Employee Drug Testing: A Guide for Small Businesses

When we made our first hire for a role that involved driving a company vehicle, I hit a question I had no idea how to answer: should we drug test? I had 5 employees, no HR department, and a vague sense that drug testing was something "real" companies did. What I found when I started researching was a mess of lab sales pages trying to sell me tests, dense government documents, and law-firm articles written for corporations with legal teams. Nobody was talking to a founder with a handful of employees trying to make a sensible decision.

That gap is exactly what this guide fills. If you have 5 to 50 employees, no dedicated HR person, and you are trying to decide whether and how to drug test, this is written for you. It walks through the real decision: whether you should test at all, what the law actually requires, how state marijuana laws complicate things, the types and costs of tests, and how to build a policy that will not get you sued. It is US-focused and current as of mid-2026, though this is a fast-changing area, especially for cannabis.

What Is Employee Drug Testing?

Employee drug testing is the practice of screening job applicants or current employees for the presence of certain drugs, usually through a urine, saliva, or hair sample analyzed by a lab. Employers use it to support workplace safety, reduce liability, meet legal requirements in regulated industries, and, in some states, qualify for insurance or workers-compensation discounts.

The single most important thing to understand up front is that drug testing is not one decision but several: whether to test, whom to test, when to test, what to test for, and how to handle the results. Each of those has legal and practical dimensions, and getting any of them wrong, particularly around marijuana and prescription drugs, is where small businesses run into trouble. This guide takes them in order, starting with the most fundamental question.

Should You Test at All?

Before diving into how to test, decide whether you should. For many small businesses, especially office-based ones in states with strong cannabis protections, the honest answer may be no, or at least "not for everything." Drug testing costs money, can shrink your hiring pool, and creates legal obligations. It pays off most clearly where safety is genuinely at stake.

The clearest case for testing is safety-sensitive work: driving, operating heavy machinery, working at heights, or handling dangerous equipment. If a mistake by an impaired employee could seriously hurt someone, testing is easy to justify and defend. The weakest case is blanket testing of low-risk office roles in states that protect off-duty cannabis use, where you take on cost and legal risk for little safety benefit. A good middle path for many small businesses is to test only safety-sensitive roles rather than everyone. Whatever you decide, tie it to a real rationale, because that rationale is also your legal defense. This decision is part of the broader challenge of running HR at a small business without a dedicated team.

The Federal Framework: What the Law Actually Requires

Here is the fact that surprises most small business owners: there is no general federal law requiring or prohibiting private-employer drug testing. Federal law is largely silent, leaving most of the rules to the states. The main federal touchpoints are a narrow set of situations, not a blanket mandate.

The Drug-Free Workplace Act of 1988 requires a drug-free workplace policy for any organization with a federal contract of $100,000 or more, or any federal grant of any size. Importantly, that act requires a written policy, an awareness program, and sanctions, but it does not require drug testing itself. Beyond that, DOT regulations mandate testing for safety-sensitive transportation roles (covered next), and the ADA and FCRA constrain how any employer conducts testing. Outside these, the federal government neither requires nor prohibits testing for a typical small business. Drug testing sits alongside the other human resource laws a small employer needs to know.

The Drug-Free Workplace Act: What It Actually Requires

The Drug-Free Workplace Act of 1988 is the single most misunderstood federal law in this area, so it is worth being precise. It applies only to organizations with a federal contract of $100,000 or more, or any organization receiving a federal grant of any size. If you have no federal contracts or grants, it does not apply to you at all. Many small businesses assume this law forces them to drug test; it does not.

What the act actually requires of covered employers is a written policy prohibiting drug use in the workplace, a drug-free awareness program, and specific actions when a covered employee is convicted of a workplace drug offense, including notifying the contracting agency within a set time. Notably, the statute is silent on drug testing itself. It requires awareness and policy, not testing. It also does not require you to fire drug users or refuse to hire them, and it does not override state cannabis employment protections. Understanding this correctly saves a lot of unnecessary policy.

DOT-Regulated Roles: Different Rules Entirely

If you employ anyone in a safety-sensitive transportation role, the calculus changes completely. Department of Transportation regulations make drug and alcohol testing mandatory for these roles, and the rules are strict, specific, and non-negotiable. This applies regardless of your size; even a one-truck owner-operator is covered.

