Employee Drug Testing: A Guide for Small Businesses

When we made our first hire for a role that involved driving a company vehicle, I hit a question I had no idea how to answer: should we drug test? I had 5 employees, no HR department, and a vague sense that drug testing was something "real" companies did. What I found when I started researching was a mess of lab sales pages trying to sell me tests, dense government documents, and law-firm articles written for corporations with legal teams. Nobody was talking to a founder with a handful of employees trying to make a sensible decision.

That gap is exactly what this guide fills. If you have 5 to 50 employees, no dedicated HR person, and you are trying to decide whether and how to drug test, this is written for you. It walks through the real decision: whether you should test at all, what the law actually requires, how state marijuana laws complicate things, the types and costs of tests, and how to build a policy that will not get you sued. It is US-focused and current as of mid-2026, though this is a fast-changing area, especially for cannabis.

What Is Employee Drug Testing?

Employee drug testing is the practice of screening job applicants or current employees for the presence of certain drugs, usually through a urine, saliva, or hair sample analyzed by a lab. Employers use it to support workplace safety, reduce liability, meet legal requirements in regulated industries, and, in some states, qualify for insurance or workers-compensation discounts.

The single most important thing to understand up front is that drug testing is not one decision but several: whether to test, whom to test, when to test, what to test for, and how to handle the results. Each of those has legal and practical dimensions, and getting any of them wrong, particularly around marijuana and prescription drugs, is where small businesses run into trouble. This guide takes them in order, starting with the most fundamental question.

Should You Test at All?

Before diving into how to test, decide whether you should. For many small businesses, especially office-based ones in states with strong cannabis protections, the honest answer may be no, or at least "not for everything." Drug testing costs money, can shrink an already tight applicant pool, and creates legal obligations. It pays off most clearly where safety is genuinely at stake.

The clearest case for testing is safety-sensitive work: driving, operating heavy machinery, working at heights, or handling dangerous equipment. If a mistake by an impaired employee could seriously hurt someone, testing is easy to justify and defend, and it sits naturally alongside the rest of your health and safety policy. The weakest case is blanket testing of low-risk office roles in states that protect off-duty cannabis use, where you take on cost and legal risk for little safety benefit. A good middle path for many small businesses is to test only safety-sensitive roles rather than everyone. Whatever you decide, tie it to a real rationale, because that rationale is also your legal defense.

Write that rationale down role by role while you are making the decision, not afterward. The middle column is the one that does the work: if you cannot name what would actually go wrong when someone in that role is impaired, you have found a role you probably should not be testing.

The Federal Framework: What the Law Actually Requires

Here is the fact that surprises most small business owners: there is no general federal law requiring or prohibiting private-employer drug testing. Federal law is largely silent, leaving most of the rules to the states. The main federal touchpoints are a narrow set of situations, not a blanket mandate.

The Drug-Free Workplace Act of 1988 requires a drug-free workplace policy for any organization with a federal contract of $100,000 or more, or any federal grant of any size. Importantly, that act requires a written policy, an awareness program, and sanctions, but it does not require drug testing itself. Beyond that, DOT regulations mandate testing for safety-sensitive transportation roles (covered next), and the ADA and FCRA constrain how any employer conducts testing. Outside these, the federal government neither requires nor prohibits testing for a typical small business.

The Drug-Free Workplace Act: What It Actually Requires

The Drug-Free Workplace Act of 1988 is the single most misunderstood federal law in this area, so it is worth being precise. It applies only to organizations with a federal contract of $100,000 or more, or any organization receiving a federal grant of any size. If you have no federal contracts or grants, it does not apply to you at all. Many small businesses assume this law forces them to drug test; it does not.

What the act actually requires of covered employers is a written policy prohibiting drug use in the workplace, a drug-free awareness program, and specific actions when a covered employee is convicted of a workplace drug offense, including notifying the contracting agency within a set time. Notably, the statute is silent on drug testing itself. It requires awareness and policy, not testing, and many covered employers meet the awareness and rehabilitation side through an employee assistance program rather than a testing regime. It also does not require you to fire drug users or refuse to hire them, and it does not override state cannabis employment protections. Understanding this correctly saves a lot of unnecessary policy.

