Federal eCCF: HHS/NLCP Oversight and Requirements 

Procedures to Verify Compliance with Federal CCF Requirements

Initial Review

Before a Federal eCCF can be used for regulated specimens, an HHS-certified test facility must 

submit a detailed plan and proposed standard operating procedures (SOPs) for the eCCF system 

for HHS review and approval (through the NLCP). 

Ongoing Review 

The review of validation records, specimen records, SOPs, staff training records, and practices 

associated with the eCCF will be part of the NLCP inspection process. 

The current NLCP Checklist and Manual include requirements for CCF annotation, computer 

system validation, security, electronic records, electronic reports, electronic signatures, audit 

trails and logs, system monitoring, incident response, and disaster recovery. The program 

requires:

• The ability to generate accurate and complete copies of records in both human readable 

and electronic form suitable for inspection, review, and copying upon request of 

authorized parties (e.g., the MRO, federal agency, or SAMHSA) 

• Protection of records to enable accurate and ready retrieval through the records retention 

period 

• Limiting system access to authorized individuals

• Secure, computer-generated, time-stamped audit trails to independently record the date 

and time of operator entries and actions that create, modify, or delete records (changes 

should be evident when reviewing the original record, and any electronic or paper copy 

of the original record) 

• Use of authority checks to ensure that only authorized individuals can use the system, 

electronically sign a record, access the operation or computer system input or output 

device, alter a record, or perform the operation at hand 

• Measures to ensure the accuracy and security of electronically transmitted results

• Verification that confidentiality is maintained at the receiving end of electronically 

transmitted reports. Laboratories must have on file copies of letters from the MRO 

attesting to the security of off-site receiving devices and must verify the MRO 

information concerning the security of receiving devices on an annual basis. The RP of 

each HHS-certified laboratory must ensure the security and confidentiality of reports sent 

from their laboratory to MROs. They must ensure that records documenting the 
2 of 3 

confidentiality and security of any electronically transmitted result (e.g., letters attesting 

to MRO compliance with security requirements), are properly maintained, whether they 

be stored on- or off-site. 

HHS Guidance

1. Guidance for using the 2014 Federal Custody and Control Form 

2. HHS Urine Specimen Collection Handbook for Federal Agency Workplace Drug Testing 

Programs 

3. HHS Medical Review Officer (MRO) Manual for Federal Agency Workplace Drug Testing 

Programs 

HHS has added wording addressing the roles of the collector and MRO using eCCFs, to 

emphasize maintenance of donor confidentiality and protection of personal identifying 

information (PII) obtained on the Federal CCF. The Collector Handbook and MRO Manual are 

focused on collection procedures and on MRO interpretation and reporting duties, respectively, 

and not on requirements of computerized systems which may be used during collections and 

review/reporting. 

4. NLCP Checklist and Manual: NLCP Manual for Urine Laboratories

Additional questions will be added to the Checklist, with explanatory comments included in the 

NLCP Manual describing specific program requirements for a Federal eCCF system. The NLCP 

will provide the relevant Checklist and Manual sections describing specific program 

requirements to entities interested in developing and implementing a Federal eCCF system.

5. The NLCP will offer an online training course on requirements for a Federal eCCF.

Overview of Federal eCCF Use

At a minimum, if an eCCF system is used, both the collection site and the test facility must have 

necessary components installed for operation of the system. If an eCCF is provided to the MRO, 

the eCCF system must be coordinated with the MRO also. 

Electronic CCF systems are currently used in non-regulated testing. HHS foresees similar 

processes will be used for regulated testing. Proposed systems must be reviewed by HHS prior 

to implementation. One eCCF option is a paperless system in which the CCF is sent to the test 

facility solely as an electronic document (i.e., CCF information and data in digital form). 

Another option is a combination electronic/paper system. In the combination system, the 

collector initiates the eCCF and maintains the signed eCCF as an electronic document, but sends 

a printout of Copy 1 with the specimen to the test facility, which is used by the laboratory to 

document receipt and report the specimen. The collector also provides the CCF to the other 

parties (e.g., printout given to the donor or legible image emailed to the donor; copy provided to 
3 of 3

the employer and to the MRO). Note 1: A paper Federal CCF is a 5-part form, with a legend (i.e., 

copy number and recipient name) at the bottom of each copy. Copies 2 through 5 are identical. 

An eCCF is a 2-part form: Copy 1 is for the test facility and Copy 2-5 is for the MRO, employer, 

collection site, and donor. An eCCF is not required to have the legend at the bottom of Copy 2-

5. Note 2: A third party may maintain files for secure access by the laboratory/MRO/employer, 

providing that all program requirements are met and the system is reviewed and approved by the 

NLCP. 

The collector will follow the same required procedures for specimen collection currently used 

with a paper CCF. The collector and donor will sign the Federal eCCF using electronic 

signatures. As with a paper CCF, the donor’s refusal to sign the eCCF is not a reason for 

rejection. The collector documents the refusal and continues. The collector will distribute the 

Federal CCF to the other parties (test facility, MRO, employer, and donor). 

Paperless eCCF system: When the Federal eCCF is sent to the test facility only as an electronic 

document, additional steps are needed to facilitate linkage of the specimen package to the 

Federal eCCF. The collector must either 1) include a printed copy of the Test Facility copy (i.e., 

Copy 1) of the Federal CCF with the specimen; or 2) apply a label to the outside of the specimen 

package, with the specimen identification number, test facility name and contact information, 

and collection site name and contact information. The accessioner at the test facility that receives 

the specimen package from the collection site continues the specimen chain of custody on the 

Federal eCCF. In addition to documenting receipt of the specimen using an electronic signature, 

the accessioner documents the condition of the primary specimen seal and releases custody of the 

specimen (e.g., to a storage area). Note: If a printed copy of Copy 1 is also included in the 

specimen package, the accessioner may, but is not required to, annotate this form. This is only a 

replica of the Federal CCF which contains the collector’s electronic signature and is not the 

chain of custody for the specimen.

Combination Electronic/Paper eCCF system: In a combination electronic/paper system, the 

collector uses the Federal eCCF to document the collection process and start the specimen chain 

of custody, and maintains the signed Federal eCCF as an electronic document. A printout of the 

eCCF (Copy 1) is sent to the test facility with the specimen. The collector also provides the CCF 

(Copy 2-5) to the other parties. For example, the donor may choose to receive his or her copy of 

the eCCF as a printout at the end of the collection or provide an email address to receive a 

legible image of the eCCF. The collector provides copies of the eCCF to the employer and MRO. 

Various methods may be used. For example, parties may access the Federal eCCF via a secure, 

password-protected website, receive an eCCF printout (e.g., by fax, mail, transporter), or receive 

an electronic file (i.e., legible image of the CCF).