The most common way small businesses encounter DOT rules is through commercial drivers. If you have CDL drivers, you must run pre-employment, random, post-accident, reasonable-suspicion, and return-to-duty testing, participate in the FMCSA Clearinghouse, and maintain a written policy and designated representative. The random testing rates for 2026 remain 50 percent for drugs and 10 percent for alcohol, announced in January 2026 and held at these levels since 2020. If DOT rules apply to you, this guide's general advice is a starting point, but you must follow the specific DOT regulations, which override the flexibility non-regulated employers have.

State Marijuana Laws: The Compliance Minefield

If there is one area where small businesses get into legal trouble with drug testing, it is marijuana. While all states permit some testing, a growing number restrict pre-employment cannabis testing or bar employers from taking adverse action based on off-duty, legal cannabis use. A national one-size-fits-all policy that tests everyone for THC can be flatly illegal in some states.

The details vary sharply by state. California's law (effective January 2024) bars discrimination based on off-duty cannabis use and prohibits relying on hair or urine tests that detect non-psychoactive metabolites in hiring. Washington's law similarly restricts pre-employment testing. New York and Minnesota are among the most restrictive, effectively prohibiting cannabis testing for most non-safety-sensitive positions rather than merely limiting adverse action. Nevada protects pre-employment applicants specifically. Several cities, including New York City, Philadelphia, and others, add their own ordinances restricting pre-employment cannabis testing.

One structural problem underlies all of this: a THC test cannot measure impairment. Cannabis metabolites can stay detectable in urine for days or weeks after use, long after any impairment has passed. That is precisely why a growing number of states now require evidence of actual impairment at work, not just a positive test, before you can take adverse action. For a small business, the safest response in a protected state is to test for impairment-relevant substances and, for non-safety roles, to consider dropping THC from the panel entirely.

The practical takeaway for a small business: never assume a marijuana testing policy that is fine in one state is fine in another. If you operate in or hire from a state with cannabis protections, get your policy reviewed before testing for THC, and seriously consider a 4-panel test that drops THC for non-safety-sensitive roles in restrictive states. This is the area where do-it-yourself policies most often go wrong.

Marijuana Rescheduling: Evolving, Not Settled

You may have heard that marijuana is being reclassified at the federal level, and it is worth knowing what that does and does not mean for you as an employer. Federal activity to move marijuana from Schedule I toward Schedule III has been developing, but as of mid-2026 it is in progress, not finalized. You should not build your testing policy around an anticipated federal change that has not happened.

The practical stance is simple: make decisions based on the law as it exists today in the states where you operate, not on where federal policy might be heading. When the rescheduling picture actually changes in a way that affects employers, that is the time to revisit your policy, ideally with legal counsel. Until then, your state law and your DOT status, if any, govern.

The ADA and the 15-Employee Rule

Once you have 15 or more employees, you are covered by the Americans with Disabilities Act, which shapes how you can test and, more importantly, how you handle results. The ADA does not prohibit drug testing. In fact, a test for the illegal use of drugs is specifically not considered a medical examination under the ADA, which is why it can be given even before a job offer.

Where the ADA bites is around prescription drugs and disability. A drug test can flag a substance an applicant is taking under a lawful prescription, and that prescription may relate to a disability. According to the EEOC, current illegal drug use is not protected, but past addiction and recovery can be, and lawful prescription use tied to a disability triggers the interactive process. Automatically rejecting anyone with a positive result, without checking whether it stems from a lawful prescription, is exactly the kind of mistake the EEOC has pursued in court.

Prescription Drugs and Lawful Positives

One of the most common and costly mistakes a small employer can make is treating a positive result as an automatic failure when it stems from a lawful prescription. A drug test can flag legitimately prescribed medication, and reflexively rescinding an offer or disciplining the person, without an individualized review, can violate the ADA. This is not a hypothetical: employers have paid settlements for rescinding offers over prescribed medication without engaging in the required interactive process.

The correct handling is to route positive results through a review that lets the person explain a lawful prescription before any decision is made. This is the core job of a Medical Review Officer, covered later in this guide: a physician verifies whether a positive has an innocent medical explanation. When it does, the result is reported as negative and no adverse action follows. When a prescription relates to a disability and might affect the person's ability to do the job safely, the ADA's interactive process applies, meaning you discuss reasonable accommodations rather than simply rejecting the person.

