Theft Polygraph for Security & Armored Car: EPPA Guide

What Is EPPA and Why Does It Exist?

The Employee Polygraph Protection Act (EPPA), codified at 29 U.S.C. § 2001–2009, was signed into law on June 27, 1988, and took effect on December 27, 1988 [1]Verified 29 C.F.R. Part 801 — Application of the Employee Polygraph Protection Act of 1988
Confirms EPPA effective date of December 27, 1988, general prohibition on lie detector use, and overall regulatory framework. It represents Congress's response to widespread concerns about the misuse and over-reliance on polygraph testing in private employment during the 1970s and 1980s. Before EPPA, an estimated two million polygraph examinations were administered annually in the private sector, often with minimal procedural safeguards. For the historical context of Congressional debates that led to EPPA, see our guide on polygraph in the 1970s: Watergate, unions, and Congress and the Senate polygraph hearings of 1964-1965.

EPPA's general rule is clear: most private-sector employers cannot require, request, suggest, or cause any employee or prospective employee to submit to a lie detector test [1]Verified 29 C.F.R. Part 801 — Application of the Employee Polygraph Protection Act of 1988
Confirms EPPA effective date of December 27, 1988, general prohibition on lie detector use, and overall regulatory framework. The term "lie detector" under the statute is broadly defined to include polygraphs, deceptographs, voice stress analyzers, psychological stress evaluators, and similar devices. Research has consistently shown that alternative technologies like voice stress analyzers perform at chance levels for detecting deception, which is one reason the exemptions under EPPA apply only to polygraph instruments, not other lie detector types [2]Verified The use of voice in security evaluations
Confirms that commercial voice stress analyzer technologies perform at chance levels for detecting deception[3]Verified The analysis of nonverbal communication: the dangers of pseudoscience in security and justice contexts
Confirms that nonverbal deception detection programs lack scientific validity and perform at chance levels. Violations of EPPA can result in civil penalties of up to $10,000 per violation under 29 U.S.C. § 2004 [4]Verified 29 U.S.C. Chapter 22 — Employee Polygraph Protection
Confirms $10,000 maximum civil penalty per violation and three-year statute of limitations under 29 U.S.C. § 2005(c)(2), and employees can pursue private lawsuits for back pay, reinstatement, and attorney fees.

The Architecture of EPPA's Exemptions

While EPPA establishes a broad prohibition, Congress recognized that certain contexts warranted continued access to polygraph testing. The Act carved out several exemptions, each with its own qualifying criteria and procedural requirements [1]Verified 29 C.F.R. Part 801 — Application of the Employee Polygraph Protection Act of 1988
Confirms EPPA effective date of December 27, 1988, general prohibition on lie detector use, and overall regulatory framework:

Government employer exemption — Federal, state, and local government employers are entirely exempt from EPPA and can use polygraph testing without restriction.

National defense/security exemption (§ 801.11) — Private contractors working on intelligence or counterintelligence functions for the federal government can test employees with access to classified information. Research into security clearance polygraph examinations has demonstrated measurable physiological responses across multiple sensor channels during security-relevant questioning, providing empirical support for continued use in personnel security vetting [5]Verified Security Clearance and Polygraph Examination
Demonstrates measurable physiological responses during security clearance questioning, supporting polygraph use in security vetting.

Ongoing investigation exemption (Section 7(d) / § 801.12) — Any private employer can request polygraph testing when conducting a specific investigation into economic loss, provided strict criteria are met including reasonable suspicion of the individual being tested.

Security service exemption (Section 7(e) / § 801.14) — This is the focus of this guide. It allows security service firms and armored car companies much broader authority to use polygraph testing, including pre-employment screening [6]Verified 29 C.F.R. § 801.14 — Exemption for employers providing security services
Confirms security service exemption under Section 7(e), primary business purpose requirement, qualifying employer and employee criteria, and pre-employment testing authority.