DOT-Regulated Roles: Different Rules Entirely

If you employ anyone in a safety-sensitive transportation role, the calculus changes completely. Department of Transportation regulations make drug and alcohol testing mandatory for these roles, and the rules are strict, specific, and non-negotiable. This applies regardless of your size; even a one-truck owner-operator is covered.

The most common way small businesses encounter DOT rules is through commercial drivers. If you have CDL drivers, you must run pre-employment, random, post-accident, reasonable-suspicion, and return-to-duty testing, participate in the FMCSA Clearinghouse, and maintain a written policy and designated representative; building those steps into your truck driver onboarding process is the simplest way to keep them from being skipped. The random testing rates for 2026 remain 50 percent for drugs and 10 percent for alcohol, announced in January 2026 and held at these levels since 2020. If DOT rules apply to you, this guide's general advice is a starting point, but you must follow the specific DOT regulations, which override the flexibility non-regulated employers have.

DOT vs Non-DOT Drug Tests

The practical difference between a DOT and a non-DOT drug test is who writes the rules. A DOT test follows a federal procedure you cannot modify. A non-DOT test follows your own written policy, within the limits of state law. If you run both, keep them separate, because one collection cannot serve as both.

State Marijuana Laws: The Compliance Minefield

If there is one area where small businesses get into legal trouble with drug testing, it is marijuana. While all states permit some testing, a growing number restrict pre-employment cannabis testing or bar employers from taking adverse action based on off-duty, legal cannabis use. A national one-size-fits-all policy that tests everyone for THC can be flatly illegal in some states.

The details vary sharply by state. California's law (effective January 2024) bars discrimination based on off-duty cannabis use and prohibits relying on hair or urine tests that detect non-psychoactive metabolites in hiring. Washington's law similarly restricts pre-employment testing. New York and Minnesota are among the most restrictive, effectively prohibiting cannabis testing for most non-safety-sensitive positions rather than merely limiting adverse action. Nevada protects pre-employment applicants specifically. Several cities, including New York City, Philadelphia, and others, add their own ordinances restricting pre-employment cannabis testing.

One structural problem underlies all of this: a THC test cannot measure impairment. Cannabis metabolites can stay detectable in urine for days or weeks after use, long after any impairment has passed. That is precisely why a growing number of states now require evidence of actual impairment at work, not just a positive test, before you can take adverse action. For a small business, the safest response in a protected state is to test for impairment-relevant substances and, for non-safety roles, to consider dropping THC from the panel entirely.

The practical takeaway for a small business: never assume a marijuana testing policy that is fine in one state is fine in another. If you operate in or hire from a state with cannabis protections, get your policy reviewed before testing for THC, and seriously consider a 4-panel test that drops THC for non-safety-sensitive roles in restrictive states. This is the area where do-it-yourself policies most often go wrong.

California Drug Testing Laws

California drug testing laws still let you test, but they narrow what you can screen for and what you can ask. Government Code section 12954, added by AB 2188 and amended by SB 700, makes it unlawful to discriminate against someone for cannabis use off the job and away from the workplace.

Two limits follow from that. You cannot base a hiring decision on a test that detects nonpsychoactive cannabis metabolites, which is exactly what a standard urine or hair THC screen finds, and you cannot ask an applicant about prior cannabis use. A scientifically valid screen that looks for active THC remains available.

The exemptions matter for a small employer. The section does not cover employees in the building and construction trades, or positions that require a federal background investigation or security clearance, and it does not displace federal testing requirements such as DOT rules or the conditions attached to a federal contract.

Illinois and Ohio: Where Zero Tolerance Still Holds

Not every legalization state restricts employers, and two of the most searched ones go the other way. Illinois and Ohio legalized adult-use cannabis while writing employer protections into the same statutes, so a drug-free workplace policy stays enforceable in both, including at the hiring stage.

Pre-employment drug testing in Illinois sits under the Cannabis Regulation and Tax Act, which lets you adopt a reasonable zero-tolerance or drug-free workplace policy applied in a nondiscriminatory way, run reasonable pre-employment and random testing, and withdraw an offer after a failed test. Discipline someone for impairment and you owe them a reasonable opportunity to contest the finding.

