A Medical Review Officer, or MRO, is a licensed physician who reviews laboratory drug test results before an employer ever sees them. When a lab reports a specimen as positive, adulterated, substituted, or invalid, the MRO investigates whether a legitimate medical explanation exists before that result becomes final. Only after this review is complete does the MRO report a verified result back to the employer.
For employers building or scaling a drug testing program, understanding what happens between "the lab called it positive" and "the employer finds out" matters. That gap is where the MRO operates, governed in detail by federal regulation for safety-sensitive transportation employers.
MRO qualifications and certification
The requirements to serve as an MRO are specific. Under 49 CFR 40.121, an MRO must be a licensed physician, either a Doctor of Medicine or Doctor of Osteopathy, licensed in any United States, Canadian, or Mexican jurisdiction. A license alone is not enough: the physician must also demonstrate knowledge of controlled substance abuse disorders and alternative medical explanations for positive results, understand adulterated and substituted specimens, and stay current on the regulations that govern the program.
Initial certification
Before practicing as an MRO, a physician must complete qualification training covering collection procedures, chain of custody, interpretation of test results, and MRO responsibilities. After training, the candidate must pass an examination administered by a nationally recognized MRO certification board, per 49 CFR 40.121. One such organization is the Medical Review Officer Certification Council, or MROCC, whose program is described on mrocc.org as "DOT and SAMHSA recognized and approved."
Ongoing recertification
Certification is not permanent. The regulation requires MROs to complete requalification training and pass another comprehensive examination during each five year period, covering the same subject areas as initial training. MROCC describes this cycle as "re-qualification training followed by certification and recertification." MROs must also keep documentation on file showing they currently meet every requirement and produce it on request from DOT agencies, employers, or service agents.
The verification interview and how donors are contacted
Once a lab reports a positive, adulterated, substituted, or invalid result, the MRO's first job is to review the chain of custody form for errors before taking any further action. 49 CFR 40.127 requires the MRO to check the paperwork for fatal or correctable flaws and confirm the reported result actually matches what is on the form, a topic covered in more depth in our piece on chain of custody and court defensible drug testing.
Assuming the paperwork holds up, the MRO must conduct a verification interview with the employee. 49 CFR 40.129 requires that "this interview must include direct contact in person or by telephone" between the MRO and the employee. This is not a delegated task: 49 CFR 40.131 is explicit that the MRO must personally conduct the interview. Staff may schedule the conversation and explain the consequences of declining to participate, but they cannot collect medical information or discuss the result itself.
To reach the employee, the MRO must make at least three contact attempts spread over a 24 hour period, using the phone numbers on the chain of custody form. If those attempts fail, the MRO instructs the designated employer representative, or DER, to make contact and tell the employee to call the MRO, without revealing the actual result.
The donor contact window and what happens if the employee is unreachable
Employers often ask how long a verification can be held up by an unreachable employee. The regulation sets real limits. Under 49 CFR 40.131, once the DER has successfully contacted the employee and told them to call the MRO, the employee has 72 hours to respond before the MRO may verify the result without an interview. 49 CFR 40.133 adds a broader deadline: if neither the MRO nor the DER, after making and documenting all reasonable efforts, has been able to contact the employee within ten days, the MRO may verify the result as positive or as a refusal to test without ever conducting an interview. Every contact attempt has to be made and documented by both the MRO and the DER, not just claimed after the fact.
Verification without an interview is not necessarily final. The same section lets the employee come back within 60 days and present evidence that a serious illness, an injury, or another circumstance prevented them from responding in time. If the MRO finds that explanation credible, the verification can be reopened.
Legitimate medical explanations and prescription review
Not every positive result stays positive. 49 CFR 40.137 requires the MRO to verify a result as negative if the employee presents a legitimate medical explanation for the substance found in the specimen. The burden is on the employee to raise this during the interview and produce supporting evidence. If the MRO has reasonable basis to believe the employee can obtain relevant documentation, the deadline for producing it can be extended by up to five days.