Drug industry exemptions (§ 801.13) — Companies that manufacture, distribute, or dispense controlled substances can use polygraph testing for employees with direct access to those substances [7]Verified 29 C.F.R. § 801.13 — Exemption of employers authorized to manufacture, distribute, or dispense controlled substances
Confirms controlled substance exemption is at § 801.13, distinct from security service exemption at § 801.14.

The security service exemption is the most expansive employer-side exemption available to private companies that are not in the controlled substances industry, and it fundamentally changes how security firms can approach both hiring and internal investigations.

What Section 7(e) Actually Says

Section 7(e) of EPPA, found at 29 U.S.C. § 2006(e), provides that the general prohibition on polygraph testing does not apply to prospective employees or current employees of armored car companies, security firms providing personnel for facilities protection, and employers authorized to handle controlled substances. The Department of Labor's implementing regulations at 29 C.F.R. § 801.14 further clarify the scope of this exemption, specifying that it permits polygraph testing provided that such employers have as their primary business purpose the providing of armored car personnel, security alarm personnel, or other uniformed or plainclothes security personnel [6]Verified 29 C.F.R. § 801.14 — Exemption for employers providing security services
Confirms security service exemption under Section 7(e), primary business purpose requirement, qualifying employer and employee criteria, and pre-employment testing authority.

The security service exemption is notably different from the ongoing investigation exemption in several critical ways. First, it permits pre-employment testing — employers can make passing a polygraph a condition of being hired [6]Verified 29 C.F.R. § 801.14 — Exemption for employers providing security services
Confirms security service exemption under Section 7(e), primary business purpose requirement, qualifying employer and employee criteria, and pre-employment testing authority. Second, it does not require an "ongoing investigation" or "reasonable suspicion" to test current employees. Third, the scope of permissible questions is broader because the testing isn't limited to a specific incident of economic loss. If you want to understand what questions can be asked, our theft polygraph questions guide provides detailed coverage.

Two Categories of Qualifying Employers

The exemption covers two distinct types of businesses, each with specific qualifying criteria [6]Verified 29 C.F.R. § 801.14 — Exemption for employers providing security services
Confirms security service exemption under Section 7(e), primary business purpose requirement, qualifying employer and employee criteria, and pre-employment testing authority:

Armored Car Companies: Companies whose primary business involves the transportation, protection, or custody of cash, currency, coins, precious metals, jewelry, or other high-value items. This includes vault operations, cash-in-transit services, and ATM servicing companies. The US armored vehicle industry includes about 830 establishments with combined annual revenue of approximately $3 billion [8]Verified Armored Vehicle Services Industry Profile
Confirms US armored vehicle industry includes about 830 establishments with combined annual revenue of approximately $3 billion. Key players like Brink's, Loomis, and GardaWorld dominate this highly concentrated sector [8]Verified Armored Vehicle Services Industry Profile
Confirms US armored vehicle industry includes about 830 establishments with combined annual revenue of approximately $3 billion[9]Verified Brink's Company — Wikipedia
Confirms Brink's operations include cash-in-transit, ATM replenishment, vault outsourcing, money processing, and international transportation of valuables.

Security Service Firms: Companies whose primary business purpose is providing protective services including guard services, alarm monitoring, private investigation, and similar security functions. According to the Bureau of Labor Statistics, approximately 1.2 million security guards are employed across the United States [10]Verified Security Guard Industry Statistics and Facts 2025
Confirms approximately 1.2 million security guards employed in US and Allied Universal generating approximately $20 billion in global revenue. The industry is overseen under NAICS code 56161 and includes investigation, guard, patrol, and armored vehicle services [11]Verified Security Services in the US Industry Analysis
Confirms Security Services industry operates under NAICS code 56161, including guard, patrol, and armored vehicle services.

Key Legal Distinction: Primary Business Purpose

The single most important phrase in the exemption is "primary business purpose." The Department of Labor has consistently interpreted this to mean that the security exemption applies only to companies whose main business activity is providing security services [6]Verified 29 C.F.R. § 801.14 — Exemption for employers providing security services
Confirms security service exemption under Section 7(e), primary business purpose requirement, qualifying employer and employee criteria, and pre-employment testing authority.