Ohio pre-employment drug testing laws are shorter to summarize. Section 3780.35 of the Revised Code says nothing in the adult-use chapter stops an employer from establishing and enforcing a drug testing policy, a drug-free workplace policy, or a zero-tolerance policy, or from refusing to hire over cannabis use.

Marijuana Rescheduling: Evolving, Not Settled

You may have heard that marijuana is being reclassified at the federal level, and it is worth knowing what that does and does not mean for you as an employer. Federal activity to move marijuana from Schedule I toward Schedule III has been developing, but as of mid-2026 it is in progress, not finalized. You should not build your testing policy around an anticipated federal change that has not happened.

The practical stance is simple: make decisions based on the law as it exists today in the states where you operate, not on where federal policy might be heading. When the rescheduling picture actually changes in a way that affects employers, that is the time to revisit your policy, ideally with legal counsel. Until then, your state law and your DOT status, if any, govern.

The ADA and the 15-Employee Rule

Once you have 15 or more employees, you are covered by the Americans with Disabilities Act, which shapes how you can test and, more importantly, how you handle results. The ADA does not prohibit drug testing. In fact, a test for the illegal use of drugs is specifically not considered a medical examination under the ADA, which is why it can be given even before a job offer.

Where the ADA bites is around prescription drugs and disability. A drug test can flag a substance an applicant is taking under a lawful prescription, and that prescription may relate to a disability. According to the EEOC, current illegal drug use is not protected, but past addiction and recovery can be, and lawful prescription use tied to a disability triggers the interactive process. Automatically rejecting anyone with a positive result, without checking whether it stems from a lawful prescription, is exactly the kind of mistake the EEOC has pursued in court, and it is worth understanding how an EEOC complaint hurts an employer before you learn it the hard way.

Prescription Drugs and Lawful Positives

One of the most common and costly mistakes a small employer can make is treating a positive result as an automatic failure when it stems from a lawful prescription. A drug test can flag legitimately prescribed medication, and reflexively rescinding an offer or disciplining the person, without an individualized review, can violate the ADA. This is not a hypothetical: employers have paid settlements for rescinding offers over prescribed medication without engaging in the required interactive process.

The correct handling is to route positive results through a review that lets the person explain a lawful prescription before any decision is made. This is the core job of a Medical Review Officer, covered later in this guide: a physician verifies whether a positive has an innocent medical explanation. When it does, the result is reported as negative and no adverse action follows. When a prescription relates to a disability and might affect the person's ability to do the job safely, the ADA's interactive process applies, meaning you discuss reasonable accommodations rather than simply rejecting the person.

Pre-Employment Drug Testing

Pre-employment drug testing, screening a candidate before they start, is the most common type of employment drug test and the one most small businesses ask about first. It is typically run after a conditional job offer and before the start date. Done right, it is straightforward; the pitfalls are almost all about timing, consistency, and how you handle a positive.

The key rules for pre-employment testing are: extend a conditional offer first, with your offer letter stating plainly that the offer depends on the result, then test; apply testing consistently to everyone in the same job category rather than singling out individuals; use a Medical Review Officer to confirm any positive before acting; and, if a positive turns out to be a lawful prescription, run the interactive process instead of automatically rescinding the offer. If you use a background-check company to run the test, you also pick up FCRA obligations, covered below.

One caution specific to hiring: you cannot use a drug test as a backdoor to ask disability-related questions, just as you avoid other illegal interview questions. And in states with cannabis protections, a pre-employment THC screen may itself be restricted or prohibited, so the "test everyone for everything before they start" instinct is exactly what gets employers in trouble in those states. Match your pre-employment testing to the role's safety-sensitivity and your state's rules.

When Do Employers Drug Test New Hires?

Most employers test a new hire after the conditional offer is accepted and before the first day. The usual sequence is offer, signed testing authorization, collection within a business day or two, then a start date the result has to clear. Testing at the offer stage keeps it out of week one.

Turnaround is the part founders underestimate. A negative lab result comes back quickly, but anything not negative goes to the Medical Review Officer, who has to reach the candidate before you hear anything. Set the start date with that gap in mind, and say in the offer letter that the offer depends on a clear result.