Pre-Employment Drug Testing

Pre-employment drug testing, screening a candidate before they start, is the most common type of employment drug test and the one most small businesses ask about first. It is typically run after a conditional job offer and before the start date. Done right, it is straightforward; the pitfalls are almost all about timing, consistency, and how you handle a positive.

The key rules for pre-employment testing are: extend a conditional offer first, then test; apply testing consistently to everyone in the same job category rather than singling out individuals; use a Medical Review Officer to confirm any positive before acting; and, if a positive turns out to be a lawful prescription, run the interactive process instead of automatically rescinding the offer. If you use a background-check company to run the test, you also pick up FCRA obligations, covered below. Pre-employment testing fits naturally into a well-run pre-employment screening process and your broader hiring process.

One caution specific to hiring: you cannot use a drug test as a backdoor to ask disability-related questions, just as you avoid other illegal interview questions. And in states with cannabis protections, a pre-employment THC screen may itself be restricted or prohibited, so the "test everyone for everything before they start" instinct is exactly what gets employers in trouble in those states. Match your pre-employment testing to the role's safety-sensitivity and your state's rules.

Types and Timing of Tests

Beyond pre-employment, there are several points at which an employer might test, each suited to a different situation. Your policy should specify which of these you use and for which roles, because testing at a moment you have not defined in advance invites disputes.

For most small businesses, pre-employment and reasonable-suspicion testing cover the majority of real needs, with post-accident testing added for safety-sensitive roles. Random testing is common in DOT and high-risk settings but is costly and administratively heavy, so many small businesses reserve it for safety-sensitive positions or skip it entirely outside DOT requirements. The important thing is that whichever triggers you use, they are written into your policy and applied consistently, and that reasonable-suspicion testing rests on documented, objective observations rather than a hunch.

Reasonable-Suspicion Testing: Getting It Right

Reasonable-suspicion testing, sometimes called for-cause testing, is where small businesses most often stumble, because it depends on a manager's judgment in the moment. The rule is that you can require a test when you have specific, documented, objective reasons to believe an employee is impaired, not a vague feeling or a rumor. Get this wrong and you expose yourself to a claim; get it right and you have a defensible, fair process.

What counts as reasonable suspicion is observable, articulable evidence: slurred speech, unsteady movement, the smell of alcohol or marijuana, erratic behavior, or a witnessed incident. Crucially, the same symptoms can have innocent medical explanations, so training matters. A manager should document what they personally observed, ideally have a second person corroborate it, and record it before the test, not after. The observation, not the test result, is what has to justify the decision to test.

One related trap deserves its own mention because it catches employers off guard: OSHA limits blanket post-accident drug testing. Under OSHA's rule barring retaliation against employees who report workplace injuries, automatically drug testing everyone who reports an injury can look like retaliation, since it may discourage reporting. OSHA's guidance permits post-accident testing, but it should be tied to a reasonable belief that impairment could have contributed to the incident, and you should test everyone whose conduct could have contributed, not just the person who got hurt. Testing an employee for something drug use could not plausibly have caused, like a repetitive-strain injury, is exactly the kind of blanket testing OSHA warns against.

Test Methods and Detection Windows

Different testing methods detect use over different time windows, and choosing among them is a practical decision about cost, invasiveness, and what you are trying to catch. Here are the main methods and roughly how far back each reaches.

For most small businesses, urine testing is the default: it is inexpensive, widely available, and the only method approved for DOT testing. Oral fluid is gaining popularity for non-DOT testing because collection can be observed, making it hard to cheat, and it catches very recent use. Hair testing is useful when you want a longer history but is more expensive and cannot detect recent use or impairment. A crucial point that trips up employers: none of these methods measures current impairment. A positive shows past presence within the window, not that someone is high right now, which is central to why marijuana testing is so legally fraught.

Drug Test Panels: What Gets Screened

A "panel" is the set of substances a test screens for. The number in a panel name tells you how many drug classes it covers. Choosing a panel is partly about your industry and partly about state compliance, especially around marijuana.

The 5-panel is the workhorse and matches the DOT requirement. The 4-panel, which simply drops THC, is an increasingly useful option for employers in states that restrict marijuana testing, letting you screen for other substances without the cannabis legal risk. Larger panels add cost and can surface more prescription medications, which means more potential ADA interactive-process situations, so bigger is not automatically better. Pick the smallest panel that meets your genuine safety needs and state constraints.