This distinction eliminates a wide range of businesses from claiming the exemption. A retail chain with its own in-house security team does not qualify. A manufacturing plant that employs guards to patrol its facility does not qualify. A bank with armed security officers does not qualify. In each case, the company's primary business is retail, manufacturing, or banking — not security services. These employers remain subject to EPPA's general prohibition and can only use polygraph testing under the more restrictive ongoing investigation exemption described in Section 7(d). For more on how retail businesses can use polygraph, see our retail loss prevention guide.

Conversely, companies like Allied Universal (generating approximately $20 billion in global revenue [10]Verified Security Guard Industry Statistics and Facts 2025
Confirms approximately 1.2 million security guards employed in US and Allied Universal generating approximately $20 billion in global revenue), Securitas, Brink's, Loomis, and GardaWorld clearly qualify because their primary business is providing security and cash handling services [9]Verified Brink's Company — Wikipedia
Confirms Brink's operations include cash-in-transit, ATM replenishment, vault outsourcing, money processing, and international transportation of valuables. Smaller regional security companies also qualify as long as their principal business activity is security service provision.

If your company is investigating employee theft but security services are not your primary business, you should review the ongoing investigation exemption requirements, which require documented reasonable suspicion before testing any individual employee.

Employer Qualification Tests

To determine whether your company qualifies for the security service exemption, you must satisfy both the employer-level test and the employee-level test. The Department of Labor applies a functional analysis, looking at the actual nature of the business rather than merely its corporate description or SIC/NAICS code [6]Verified 29 C.F.R. § 801.14 — Exemption for employers providing security services
Confirms security service exemption under Section 7(e), primary business purpose requirement, qualifying employer and employee criteria, and pre-employment testing authority.

For the employer-level test, the analysis considers: What percentage of revenue comes from security-related services versus other business activities; how the company describes itself in marketing materials, contracts, and regulatory filings; the company's licensing (state security licenses, armored car permits); the nature of the services provided to clients; and whether the company is classified as a security service provider by state regulatory bodies.

Companies that derive the majority of their revenue from security services but also offer ancillary services (such as a security company that also provides janitorial or facilities management services) will generally still qualify, provided that security remains the primary business purpose. However, companies where security is an add-on or ancillary service may not qualify.

Employee Qualification Tests

Even within a qualifying security firm, not every employee can be tested under the exemption. The employee must be hired to perform, or be performing, duties directly related to the company's security functions. The Department of Labor's regulations at § 801.14 specify that the employee's role must involve the protection of [6]Verified 29 C.F.R. § 801.14 — Exemption for employers providing security services
Confirms security service exemption under Section 7(e), primary business purpose requirement, qualifying employer and employee criteria, and pre-employment testing authority:

Currency, negotiable securities, precious commodities or instruments, or proprietary information; facilities, operations, or materials that have a significant impact on the health or safety of any state or political subdivision; or materials or operations affecting national security.

Typical qualifying roles include: Armed and unarmed security officers assigned to protect facilities, personnel, or assets; armored car drivers and crew members who operate armored vehicles and handle cash pickups and deliveries; cash processing and vault personnel who count, sort, verify, package, or store currency; alarm and monitoring center operators who monitor security systems and dispatch responses; and security supervisors and managers with direct oversight responsibility for security operations.

Conversely, employees in purely administrative, clerical, or support roles at a security company would generally not qualify for testing under this exemption. If a security company wanted to polygraph test its accountant during a suspected embezzlement investigation, it would need to use the Section 7(d) ongoing investigation exemption instead, which requires reasonable suspicion of that specific individual. For employees who may face polygraph requests in other contexts, our guide on whether you can be forced to take a polygraph at work provides important information.