Types and Timing of Tests

Beyond pre-employment, there are several points at which an employer might test, each suited to a different situation. Your policy should specify which of these you use and for which roles, because testing at a moment you have not defined in advance invites disputes.

For most small businesses, pre-employment and reasonable-suspicion testing cover the majority of real needs, with post-accident testing added for safety-sensitive roles. Random testing is common in DOT and high-risk settings but is costly and administratively heavy, so many small businesses reserve it for safety-sensitive positions or skip it entirely outside DOT requirements. The important thing is that whichever triggers you use, they are written into your policy and applied consistently, and that reasonable-suspicion testing rests on documented, objective observations rather than a hunch.

Random Drug Testing at Work

Random drug testing means pulling names from a defined pool by a genuinely random method, with no advance notice and no manager choosing who goes. Outside DOT-regulated roles it is optional, and for most small businesses it earns its cost only in safety-sensitive positions.

Running a random drug test program properly takes three things: a written definition of who is in the pool, a selection method nobody in the company can influence, such as a computer-generated random number matched to employee ID numbers, and a record of every draw. If a manager can nudge the list, the program stops being random and starts looking like targeting.

Some states cap this before you start. Vermont bars employers from requesting or conducting random or company-wide drug tests unless federal law requires them (21 V.S.A. section 513). Minnesota allows random testing only for safety-sensitive positions, and only under a written policy (Minnesota Statutes sections 181.951 and 181.952). Check your state before you build a pool.

DOT Random Drug Testing Rules

For DOT-regulated drivers the random program is prescribed rather than optional. Under 49 CFR 382.305, selection must use a scientifically valid method such as a random number generator matched to driver identification numbers, every driver in the pool gets an equal chance in each draw, and the tests are unannounced.

Two details catch small carriers out. Selection dates have to be spread reasonably throughout the calendar year, so you cannot run the whole annual quota in one quarter, and a driver who is notified of selection must proceed to the collection site immediately. The annual rates remain 50 percent for drugs and 10 percent for alcohol.

Reasonable-Suspicion Testing: Getting It Right

Reasonable-suspicion testing, sometimes called for-cause testing, is where small businesses most often stumble, because it depends on a manager's judgment in the moment. The rule is that you can require a test when you have specific, documented, objective reasons to believe an employee is impaired, not a vague feeling or a rumor. Get this wrong and you expose yourself to a claim; get it right and you have a defensible, fair process.

What counts as reasonable suspicion is observable, articulable evidence: slurred speech, unsteady movement, the smell of alcohol or marijuana, erratic behavior, or a witnessed incident. Crucially, the same symptoms can have innocent medical explanations, so training matters. A manager should document what they personally observed on an incident report, ideally have a second person corroborate it, and record it before the test, not after, with the same care a full workplace investigation would demand. The observation, not the test result, is what has to justify the decision to test.

Give managers a form for that, because nobody writes a good contemporaneous account from a blank page while a difficult situation is unfolding. Fields prompt the observer for the specific, describable things a reviewer will later ask about, and they stop the record from becoming an accusation about what the person took.

The Reasonable Suspicion Checklist

A reasonable suspicion checklist is a list of what to look at, not a list of conclusions. The federal rule for transportation employers, 49 CFR 382.603, organizes supervisor training around four kinds of indicator: physical, behavioral, speech, and performance. Those four categories work as well in a print shop as they do in a trucking company.

That rule also sets the training bar for DOT-regulated employers at 60 minutes on alcohol misuse plus another 60 minutes on controlled substances, for anyone designated to supervise drivers. Nothing obliges a non-DOT employer to match it, and two hours is still the sensible benchmark before you let a manager invoke this trigger.

Two things separate a checklist that holds up from one that does not. The observations have to be current, meaning what is happening on this shift rather than what somebody noticed last month. And the innocent explanations (illness, a medication side effect, a long drive, grief) have to be considered and written down at the time rather than raised by somebody else later.

