NEMT Record Retention in 2027: What to Keep and for How Long

Every paid NEMT claim rests on records: the trip log, the approval, and the driver and van used that day. Auditors can ask for them years after the ride, and a claim you cannot back up can be taken back. Retention is how long you must keep each one.

How long to keep NEMT records

No single federal number covers NEMT trip records. Federal rules require every Medicaid provider agreement to include a promise to keep the records needed to show the extent of your services, and to hand them over on request (42 CFR 431.107). Each state sets the period. Brokers and health plans add their own. The longest period that applies to you wins.

Record	Keep at least	Where the period comes from
Trip logs, signatures, odometer or GPS data, manifests	Your state’s Medicaid period, and 10 years under agreements such as MTM Health’s and WellTrans’s	State rules, broker agreements
Claims, remittance advice, corrections, and refunds	As long as the trip records they support	State rules, broker agreements
Approvals, level-of-service forms, and medical necessity forms	As long as the trip records they support	State rules
Driver and vehicle files behind each trip	As long as the trip records, because auditors check who drove and in what	State rules, broker agreements
HIPAA policies, risk analysis, training, complaints, breach files, business associate agreements	6 years from creation or the date last in effect, whichever is later	45 CFR 164.316(b)(2) and 164.530(j)(2)
Payroll records	3 years from the last entry	29 CFR 516.5
Time cards and wage rate tables	2 years	29 CFR 516.6
Form I-9	3 years after hire or 1 year after the job ends, whichever is later	8 CFR 274a.2(b)(2)
Tax records	3 years in most cases, 4 years for employment taxes	IRS

The sections below cover each part: state periods, broker contracts, driver and vehicle files, HIPAA, and taxes.

Medicaid record retention by state

In these nine states, periods run from 4 to 10 years, and they start on different days. Some count from the ride, others from billing or payment.

State	Keep at least	Counted from	Rule
California	10 years	The latest of the end of the plan contract period, the end of any audit, or the date of service	Welfare and Institutions Code 14124.1 (effective January 1, 2018)
Indiana	7 years	The date of service	405 IAC 1-1.4-2, IHCP Provider Enrollment module (September 8, 2026)
Illinois	6 years, or longer if state law requires	The date of service, extended until any audit started in that time is closed	89 Ill. Adm. Code 140.28 (amended effective January 29, 2014)
New York	6 years	The date of payment for each trip leg under the transportation manual (the regulations count from the ride or the billing date, whichever is later)	18 NYCRR 504.3(a) and 517.3(b), Medicaid Transportation Policy Manual section 2.5 (effective August 25, 2023)
Ohio	6 years	The date you receive payment, extended until any audit started in that time is done	Ohio Adm. Code 5160-1-17.2 (effective September 19, 2019)
Florida	5 years	The date of service	Florida Statutes 409.913(9) (2026)
Minnesota	5 years	The first billing date	Minnesota Rules 9505.2190
Texas	5 years, or until every audit, appeal, investigation, and court case is resolved	The date of service	Texas Medicaid Provider Procedures Manual, section 1.7.4 (September 2026)
Pennsylvania	4 years, unless the rules for your provider type say otherwise	The rule does not say	55 Pa. Code 1101.51(e)

Three details matter as much as the number of years:

• An audit stops the clock. In New York, a notice of intent to audit pauses the 6-year period (18 NYCRR 517.3(c)). Texas, Ohio, and Illinois all require records until the audit or case is finished.
• Leaving Medicaid does not end the duty. Minnesota requires a provider that withdraws or is terminated to keep its records and produce them on demand. In Pennsylvania, if the state ends your agreement, records for services before the termination stay subject to the rule.
• Records must come out fast. Texas can require records at the time of the request or within 24 hours. Missing records can mean a payment hold, recoupment of every related claim, or exclusion. Florida requires you to keep the state informed of where your Medicaid records are.

For your own state, check the provider manual and our state guides.

Broker and health plan contracts: plan on 10 years

If you take trips from a broker or health plan, its contract usually sets the longest period.

• MTM Health. Its standard transportation provider agreement, in the January 1, 2023 version Pennsylvania posts, requires full records of all operations under the agreement for 10 years, or longer if law or MTM’s client requires (section 2.S).
• WellTrans. Its Indiana provider agreement, revised October 16, 2025, requires all records for the life of the agreement plus 10 years. You must send copies within three days of a request and never destroy records under audit, review, or investigation.