Why Pre-Employment Screening Matters

The security industry's ability to conduct pre-employment polygraph screening is perhaps the most significant advantage conferred by the Section 7(e) exemption. While virtually all other private employers must wait until a specific incident occurs before they can even consider polygraph testing, security firms can make it a standard part of the hiring process [6]Verified 29 C.F.R. § 801.14 — Exemption for employers providing security services
Confirms security service exemption under Section 7(e), primary business purpose requirement, qualifying employer and employee criteria, and pre-employment testing authority.

This is critically important in an industry where employees routinely have access to significant amounts of cash, sensitive client facilities, and security systems. The US armored vehicle industry provides cash-in-transit, ATM replenishment, vault outsourcing, and money processing services to banks, retailers, governments, and other clients [9]Verified Brink's Company — Wikipedia
Confirms Brink's operations include cash-in-transit, ATM replenishment, vault outsourcing, money processing, and international transportation of valuables[11]Verified Security Services in the US Industry Analysis
Confirms Security Services industry operates under NAICS code 56161, including guard, patrol, and armored vehicle services. Even small discrepancies in cash handling can translate to enormous financial impact given the volumes involved.

Pre-employment polygraph screening serves as both a deterrent — candidates with disqualifying histories may self-select out of the application process — and a detection tool. Early research into security screening polygraph accuracy showed 94.9% accuracy for innocent examinees [12]Verified Studies of the accuracy of security screening polygraph examinations
Found 94.9% accuracy for innocent examinees in security screening polygraph examinations, demonstrating the utility of these examinations for clearing trustworthy candidates. For an overview of how pre-employment screening works across industries, see our pre-employment lie detector test guide.

Structuring a Legally Compliant Pre-Employment Polygraph Program

While the security exemption provides broad authority, implementing a pre-employment polygraph program requires careful attention to legal requirements and best practices:

Written policy documentation: Develop a formal written policy that clearly defines which positions require polygraph screening, the criteria for the examination, and how results will be used in hiring decisions.

Job posting transparency: Disclose the polygraph requirement in job postings and during the initial application process. Candidates should never be surprised by a polygraph requirement after investing significant time in the hiring process.

Standardized application across positions: Apply the polygraph requirement uniformly to all candidates for a given position. Selective testing of certain candidates but not others for the same role creates legal risk and potential discrimination claims.

Integration with other screening methods: The polygraph should be part of a comprehensive screening program that includes criminal background checks, employment verification, reference checks, drug testing, and credit history review (where permitted). Advanced tools like EyeDetect for theft investigations may also complement traditional polygraph screening.

Professional examiner selection: Use only qualified, licensed (where required) polygraph examiners who have graduated from APA-accredited training programs of at least 400 hours [13]Verified PEAK Basic Polygraph Examiner's Course — APA Accredited
Confirms APA-accredited basic polygraph examiner programs require a minimum of 400 hours of instruction and who are familiar with EPPA compliance requirements. Learn more about choosing an examiner in our consent form guide.

Common Pre-Employment Screening Topics

Pre-employment polygraph examinations in the security industry typically cover several key areas relevant to the candidate's suitability for positions of trust:

Theft history: Questions about prior theft from employers, shoplifting, embezzlement, or other forms of dishonest acquisition of property. Research dating to the 1930s has demonstrated higher diagnostic accuracy using physiological measurement for detecting deception in theft cases compared to other methods [14]Verified A comparison of the cardio-pneumo-psychograph and association methods in the detection of lying in cases of theft among college students
Demonstrated higher diagnostic accuracy using physiological measurement for detecting deception in theft cases.

Criminal activity: Undisclosed criminal conduct, particularly offenses related to dishonesty, violence, or substance abuse.

Employment history accuracy: Whether the candidate has been truthful about prior employment, reasons for leaving previous jobs, and past disciplinary actions.

Drug use: Current or recent illegal drug use, particularly substances that could impair judgment or create vulnerability to coercion.

Integrity and reliability: Questions designed to assess the candidate's overall trustworthiness and suitability for positions handling valuables.