One related trap deserves its own mention because it catches employers off guard: OSHA limits blanket post-accident drug testing. Under OSHA's rule barring retaliation against employees who report workplace injuries, automatically drug testing everyone who reports an injury can look like retaliation, since it may discourage reporting. OSHA's guidance permits post-accident testing, but it should be tied to a reasonable belief that impairment could have contributed to the incident, and you should test everyone whose conduct could have contributed, not just the person who got hurt. Testing an employee for something drug use could not plausibly have caused, like a repetitive-strain injury, is exactly the kind of blanket testing OSHA warns against.

Test Methods and Detection Windows

Different testing methods detect use over different time windows, and choosing among them is a practical decision about cost, invasiveness, and what you are trying to catch. Here are the main methods and roughly how far back each reaches.

For most small businesses, urine testing is the default: it is inexpensive, widely available, and the only method approved for DOT testing. Oral fluid is gaining popularity for non-DOT testing because collection can be observed, making it hard to cheat, and it catches very recent use. Hair testing is useful when you want a longer history but is more expensive and cannot detect recent use or impairment. A crucial point that trips up employers: none of these methods measures current impairment. A positive shows past presence within the window, not that someone is high right now, which is central to why marijuana testing is so legally fraught.

Drug Screen vs Drug Test

In everyday hiring talk the two mean the same thing, and vendors use them interchangeably. Technically the screen is the first step: a fast immunoassay that sorts specimens into negative and not-negative. Anything that is not negative then goes to a confirmation test by mass spectrometry, which identifies the specific substance and its level.

That two-step design is why you never act on a first result. Federal testing procedures under 49 CFR Part 40 build the confirmation step in, and a sound non-DOT program copies it. If a vendor offers to report screening results straight to you with no confirmation and no physician review, that is a program to walk away from.

Drug Test Panels: What Gets Screened

A "panel" is the set of substances a test screens for. The number in a panel name tells you how many drug classes it covers. Choosing a panel is partly about your industry and partly about state compliance, especially around marijuana.

The 5-panel is the workhorse and matches the DOT requirement. The 4-panel, which simply drops THC, is an increasingly useful option for employers in states that restrict marijuana testing, letting you screen for other substances without the cannabis legal risk. Larger panels add cost and can surface more prescription medications, which means more potential ADA interactive-process situations, so bigger is not automatically better. Pick the smallest panel that meets your genuine safety needs and state constraints.

Can You Drug Test for Nicotine?

You can drug test for nicotine in some states, but it is a separate test rather than part of any standard panel. Labs screen for cotinine, the metabolite the body produces from nicotine, and you have to order it specifically. Healthcare employers and self-insured plans are the usual users.

Whether you can act on the result depends on state off-duty conduct law. New York's Labor Law section 201-d makes it unlawful to refuse to hire or discharge someone over the legal use of consumable products outside work hours and off the employer's premises, and Colorado's section 24-34-402.5 bars firing an employee for lawful off-duty activity. Both cover tobacco.

For most small businesses this is a fight not worth picking. A nicotine-free hiring rule shrinks an already tight candidate pool, collides with the off-duty conduct and smoker-protection statutes many states have on the books, and does nothing for workplace safety. If the goal is lower health costs, a wellness program gets you there without the legal exposure.

Which Test for Which Situation

With several methods, panels, and testing triggers, it helps to see how they fit together in practice. The matrix below maps common situations a small business faces to a sensible default choice. These are starting points, not rigid rules; your state law, industry, and risk tolerance may shift them, but they reflect what works for most small employers.

The throughline is proportionality: match the test to the situation rather than applying one heavy approach everywhere. A 5-panel post-offer urine test handles most hiring. Oral fluid shines for reasonable-suspicion and post-accident situations because it captures recent use. And in a THC-protected state, dropping to a 4-panel for non-safety roles keeps you compliant. Choosing deliberately, rather than testing everyone the same way, is both cheaper and safer.

What Drug Testing Costs

Cost matters for a small business deciding whether testing is worth it. Prices vary by method, panel, provider, and volume, but here are rough ranges to plan around. These are approximate and change over time, so treat them as ballpark figures for budgeting rather than quotes.

