Supervisors are on the front line of workplace drug and alcohol testing programs. They manage the workers who are tested, they observe the behaviours that may trigger for-cause testing, and they are responsible for ensuring fitness for duty on a daily basis. Yet the information they are entitled to receive about test results is strictly limited by privacy legislation and the organisation’s duty of confidentiality.

Understanding the boundary between what supervisors need to know and what they legally cannot know is essential for every organisation that conducts workplace testing. Getting this wrong can expose the organisation to privacy complaints, damage employee trust, and undermine the testing program.

The Need-to-Know Principle

The foundation of information management in drug and alcohol testing programs is the need-to-know principle. This means that access to test result information is limited to those who require it to fulfil a legitimate workplace function. Not everyone in the management chain needs to know — and for most supervisors, the specific details of a test result are not required for them to perform their role.

The Australian Privacy Principles under the Privacy Act 1988 require that personal information (which includes health information such as drug test results) is only used and disclosed for the purpose for which it was collected, unless an exception applies. Employers must also comply with any applicable state or territory health records legislation.

In practical terms, this means that the organisation must define, in advance, who has access to what information — and enforce those boundaries consistently.

What Supervisors Are Told: Fit or Unfit

In most well-designed testing programs, supervisors receive one of two outcomes: the employee is fit for duty or not fit for duty. This binary outcome is all a supervisor needs to manage the immediate operational situation.

When an employee is assessed as fit for duty:

• The supervisor is notified that the employee has been tested and is cleared to continue working.
• No further information is provided about the substances tested or the specific result.
• The employee returns to their duties without further discussion.

When an employee is assessed as not fit for duty:

• The supervisor is notified that the employee is not cleared for duty and must be stood down from safety-sensitive work.
• The supervisor is given instructions on what to do next — typically, arranging safe transport home or to a designated area, and ensuring the employee’s duties are covered.
• The supervisor is not told the specific substance detected, the level of the result, or any personal details about the employee’s circumstances.

This approach protects the employee’s privacy while giving the supervisor the information they need to manage the immediate situation safely.

What Supervisors Cannot Access

The following information should never be disclosed to supervisors unless they are specifically authorised within the policy and have a demonstrable need to know:

• The specific substance detected — a supervisor does not need to know whether the positive result was for cannabis, methamphetamine, or any other substance.
• The quantitative result — the level or concentration of the substance detected is clinical information that is relevant only to the Medical Review Officer or occupational health professional.
• Medical information — any prescribed medication the employee has disclosed, any medical condition relevant to the result, or any information provided during a Medical Review Officer assessment.
• EAP engagement details — whether the employee has been referred to the EAP, is attending counselling, or is participating in a treatment program.
• Disciplinary discussions — the content of meetings between the employee, HR, and management regarding the positive result is confidential to those participants.
• Other employees’ results — supervisors should never have access to aggregated or individual results for their team members beyond the fit/unfit determination for the specific testing event.

Managing Fitness for Duty

While supervisors cannot access detailed result information, they retain a critical role in managing fitness for duty on an ongoing basis. This role extends beyond the testing event itself.

Supervisors should be trained to:

• Observe and document — monitor employees for signs of impairment during normal duties. This includes changes in behaviour, coordination, speech, alertness, and work performance.
• Report concerns — if a supervisor has reasonable concerns about an employee’s fitness for duty, they should report these through the defined channel (typically to HR or a designated manager) rather than confronting the employee directly about suspected substance use.
• Manage stand-downs — when an employee is assessed as not fit for duty (whether through testing or observation), the supervisor must manage the immediate safety situation, including removing the employee from safety-sensitive duties and arranging safe transport.
• Maintain confidentiality — supervisors must not discuss an employee’s test result or fitness-for-duty status with other team members, even in general terms.

Confidentiality Training for Supervisors

Confidentiality obligations should not be left to assumption. Supervisors must receive specific training on their responsibilities, including:

• What information they will receive — and, critically, what they will not receive.
• How to handle questions from team members — when a colleague is stood down or absent, other team members will ask questions. Supervisors need a prepared response that protects confidentiality while addressing operational concerns.
• The consequences of breaching confidentiality — supervisors must understand that disclosing test result information without authorisation is a serious matter that may result in disciplinary action against the supervisor, a privacy complaint against the organisation, and damage to the employee concerned.
• How to manage their own curiosity — it is human nature to want to know more. Supervisors must be trained to accept that the information boundary exists for good reason and to resist the temptation to seek out details they are not entitled to.

This training should be refreshed regularly and documented. A record of each supervisor’s training attendance provides evidence of the organisation’s commitment to confidentiality.

When Supervisors Are Also the Tester

In some organisations — particularly smaller ones or those operating on remote sites — the supervisor may also be the person conducting the test. This creates a tension, because the person collecting the specimen and reading the screening device will inevitably see the result before it is formally processed.

In these situations:

• The supervisor-tester should be trained to record the result through the defined process and to communicate only the fit/unfit outcome to the rest of the management chain.
• The specific result should not be discussed with anyone other than the designated HR or management contact responsible for managing positive results.
• Where possible, consider using an external collector for testing events to remove this conflict entirely.

Systems That Enforce Boundaries

The most effective way to manage information boundaries is through systems that enforce them automatically. A testing management platform with role-based access controls ensures that supervisors can see only what they are authorised to see, while HR and management have access to the full picture.

Paper-based systems and shared spreadsheets make confidentiality enforcement virtually impossible. When test results are stored in a document that anyone with file access can open, the privacy protections in your policy are meaningless in practice.

If you are looking for a platform that manages test results with the access controls and confidentiality protections your program requires — start your free trial with FairTest and ensure the right people see the right information, and nothing more.