49 CFR §40.109

1. (a)As a laboratory, you must retain all records pertaining to each employee urine specimen for a minimum of two years.
2. (b)As a laboratory, you must also keep for two years employer-specific data required in § 40.111.
3. (c)Within the two-year period, the MRO, the employee, the employer, or a DOT agency may request in writing that you retain the records for an additional period of time (e.g., for the purpose of preserving evidence for litigation or a safety investigation). If you receive such a request, you must comply with it. If you do not receive such a request, you may discard the records at the end of the two-year period.