Instant or onsite tests are generally cheaper than lab-based ones, and many providers offer volume discounts if you test regularly. For a small business, the real cost is not just the per-test price but the administrative time: setting up a provider relationship, arranging a Medical Review Officer, and handling results properly. When you weigh testing against its benefit, factor in that overhead, not just the sticker price of a single test. For many low-risk roles, that fuller cost is what tips the decision toward testing only where safety genuinely warrants it.

Onsite drug testing is worth pricing separately if collection time is your real cost. A mobile collector comes to your site, which suits a hiring event or a shift you cannot send across town, and instant point-of-collection devices return a preliminary result in minutes. Anything not negative still goes to a lab for confirmation, and instant tests are not authorized for DOT testing at all.

Workers' Comp Discounts: The Upside

There is a financial upside to drug testing that many small businesses overlook: in some states, a qualifying drug-free workplace program earns a discount on your workers' compensation insurance premium. For a small business watching every cost, this can meaningfully offset the expense of running a testing program, turning what feels like pure overhead into something closer to break-even.

The details and requirements vary by state, and you typically have to meet specific program criteria, not just test occasionally, to qualify. If you operate in one of these states and were already leaning toward a drug-free program for safety reasons, the premium discount can tip the cost-benefit math in favor of doing it properly. Check your state's specific rules, since the qualifying requirements and discount amounts differ, and the program has to be genuine rather than nominal to count.

Using a Third Party: FCRA Obligations

Many small businesses do not run drug tests themselves; they use a background check company or testing service. The moment a third-party consumer reporting agency is involved, the Fair Credit Reporting Act, or FCRA, kicks in, and it imposes specific steps you must follow, especially before rescinding a job offer based on a result.

Under the FCRA, before you use a third party to screen an applicant you must provide a clear, standalone written disclosure (not buried in the application) and get the applicant's written consent. If a result leads you to consider rescinding an offer, you must follow the adverse-action process: first a pre-adverse-action notice with a copy of the report and a summary of rights, giving the applicant a chance to respond, then, after a reasonable wait, a final adverse-action notice.

Choosing a Testing Vendor

Most small businesses do not run tests themselves; they use a testing lab, an occupational-health clinic, or one of the background-check services that bundle drug screening. Choosing the right vendor matters, because a good one handles the collection, chain of custody, lab analysis, and Medical Review Officer review correctly, which is most of what keeps your program defensible. A cheap vendor that cuts corners on process can cost you far more than it saves if a result is ever challenged.

When evaluating a vendor, look for a few things: use of a SAMHSA-certified laboratory for analysis, a Medical Review Officer to verify positives, a clear chain-of-custody process, and support for the panels and methods your state requires (for example, the ability to exclude THC or non-psychoactive metabolites where the law demands it). If you use a background-check service that also does testing, confirm it handles the FCRA disclosure and adverse-action steps. For a small business, the right vendor effectively becomes your outsourced compliance department for testing, so choose for process quality, not just price.

The Medical Review Officer: Your Safeguard

A Medical Review Officer, or MRO, is a licensed physician who reviews drug test results before they reach you, and using one is one of the smartest protections a small business can put in place. The MRO's role is to verify that a positive result is legitimate and not explained by a lawful prescription or other medical reason. For DOT-regulated testing an MRO is required; for everyone else it is a strongly advised best practice.

Here is why the MRO matters so much. When a test comes back positive, the MRO contacts the individual privately, asks whether there is a medical explanation such as a prescription, and verifies it. If there is a legitimate explanation, the MRO reports the result to you as negative, and you never learn the private medical details. If there is not, the MRO confirms the positive. This process keeps you from acting on a false positive, keeps confidential medical information away from you, and creates exactly the individualized review the ADA expects for prescription-related positives. In other words, the MRO handles the single most legally dangerous moment in the whole process on your behalf.

Handling a Positive Result

How you respond to a positive result is where good intentions most often collide with legal risk. The instinct to automatically reject or fire on any positive is exactly the instinct that gets employers sued, because a positive can have a lawful explanation. A careful, consistent process protects both the person and your business.

