(a) A medical review officer or third party administrator shall maintain all dated records and notifications, identified by individual, for a minimum of five years for verified positive controlled substances test results.
(b) A medical review officer or third party administrator shall maintain all dated records and notifications, identified by individual, for a minimum of one year for negative and canceled controlled substances test results.
(c) No person may obtain the individual controlled substances test results retained by a medical review officer or third party administrator, and no medical review officer or third party administrator shall release the individual controlled substances test results of any driver to any person, without first obtaining a specific, written authorization from the tested driver. Nothing in this paragraph (c) shall prohibit a medical review officer or third party administrator from releasing, to the employer or to officials of the Secretary of Transportation, any DOT agency, or any State or local officials with regulatory authority over the controlled substances testing program under this part, the information delineated in part 40, Subpart G, of this title.