While the security exemption broadens the scope of permissible testing, it does not eliminate all limits. The Equal Employment Opportunity Commission (EEOC) guidelines still apply, meaning questions cannot be designed to discriminate based on race, sex, religion, national origin, age, or disability. The Americans with Disabilities Act (ADA) also imposes certain constraints on medical inquiries during the pre-employment phase. For more on what specific questions may be asked, review our detailed theft polygraph questions guide.

When Current Employees Face Polygraph Examinations

Beyond pre-employment screening, security companies use polygraph testing in two primary contexts involving current employees: as part of periodic security maintenance programs and during specific theft or misconduct investigations.

Periodic testing programs involve regularly scheduled polygraph examinations for employees in sensitive positions. Many armored car companies conduct annual or biennial polygraph examinations of all cash-handling personnel. Research into the implications of multiple testing in polygraph screening for internal security has examined how repeated examinations affect accuracy and decision-making [15]Verified The issue of multiple testing in polygraph screening — implications for internal security
Foundational research relevant to periodic polygraph testing programs in security settings. Under the security exemption, such programs are permissible without the need for individualized suspicion, as long as the employees hold qualifying security-related positions.

Specific investigation testing occurs when a company suspects that theft, fraud, or other misconduct has taken place. In a security company context, this might involve investigating a cash shortage in an armored car route, a missing shipment from a vault facility, or unauthorized access to a client's secured premises. For investigations involving organized theft, our guide on using polygraphs to identify conspirators in theft rings provides specialized strategies.

Investigating Cash Shortages in Armored Car Operations

Cash shortages are a significant concern in the armored car industry, where companies handle billions of dollars in cash annually across their routes [9]Verified Brink's Company — Wikipedia
Confirms Brink's operations include cash-in-transit, ATM replenishment, vault outsourcing, money processing, and international transportation of valuables. When a discrepancy is identified — whether during a routine audit or through a client complaint — the investigation typically proceeds through several stages:

First, document the discrepancy by recording the exact nature and amount of the shortage, when it was discovered, which routes or facilities were involved, and which employees had access during the relevant time period. This documentation forms the foundation of the investigation.

Second, review physical evidence including surveillance footage, access logs, GPS tracking data from vehicles, seal integrity records, and any other physical evidence. Modern armored vehicles are equipped with CCTV cameras and GPS tracking devices that can be monitored by the company in real-time [16]Verified Armored car (valuables) — Wikipedia
Confirms modern armored vehicles equipped with CCTV cameras, GPS tracking, remote monitoring, and access controls.

Third, conduct administrative interviews with employees who had access to the cash or facility during the relevant period. These interviews should be fact-finding in nature, not accusatory.

Fourth, administer polygraph examinations. Under the security exemption, the company has broader latitude than other employers in requesting such examinations, but should still follow EPPA's procedural requirements [6]Verified 29 C.F.R. § 801.14 — Exemption for employers providing security services
Confirms security service exemption under Section 7(e), primary business purpose requirement, qualifying employer and employee criteria, and pre-employment testing authority.

Fifth, evaluate results holistically. Consider polygraph results alongside all other evidence gathered during the investigation. EPPA specifically prohibits taking adverse employment action based solely on polygraph results or test refusal [17]Verified 29 C.F.R. § 801.21 — Adverse employment action under security service and controlled substance exemptions
Confirms employers cannot take adverse action based solely on polygraph results; additional bona fide reasons with supporting evidence required. Our guide on polygraph for cash theft investigations provides additional detail.