The right sequence is: first, have a Medical Review Officer confirm the result, because initial positives can be false or explained by lawful medication; second, if the positive reflects a lawful prescription, engage the ADA interactive process rather than rejecting outright, especially where the medication relates to a disability; third, if a third party ran the test, follow the FCRA adverse-action steps; and only then, if the result stands and no lawful explanation applies, act according to your written policy. Current illegal drug use is not protected, but you have to get to that conclusion through the process, not assume it.

This is also where prescription drugs and recovery matter. Someone lawfully taking prescribed medication, or in recovery from a past addiction and not currently using illegally, may be protected under the ADA.

Confidentiality and Record-Keeping

Drug-test results are confidential medical information and must be handled accordingly. This is a requirement small businesses frequently overlook, and it is a compliance problem in its own right, separate from how you conducted the test. Results cannot sit in the general personnel file alongside performance reviews and pay records, which is one reason employee records software with per-document access control earns its keep once you start testing.

Store drug-test results in a separate, confidential file with restricted access, following the same standard the ADA requires for medical information. Limit who can see them to the few people who genuinely need to. If your recordkeeping currently mixes everything together, setting up a drug testing program is a good reason to separate medical information properly.

Building a Compliant Drug Testing Policy

If you decide to test, a written policy is essential. It is both your operational playbook and your legal defense, because consistency is what protects you from discrimination claims. A policy applied unevenly is worse than no policy. Here is how to build one for a small business.

Put the finished policy in your employee handbook so every employee knows the rules, and apply it uniformly to the roles or categories it covers. The policy should state clearly what is tested, under what circumstances, what happens on a positive or a refusal, and how results are kept confidential. Keep a "last reviewed" date on it, because, as we have seen, this area changes.

In a handful of states the written policy is not merely good practice but a legal precondition to testing at all, and skipping it is a violation even if the test itself was fair. Oklahoma's Standards for Workplace Drug and Alcohol Testing Act is the clearest example: testing stays voluntary, but an employer who chooses to test must first adopt a written policy covering a prescribed list of elements, give employees ten days' notice before it takes effect or changes, pay for the testing, and route positives through a confirmation test and a certified review officer, with a willful violation exposing the employer to double lost wages plus attorney fees. Minnesota and Maine impose statutory prerequisites of the same kind. If you operate in one of those states, drafting the policy is step one rather than paperwork you catch up on after the first test.

Common Mistakes to Avoid

Most drug-testing trouble for small businesses comes from a short list of avoidable mistakes. Nearly all of them stem from acting too fast or too broadly, testing before an offer, rejecting on an unconfirmed positive, ignoring state cannabis law, or applying the policy inconsistently in a way that looks like disparate treatment. Here are the ones to watch for.

The unifying lesson is that drug testing rewards deliberateness and punishes shortcuts. The employer who tests post-offer, confirms positives through a Medical Review Officer, checks state law before testing for THC, runs the interactive process for prescriptions, follows FCRA steps, and keeps results confidential is well protected. The one who "just tests everyone and rejects any positive" is exposed on multiple fronts at once. In this area, the careful path is genuinely the safer and often the cheaper one.

Operating Across Multiple States

If your small business has employees in more than one state, drug testing gets meaningfully harder, because the rules, especially around marijuana, differ from state to state. A policy that is perfectly legal in one state can be illegal in another. This is one of the most under-discussed challenges for growing small businesses, and it deserves specific attention.

You have two broad options. The first is to maintain state-specific policies, applying the correct rules in each state where you have employees. This is the most precise approach but the hardest to administer for a small team. The second, often more practical for a small business, is to apply the most protective standard across your whole workforce, so you never accidentally violate a stricter state's rules. For example, if one of your states restricts pre-employment THC testing, you might drop THC from pre-employment screening everywhere, keeping a single consistent policy that is legal in all your states.

Whichever you choose, multi-state operation is the clearest situation in which to get legal review, because the interactions between state laws are exactly where do-it-yourself policies fail. Tracking which rules apply where, and keeping your policy current as states change their laws, is the kind of ongoing HR compliance work that benefits from a centralized system rather than memory, which is what HR compliance software is built to carry. This is one of the quieter ways an HR platform like FirstHR helps a small business stay organized as it grows across state lines and manages the documentation a compliant testing program requires.

Frequently Asked Questions