A toxicology report is organized into a handful of standard sections, and once you know what each one means, the document becomes much easier to navigate. The two sections to find first are “Specimens Tested” (which biological samples were analyzed) and “Analytes Detected” (which substances were found and at what concentrations). Everything else on the report supports or contextualizes those two pieces of information.
Start With the Specimens
The specimen section tells you what type of biological sample was tested: blood, urine, liver tissue, hair, or oral fluid. This matters because each specimen type captures a different window of time and tells a different story about substance use.
Blood reflects what was circulating in the body within roughly 2 to 12 hours of the test. It’s the best snapshot of what someone was actively under the influence of at a specific moment. Urine captures a much wider window, typically one day to several weeks depending on the substance. Cannabis, for example, can show up in urine for up to 30 days in heavy users because it’s highly fat-soluble and leaves the body slowly. Cocaine is detectable in urine for 1 to 3 days, amphetamines for 2 to 4 days, and opiates like morphine for 2 to 5 days.
Hair offers the longest detection window. Drug metabolites get trapped inside the hair shaft as it grows, and since hair grows about half an inch per month, a standard 1.5-inch sample taken near the root represents roughly three months of history. Oral fluid (saliva) sits on the other end of the spectrum, generally reflecting use within the past 24 to 48 hours.
So if a report shows a substance detected in urine but not in blood, that substance was likely used days before the sample was collected, not hours. Finding a drug in blood suggests much more recent exposure. On a forensic or postmortem report, you may also see distinctions between heart blood and peripheral blood (drawn from a limb), which can affect how concentrations are interpreted after death.
Reading the Analytes Detected Section
This is the core of the report. It lists every substance that was found, along with its measured concentration. Concentrations are almost always reported in nanograms per milliliter (ng/mL). A nanogram is one billionth of a gram, so these are very small quantities, but the numbers are meaningful when compared to established reference ranges.
You’ll often see both a “parent drug” and its “metabolite” listed. A metabolite is the breakdown product your body creates after processing a substance. For instance, cocaine breaks down into benzoylecgonine, and that metabolite is what most tests actually look for. The ratio between parent drug and metabolite concentrations carries useful information. A high concentration of the parent drug relative to its metabolite suggests recent or acute use. The reverse, a high metabolite level relative to the parent drug, points toward longer-term or chronic use. In forensic investigations, this ratio can help distinguish between a single large dose and sustained use over time.
Some substances on the list may be prescription medications taken as directed. The report itself doesn’t distinguish between legitimate prescriptions and illicit use. That interpretation comes from comparing the results against known medication history.
What the Concentration Numbers Mean
Every substance has established reference ranges that fall into general categories: therapeutic (the range expected from a normal prescribed dose), toxic (concentrations associated with harmful side effects), and in forensic contexts, comatose or fatal (levels reported to have caused coma or death). A drug found at a therapeutic concentration tells a very different story than the same drug at a toxic level.
These ranges are not absolute cutoffs. Individual tolerance varies enormously. A person who has taken an opioid daily for years may function normally at a blood concentration that would be dangerous for someone with no tolerance. The numbers provide a framework, not a definitive verdict.
Reports also use cutoff concentrations to determine whether a result counts as positive or negative. Under federal workplace testing guidelines, for example, the initial screening cutoff for marijuana metabolites in urine is 50 ng/mL. If the result falls below that threshold, it’s reported as negative, even if trace amounts are technically present. Confirmation testing uses a lower, more precise cutoff of 15 ng/mL. For cocaine metabolites, the initial screen cutoff is 150 ng/mL and the confirmatory cutoff is 100 ng/mL. Fentanyl uses an extremely low cutoff of just 1 ng/mL for both screening and confirmation, reflecting its potency at tiny doses.
Screening vs. Confirmatory Results
Most toxicology reports involve a two-step process. The initial screen uses a fast, broad technique called immunoassay that can quickly flag whether a category of drugs might be present. If the screen comes back positive, a second, more precise test is run using advanced equipment like a mass spectrometer, which can identify the exact substance and measure its concentration with much greater accuracy.
This two-step process exists because initial screens have a real false-positive problem. One study comparing the two methods found that immunoassay screening produced false positives for non-opioid drugs in 44% of tested patients. Common over-the-counter and prescription medications are frequent culprits. Ibuprofen, naproxen, and the cough suppressant dextromethorphan can trigger false positives. So can diphenhydramine (the active ingredient in many sleep aids and allergy medications), the antidepressants bupropion, sertraline, trazodone, and venlafaxine, and even some antihistamines and heartburn medications like ranitidine. False positives for amphetamine and methamphetamine are the most commonly reported across these medications.
If a report shows only a positive screening result with no confirmatory test, treat that result with skepticism. A confirmed positive, where the mass spectrometry test also came back above the cutoff, is far more reliable. The confirmatory step improved overall accuracy by about 9% in one direct comparison, and it eliminates the cross-reactivity issues that plague initial screens.
Understanding “None Detected”
“None detected” or “not detected” does not necessarily mean a substance was completely absent from the sample. It means the concentration was below the test’s ability to reliably measure it. Every lab test has two key thresholds: the limit of detection (the lowest concentration that can be reliably distinguished from zero) and the limit of quantitation (the lowest concentration that can be measured with acceptable precision). A substance can be present in the sample but still come back as “not detected” if it falls below these thresholds.
This is particularly relevant for substances with very short detection windows. If someone used a drug and the sample was collected well after the detection window closed, the report will read “none detected” even though use occurred. It’s a statement about what the test found at the time of collection, not a definitive statement about whether the person ever used the substance.
The Analytes Not Detected Section
This section lists every substance the lab tested for but did not find. It’s easy to skip over, but it provides important context. If you’re trying to understand someone’s cause of death or clinical picture, knowing what was ruled out can be just as valuable as knowing what was found. A long list of negatives narrows the possibilities and strengthens the significance of whatever did show up.
Specimen Validity Testing
For urine-based reports, you may see a section on specimen validity. Labs check three markers to ensure the sample hasn’t been tampered with: creatinine concentration, specific gravity, and pH. A urine sample is flagged as dilute when creatinine falls between 2 and 20 mg/dL and specific gravity is between 1.0010 and 1.0030. This can happen from drinking large amounts of water before the test, and it means the results may underrepresent what’s actually in the person’s system.
A sample is reported as substituted (meaning it’s likely not real urine) when creatinine drops below 2 mg/dL and specific gravity falls outside the range of 1.0010 to 1.0200. A pH below 3 or above 11 flags the sample as adulterated, since normal urine pH falls well within that range. If a report notes any of these validity issues, the drug results from that sample are unreliable.
Testing Methodology
Near the end of most reports, you’ll find a section describing the lab methods used. For most readers, the key thing to look for here is whether both screening and confirmatory testing were performed. The methodology section will reference immunoassay for initial screens and some form of mass spectrometry (often abbreviated as GC-MS or LC-MS/MS) for confirmation. If only immunoassay was used, the results carry less certainty. If mass spectrometry confirmed the findings, the identification of specific substances and their concentrations is highly reliable.