Before the Examination

Proper preparation is essential for both the employer and the examinee. The employer must provide the employee with written notice of the upcoming examination at least 48 hours in advance (unless the employee voluntarily agrees to a shorter notice period). This notice must include [1]Verified 29 C.F.R. Part 801 — Application of the Employee Polygraph Protection Act of 1988
Confirms EPPA effective date of December 27, 1988, general prohibition on lie detector use, and overall regulatory framework:

The date, time, and location of the examination; the name and qualifications of the examiner; the nature and characteristics of the polygraph instrument; a statement that the employee has the right to consult with legal counsel or an employee representative before the test; and a statement of the employee's rights under EPPA, including the right to refuse the test (though in the security exemption context, refusal may result in adverse employment consequences when combined with other bona fide reasons [17]Verified 29 C.F.R. § 801.21 — Adverse employment action under security service and controlled substance exemptions
Confirms employers cannot take adverse action based solely on polygraph results; additional bona fide reasons with supporting evidence required). For a comprehensive explanation of consent requirements, see our polygraph consent form guide.

The Pre-Test Interview and In-Test Phase

The pre-test interview is a critical component of any polygraph examination and typically lasts 45 minutes to an hour or more. During this phase, the examiner reviews the purpose of the examination and the areas to be covered; explains how the polygraph instrument works and what physiological responses it measures; discusses the specific questions that will be asked during the actual testing phase; and reviews the examinee's background and any relevant information.

EPPA mandates that no polygraph examination may last less than ninety minutes in total duration [18]Verified 29 C.F.R. § 801.22-801.26 — Restrictions on Polygraph Usage Under Exemptions
Confirms 90-minute minimum examination duration, five-exam daily limit, examiner reporting requirements, and examinee rights during testing. This minimum includes the pre-test, in-test, and post-test phases. The examiner may administer no more than five polygraph examinations in any one calendar day [18]Verified 29 C.F.R. § 801.22-801.26 — Restrictions on Polygraph Usage Under Exemptions
Confirms 90-minute minimum examination duration, five-exam daily limit, examiner reporting requirements, and examinee rights during testing. These requirements ensure that each examination receives the thoroughness and attention it demands.

During the actual testing phase, the examinee may not be asked questions in a degrading or unnecessarily intrusive manner, nor may they be asked about religious beliefs, racial matters, political beliefs, sexual behavior, or lawful labor union activities [18]Verified 29 C.F.R. § 801.22-801.26 — Restrictions on Polygraph Usage Under Exemptions
Confirms 90-minute minimum examination duration, five-exam daily limit, examiner reporting requirements, and examinee rights during testing. Employers should be aware that they cannot watch the examination through a two-way mirror — the testing must maintain appropriate privacy.

Examiner Qualifications Under EPPA

EPPA imposes specific qualifications on polygraph examiners conducting tests under any of the Act's exemptions. Examiners must hold a valid current license if required by the state in which the test is conducted and must carry a minimum bond of $50,000 or an equivalent amount of professional liability coverage [19]Verified 29 C.F.R. § 801.26 — Qualifications of and requirements for examiners
Confirms examiners must carry a minimum bond of $50,000 or equivalent professional liability coverage. APA-accredited polygraph training programs now require a minimum of 400 hours of coursework [13]Verified PEAK Basic Polygraph Examiner's Course — APA Accredited
Confirms APA-accredited basic polygraph examiner programs require a minimum of 400 hours of instruction, and practicing examiners must complete a minimum of 30 continuing education hours every two years [20]Verified Policy for APA Continuing Education Hours
Confirms practicing examiners must complete a minimum of 30 continuing education hours every two years.

The examiner must render any opinion or conclusion regarding truthfulness or deception in writing, and that written report must be based solely on the polygraph test results [18]Verified 29 C.F.R. § 801.22-801.26 — Restrictions on Polygraph Usage Under Exemptions
Confirms 90-minute minimum examination duration, five-exam daily limit, examiner reporting requirements, and examinee rights during testing. The report must not include any recommendation concerning the employment of the examinee — that decision remains with the employer. For more on understanding what appears in an examiner's report, see our diagnostic impression guide.

