DOT Rule 49 CFR Part 40 Section 40.327
Subpart P - Confidentiality and Release of Information
§ 40.327 When must the MRO report medical information gathered in the verification process?
(a) As the MRO, you must, except as provided in paragraph (c) of this section, report drug test results and medical information you learned as part of the verification process to third parties without the employee's consent if you determine, in your reasonable medical judgment, that:
(1) The information is likely to result in the employee being determined to be medically unqualified under an applicable DOT agency regulation; or
(2) The information indicates that continued performance by the employee of his or her safety-sensitive function is likely to pose a significant safety risk.
(b) The third parties to whom you are authorized to provide information by this section include the employer, a physician or other health care provider responsible for determining the medical qualifications of the employee under an applicable DOT agency safety regulation, a SAP evaluating the employee as part of the return to duty process (see §40.293(g)), a DOT agency, or the National Transportation Safety Board in the course of an accident investigation.
(c) If the law of a foreign country (e.g., Canada) prohibits you from providing medical information to the employer, you may comply with that prohibition.