Procedural clarification on drug testing Health Insurance Portability and Accountability Act (HIPAA) rules do not apply to medical review officers carrying out their verification process duties under 49 CFR Part 40. MROs do not need and must not attempt to obtain an employee’s permission in order to confer with prescribing physicians or pharmicists. MROs need no written authorizations from employees to verify drug test results.               return