Core Rights During Polygraph Examination

Even under the security service exemption, EPPA maintains important protections for examinees. During all phases of polygraph testing, the person being examined retains several fundamental rights [18]Verified 29 C.F.R. § 801.22-801.26 — Restrictions on Polygraph Usage Under Exemptions
Confirms 90-minute minimum examination duration, five-exam daily limit, examiner reporting requirements, and examinee rights during testing:

The right to terminate the test at any time. The examinee cannot be coerced into continuing an examination they wish to stop. The right not to be asked questions in a degrading or unnecessarily intrusive manner. Protection from questions about religious beliefs, racial matters, political beliefs, sexual behavior, or lawful labor union activities. The right not to be tested if a physician has provided written evidence that a medical or psychological condition might cause abnormal responses during testing.

Additionally, the examinee has the right to review all questions to be asked during the test before the actual testing phase begins, and the right to consult with legal counsel before and after the examination. Our guide on voluntary polygraph testing provides additional context on examinee rights.

Limitations on Use of Results

Section 8(a)(2) of EPPA provides that the security service exemption shall not apply if an employer discharges, disciplines, denies employment or promotion, or otherwise discriminates against any current employee or prospective employee based solely on the analysis of a polygraph test chart or the refusal to take a polygraph test [17]Verified 29 C.F.R. § 801.21 — Adverse employment action under security service and controlled substance exemptions
Confirms employers cannot take adverse action based solely on polygraph results; additional bona fide reasons with supporting evidence required.

However, analysis of a polygraph test chart or refusal to take a test may serve as one basis for adverse employment actions, provided that the adverse action was also based on another bona fide reason with supporting evidence [17]Verified 29 C.F.R. § 801.21 — Adverse employment action under security service and controlled substance exemptions
Confirms employers cannot take adverse action based solely on polygraph results; additional bona fide reasons with supporting evidence required. Traditional factors such as prior employment experience, education, and job performance may be used alongside polygraph results.

For employees who receive unfavorable results, our guide on what happens after a failed theft polygraph explains the process and available options in detail.

Federal Preemption and State Restrictions

Section 10 of EPPA provides that the Act does not preempt any provision of a state or local law, or any provision of a collective bargaining agreement, that prohibits lie detector tests or is more restrictive with respect to their use [21]Verified 29 C.F.R. § 801.5 — Effect on other laws or agreements
Confirms EPPA does not preempt more restrictive state laws or collective bargaining agreements regarding lie detector testing. This means that even though the federal security exemption permits polygraph testing, individual states can impose additional restrictions or outright prohibitions.

For example, if a state prohibits the use of polygraphs in all private employment, polygraph examinations could not be conducted pursuant to the exemptions provided in Section 7(d), (e), or (f) of the Act [21]Verified 29 C.F.R. § 801.5 — Effect on other laws or agreements
Confirms EPPA does not preempt more restrictive state laws or collective bargaining agreements regarding lie detector testing. Similarly, a collective bargaining agreement that provides greater protection to an examinee would apply in addition to the protection provided in the Act. More stringent licensing or bonding requirements in a state law would also apply in addition to the federal bonding requirement [21]Verified 29 C.F.R. § 801.5 — Effect on other laws or agreements
Confirms EPPA does not preempt more restrictive state laws or collective bargaining agreements regarding lie detector testing.

Several states — including Connecticut, Delaware, Hawaii, Maryland, Massachusetts, Michigan, Minnesota, Montana, Nebraska, New Jersey, Oregon, Pennsylvania, Rhode Island, Vermont, Washington, West Virginia, and Wisconsin — have enacted laws that restrict or prohibit lie detector testing in employment, some of which apply regardless of the federal exemptions. Security companies operating in multiple states must conduct a state-by-state analysis before implementing any polygraph program.

Integrating Polygraph with Other Evidence

EPPA mandates that polygraph results cannot be the sole basis for adverse employment actions, even under the security service exemption [17]Verified 29 C.F.R. § 801.21 — Adverse employment action under security service and controlled substance exemptions
Confirms employers cannot take adverse action based solely on polygraph results; additional bona fide reasons with supporting evidence required. Best practice recommends treating polygraph results as one component of a comprehensive evaluation that includes background checks, employment verification, interview assessments, reference checks, and any other relevant evidence.