Which Test for Which Situation

With several methods, panels, and testing triggers, it helps to see how they fit together in practice. The matrix below maps common situations a small business faces to a sensible default choice. These are starting points, not rigid rules; your state law, industry, and risk tolerance may shift them, but they reflect what works for most small employers.

The throughline is proportionality: match the test to the situation rather than applying one heavy approach everywhere. A 5-panel post-offer urine test handles most hiring. Oral fluid shines for reasonable-suspicion and post-accident situations because it captures recent use. And in a THC-protected state, dropping to a 4-panel for non-safety roles keeps you compliant. Choosing deliberately, rather than testing everyone the same way, is both cheaper and safer.

What Drug Testing Costs

Cost matters for a small business deciding whether testing is worth it. Prices vary by method, panel, provider, and volume, but here are rough ranges to plan around. These are approximate and change over time, so treat them as ballpark figures for budgeting rather than quotes.

Instant or onsite tests are generally cheaper than lab-based ones, and many providers offer volume discounts if you test regularly. For a small business, the real cost is not just the per-test price but the administrative time: setting up a provider relationship, arranging a Medical Review Officer, and handling results properly. When you weigh testing against its benefit, factor in that overhead, not just the sticker price of a single test. For many low-risk roles, that fuller cost is what tips the decision toward testing only where safety genuinely warrants it.

Workers' Comp Discounts: The Upside

There is a financial upside to drug testing that many small businesses overlook: in some states, a qualifying drug-free workplace program earns a discount on your workers' compensation insurance premium. For a small business watching every cost, this can meaningfully offset the expense of running a testing program, turning what feels like pure overhead into something closer to break-even.

The details and requirements vary by state, and you typically have to meet specific program criteria, not just test occasionally, to qualify. If you operate in one of these states and were already leaning toward a drug-free program for safety reasons, the premium discount can tip the cost-benefit math in favor of doing it properly. Check your state's specific rules, since the qualifying requirements and discount amounts differ, and the program has to be genuine rather than nominal to count.

Using a Third Party: FCRA Obligations

Many small businesses do not run drug tests themselves; they use a background-check company or testing service. The moment a third-party consumer reporting agency is involved, the Fair Credit Reporting Act, or FCRA, kicks in, and it imposes specific steps you must follow, especially before rescinding a job offer based on a result.

Under the FCRA, before you use a third party to screen an applicant you must provide a clear, standalone written disclosure (not buried in the application) and get the applicant's written consent. If a result leads you to consider rescinding an offer, you must follow the adverse-action process: first a pre-adverse-action notice with a copy of the report and a summary of rights, giving the applicant a chance to respond, then, after a reasonable wait, a final adverse-action notice. Skipping these steps is a common and avoidable FCRA violation.

Choosing a Testing Vendor

Most small businesses do not run tests themselves; they use a testing lab, an occupational-health clinic, or a background-check service that bundles drug screening. Choosing the right vendor matters, because a good one handles the collection, chain of custody, lab analysis, and Medical Review Officer review correctly, which is most of what keeps your program defensible. A cheap vendor that cuts corners on process can cost you far more than it saves if a result is ever challenged.

When evaluating a vendor, look for a few things: use of a SAMHSA-certified laboratory for analysis, a Medical Review Officer to verify positives, a clear chain-of-custody process, and support for the panels and methods your state requires (for example, the ability to exclude THC or non-psychoactive metabolites where the law demands it). If you use a background-check service that also does testing, confirm it handles the FCRA disclosure and adverse-action steps. For a small business, the right vendor effectively becomes your outsourced compliance department for testing, so choose for process quality, not just price.

The Medical Review Officer: Your Safeguard

A Medical Review Officer, or MRO, is a licensed physician who reviews drug test results before they reach you, and using one is one of the smartest protections a small business can put in place. The MRO's role is to verify that a positive result is legitimate and not explained by a lawful prescription or other medical reason. For DOT-regulated testing an MRO is required; for everyone else it is a strongly advised best practice.

Here is why the MRO matters so much. When a test comes back positive, the MRO contacts the individual privately, asks whether there is a medical explanation such as a prescription, and verifies it. If there is a legitimate explanation, the MRO reports the result to you as negative, and you never learn the private medical details. If there is not, the MRO confirms the positive. This process keeps you from acting on a false positive, keeps confidential medical information away from you, and creates exactly the individualized review the ADA expects for prescription-related positives. In other words, the MRO handles the single most legally dangerous moment in the whole process on your behalf.

