55/employee/year either way).
• Deciding factor: the existing TPA filed MIS automatically. The acquired one didn't. The acquirer didn't want two MIS workflows.

They consolidated. Migration took ~60 days, mostly reissuing consent forms and updating the company D&A policy. If you're acquiring, plan 60-90 days for D&A integration. Don't assume "we'll keep using both" — that's a path to a missed MIS or a fragmented random rate.

Start with an audit

Pull the last 12 months of test results, last year's MIS (or the documentation showing you didn't need to file), your TPA contract, your DER designation letter, and your written D&A policy. If any are missing or stale, that's where to start.

For a quick reality check on overall maritime compliance posture:

[Try the free compliance calculator →](/compliance-calculator)

You can also see how Binnacle consolidates drug testing, work-rest, and credentials in one crew workflow without juggling four vendor portals. For deep regulatory reading, the authoritative texts are at eCFR Title 46 Part 16 and eCFR Title 49 Part 40.

Capt J is the founder of Binnacle AI. He runs a small maritime tech company on Oʻahu that builds compliance tools for commercial fleets. None of this article is legal advice — consult a qualified maritime attorney for specific regulatory questions.