Employers should develop clear, written policies explaining how polygraph results will be weighted alongside other factors. These policies should be reviewed by employment counsel familiar with both EPPA and applicable state laws. Admissions made by examinees during the pre-test, test, or post-test phases can serve as independent supporting evidence for employment decisions [17]Verified 29 C.F.R. § 801.21 — Adverse employment action under security service and controlled substance exemptions
Confirms employers cannot take adverse action based solely on polygraph results; additional bona fide reasons with supporting evidence required.

Record Retention and Statute of Limitations

EPPA requires employers to maintain polygraph examination records for a minimum of three years from the date the examination is conducted (or from the date the examination is requested if no examination is conducted) [22]Verified Federal Record-keeping Requirements — EPPA
Confirms employers must retain EPPA records for minimum of three years from the date the examination is conducted. Required records include a copy of the written statement setting forth the time and place of the examination, the examiner's conclusions, and copies of all notices provided to the examinee.

The statute of limitations for EPPA claims is three years from the date of the alleged violation, as provided in 29 U.S.C. § 2005(c)(2) [4]Verified 29 U.S.C. Chapter 22 — Employee Polygraph Protection
Confirms $10,000 maximum civil penalty per violation and three-year statute of limitations under 29 U.S.C. § 2005(c)(2). Given that the record retention period and the limitations period are identical, employers should consider retaining records beyond the minimum three-year period to protect against late-filed claims or disputes about the exact date of violation. Civil actions may be brought by an employee or prospective employee in federal or state court against employers who violate the Act [4]Verified 29 U.S.C. Chapter 22 — Employee Polygraph Protection
Confirms $10,000 maximum civil penalty per violation and three-year statute of limitations under 29 U.S.C. § 2005(c)(2).

Building an Effective Polygraph Program

Security companies that wish to maximize the value of their polygraph programs while minimizing legal risk should adopt the following practices:

Conduct a primary business purpose analysis: Document that your company's principal business activity is security services. Maintain records showing the percentage of revenue from security-related services. Ensure your state licensing, marketing materials, and regulatory filings consistently reflect your identity as a security services provider.

Develop position-specific testing policies: Create a clear matrix identifying which positions qualify for pre-employment testing under the exemption and which do not. Focus testing on positions that involve direct security functions — protection of facilities, cash handling, alarm monitoring, and similar duties.

Select qualified examiners: Engage examiners who hold valid licenses (where required), maintain the required $50,000 minimum bond or equivalent professional liability coverage [19]Verified 29 C.F.R. § 801.26 — Qualifications of and requirements for examiners
Confirms examiners must carry a minimum bond of $50,000 or equivalent professional liability coverage, have graduated from APA-accredited programs of at least 400 hours [13]Verified PEAK Basic Polygraph Examiner's Course — APA Accredited
Confirms APA-accredited basic polygraph examiner programs require a minimum of 400 hours of instruction, and maintain current continuing education requirements of 30 hours every two years [20]Verified Policy for APA Continuing Education Hours
Confirms practicing examiners must complete a minimum of 30 continuing education hours every two years.

Maintain comprehensive documentation: Keep detailed records of all polygraph examinations, including written notices, examiner qualifications, test results, and any employment actions taken based on or in conjunction with test results. Retain these records for at least three years [22]Verified Federal Record-keeping Requirements — EPPA
Confirms employers must retain EPPA records for minimum of three years from the date the examination is conducted.

Conduct state law reviews: Before implementing or expanding a polygraph program, review the laws of every state in which you operate. State restrictions may override the federal exemption [21]Verified 29 C.F.R. § 801.5 — Effect on other laws or agreements
Confirms EPPA does not preempt more restrictive state laws or collective bargaining agreements regarding lie detector testing. For companies interested in alternative approaches used internationally, our guide on polygraph testing in Botswana offers a comparative perspective.