Handling a Positive Result

How you respond to a positive result is where good intentions most often collide with legal risk. The instinct to automatically reject or fire on any positive is exactly the instinct that gets employers sued, because a positive can have a lawful explanation. A careful, consistent process protects both the person and your business.

The right sequence is: first, have a Medical Review Officer confirm the result, because initial positives can be false or explained by lawful medication; second, if the positive reflects a lawful prescription, engage the ADA interactive process rather than rejecting outright, especially where the medication relates to a disability; third, if a third party ran the test, follow the FCRA adverse-action steps; and only then, if the result stands and no lawful explanation applies, act according to your written policy. Current illegal drug use is not protected, but you have to get to that conclusion through the process, not assume it.

This is also where prescription drugs and recovery matter. Someone lawfully taking prescribed medication, or in recovery from a past addiction and not currently using illegally, may be protected under the ADA. Handling these situations connects to the same care you would apply to any disciplinary action, and to how you manage difficult conversations with employees generally.

Confidentiality and Record-Keeping

Drug-test results are confidential medical information and must be handled accordingly. This is a requirement small businesses frequently overlook, and it is a compliance problem in its own right, separate from how you conducted the test. Results cannot sit in the general personnel file alongside performance reviews and pay records.

Store drug-test results in a separate, confidential file with restricted access, following the same standard the ADA requires for medical information. Limit who can see them to the few people who genuinely need to. This separation is the same discipline that good HR document management requires for other sensitive records, and it connects directly to how you handle the personnel file. If your recordkeeping currently mixes everything together, setting up a drug testing program is a good reason to separate medical information properly.

Building a Compliant Drug Testing Policy

If you decide to test, a written policy is essential. It is both your operational playbook and your legal defense, because consistency is what protects you from discrimination claims. A policy applied unevenly is worse than no policy. Here is how to build one for a small business.

Put the finished policy in your employee handbook so every employee knows the rules, and apply it uniformly to the roles or categories it covers. The policy should state clearly what is tested, under what circumstances, what happens on a positive or a refusal, and how results are kept confidential. If you are building or revising your handbook, our guides on how to create an employee handbook and the company policy essentials show where a drug testing policy fits. Keep a "last reviewed" date on it, because, as we have seen, this area changes.

Common Mistakes to Avoid

Most drug-testing trouble for small businesses comes from a short list of avoidable mistakes. Nearly all of them stem from acting too fast or too broadly, testing before an offer, rejecting on an unconfirmed positive, ignoring state cannabis law, or applying the policy inconsistently. Here are the ones to watch for.

The unifying lesson is that drug testing rewards deliberateness and punishes shortcuts. The employer who tests post-offer, confirms positives through a Medical Review Officer, checks state law before testing for THC, runs the interactive process for prescriptions, follows FCRA steps, and keeps results confidential is well protected. The one who "just tests everyone and rejects any positive" is exposed on multiple fronts at once. In this area, the careful path is genuinely the safer and often the cheaper one. This kind of consistency is a hallmark of sound HR processes generally.

Operating Across Multiple States

If your small business has employees in more than one state, drug testing gets meaningfully harder, because the rules, especially around marijuana, differ from state to state. A policy that is perfectly legal in one state can be illegal in another. This is one of the most under-discussed challenges for growing small businesses, and it deserves specific attention.

You have two broad options. The first is to maintain state-specific policies, applying the correct rules in each state where you have employees. This is the most precise approach but the hardest to administer for a small team. The second, often more practical for a small business, is to apply the most protective standard across your whole workforce, so you never accidentally violate a stricter state's rules. For example, if one of your states restricts pre-employment THC testing, you might drop THC from pre-employment screening everywhere, keeping a single consistent policy that is legal in all your states.

Whichever you choose, multi-state operation is the clearest situation in which to get legal review, because the interactions between state laws are exactly where do-it-yourself policies fail. Tracking which rules apply where, and keeping your policy current as states change their laws, is the kind of ongoing compliance work that benefits from a centralized system rather than memory. This is one of the quieter ways an HR platform like FirstHR helps a small business stay organized as it grows across state lines and manages the documentation a compliant testing program requires.

Frequently Asked Questions