A valid prescription can qualify, but the regulation limits the MRO's role: the MRO cannot second guess whether a physician should have prescribed a legally valid controlled substance, only whether the prescription is genuine and consistent with the Controlled Substances Act. For medications obtained outside the United States, the MRO must confirm the substance was legally obtained in that country, has a genuine medical use rather than being a drug of abuse such as heroin, and is being used appropriately for its intended purpose.
Even when a result is verified negative, the MRO may still flag fitness for duty concerns if the medication could affect the employee's ability to safely perform the job.
What the employer actually receives
Employers sometimes assume they get the same clinical detail the MRO reviewed. They do not. Under 49 CFR 40.163, the MRO reports a verified result either as a signed or stamped copy of the chain of custody form, or as a written report limited to specific fields: the employee's name and specimen ID, the reason for the test, the collection and verification dates, the result itself (positive, negative, dilute, refusal to test, or cancelled), the specific drug detected for a positive result, and the stated reason behind any cancellation or refusal.
For negative results, the MRO may also report electronically, using the same minimum data plus the MRO's contact information and the release date. What employers never receive, regardless of format, are quantitative values. The regulation states plainly that the MRO "must not provide quantitative values to the DER or C/TPA for drug or validity test results." An employer learns a result was positive and for which substance, not the concentration detected. Records are retained by the MRO for one year for negative and cancelled results, and five years for positive results and refusals.
When an MRO is legally required versus best practice
MRO review is not optional everywhere, but it is also not universal by law. 49 CFR Part 40 states that it governs "all parties who conduct drug and alcohol tests required by Department of Transportation agency regulations," applying to transportation employers, safety sensitive transportation employees, and the service agents who support them. If a drug testing program falls under a DOT agency, whether because of commercial driving, aviation, rail, or another regulated mode, MRO review of positive, adulterated, substituted, or invalid results is a required part of the process, not a courtesy step.
Outside that regulated space, nothing in federal law forces a non-DOT employer to route results through an MRO. Many still choose to, because physician review reduces the odds of acting on a result caused by a valid prescription, and it adds a defensible process if an employment decision is challenged. A company running post-accident testing after a workplace injury benefits from the same rigor described in our post on the post-accident drug testing procedure, even when no DOT rule requires an MRO.
What to look for as your testing program scales
A testing program that started with a handful of pre-employment screens looks very different once it covers reasonable suspicion, random pools, post-accident testing, and return-to-duty cases across multiple locations. At that scale, a few things are worth checking.
First, confirm the MRO relationship, whether in-house or contracted through a third party administrator, can actually meet the response time requirements described above. A process that cannot make three documented contact attempts within 24 hours, or that lets cases drift past the ten day mark without documentation, creates legal exposure regardless of how good the collection process is.
Second, look at the collection supply chain. Programs that scale past occasional testing usually move away from single boxes of cups and start managing inventory in bulk, to keep unit costs down and make sure a testing event is never delayed by a site running out of supplies. Our bulk drug testing supply options and our range of drug testing cups are built around that kind of volume.
Third, keep chain of custody documentation consistent across every site and collector, since that paperwork is the first thing an MRO checks before verification begins, and the first thing scrutinized if a result is disputed.
Frequently asked questions
Does every employer have to use an MRO for drug test results?
No. Federal regulation under 49 CFR Part 40 requires MRO review for drug and alcohol tests conducted under Department of Transportation agency rules. Non-DOT employers are not legally required to use an MRO, though many choose to for the added medical review and documentation it provides.
How long can the MRO verification process take if the employee cannot be reached?
The MRO and the designated employer representative must make and document reasonable contact attempts. If neither can reach the employee within ten days, the MRO may verify the result as positive or as a refusal to test without an interview, though the employee can still present a valid explanation within 60 days after that.
Can a legal prescription turn a positive drug test result into a negative one?
Yes, if the employee presents it during the verification interview and it is consistent with the Controlled Substances Act. The MRO cannot second guess whether the prescription should have been written, only whether it is genuine, and the MRO may still flag fitness for duty concerns even after verifying the result as negative.
What information does the employer actually get from the MRO?
Employers receive a verified result (positive, negative, dilute, cancelled, or refusal), the specific drug detected in a positive result, and the relevant dates and reason for the test. The MRO is prohibited from sharing quantitative concentration values with the employer.