Federal managed care rules use the same 10 years. Health plans must keep their grievance, appeal, rate-setting, and program integrity records for at least 10 years and require their subcontractors to do the same (42 CFR 438.3(u)). Brokers that contract with the state to run only NEMT on a prepaid basis are held to that rule too (42 CFR 438.9). Each subcontract, such as a health plan’s contract with its broker, must let the state, CMS, and HHS OIG audit the subcontractor and its own contractors, which can include you, for 10 years after the contract period ends or an audit is completed, whichever is later (42 CFR 438.230).

Read the records section of every agreement you sign, and note whether its clock starts at the ride or at the end of the contract. A WellTrans agreement that ended in 2026 still requires records into 2036.

Why auditors can reach back 6 to 10 years

Retention periods track how long the government can come after a claim.

Clock	How far back
False Claims Act suits	6 years after the violation, or up to 10 years when officials learn the facts later (31 U.S.C. 3731(b))
HHS OIG civil money penalties	6 years after the claim was presented (42 U.S.C. 1320a-7a(c)(1))
Returning Medicare overpayments you find	Overpayments identified within 6 years of when you received them (42 CFR 401.305(f))
New York Medicaid self-disclosures	6 years by date of service
Managed care audit rights	10 years after the contract ends or an audit closes

If a review of old records turns up a billing mistake, the 60-day overpayment rule applies. See Medicaid audits for NEMT for what auditors ask to see, and the False Claims Act for how the suits work.

Driver, vehicle, and employee records

Auditors test each paid trip against the driver and van used that day. Keep each driver’s license copy, driving record checks, background check, exclusion screenings, and training certificates, and each van’s inspection and maintenance records, for as long as the trips they support. The free driver file checklist lists what goes in each file.

Federal motor carrier rules set minimums only for vans that count as commercial motor vehicles on interstate trips. See DOT numbers for NEMT for when that happens.

Record	Federal minimum when the rules apply	Rule
Driver qualification file	While the driver works for you, plus 3 years	49 CFR 391.51(c)
Annual driving record checks and reviews in that file	May be removed 3 years after they were made	49 CFR 391.51(d)
Records of duty status	6 months	49 CFR 395.8(k)
Inspection, repair, and maintenance records	1 year, and 6 months after the vehicle leaves your control	49 CFR 396.3(c)
Driver vehicle inspection reports	3 months	49 CFR 396.11(a)(4)
Drug and alcohol tests for CDL drivers	5 years for positives and refusals, 1 year for negatives	49 CFR 382.401

Part 382 covers only drivers who need a CDL (49 CFR 382.103). These are floors. When a vehicle inspection report backs up a Medicaid trip, it stays with that trip’s records for the longer Medicaid or broker period.

Employment law sets its own minimums for everyone on payroll:

• Pay records. Keep payroll records for 3 years, and time cards and wage rate tables for 2 years (29 CFR 516.5 and 516.6).
• Form I-9. Keep it 3 years after the hire date or 1 year after the job ends, whichever is later (8 CFR 274a.2(b)(2)).
• Hiring and firing records. Employers covered by federal job discrimination law, generally those with 15 or more employees, keep applications and other personnel records for 1 year after they are made or the action is taken. A fired employee’s records stay 1 year after the termination, and longer while a discrimination charge is open (29 CFR 1602.14).

HIPAA records

HIPAA sets a retention period for its own paperwork. If HIPAA applies to you, as a covered entity or as a broker’s business associate (see HIPAA for NEMT providers), keep each of these for 6 years from the date it was created or last in effect, whichever is later (45 CFR 164.316 and, for covered entities, 164.530(j)):

• Your written privacy and security policies, including versions you replaced
• Your risk analysis and the steps it led to
• Training records, complaint logs, and any sanctions on staff
• Breach investigations and notices, because you carry the burden of proving notices went out or no breach happened (45 CFR 164.414(b))
• Signed business associate agreements

A policy you replaced in 2026 is kept until 2032.

When a broker agreement ends, its business associate agreement will usually require you to return or destroy the broker’s member information. The federal contract terms add that if return or destruction is not feasible, you keep protecting the information and use it only for the reason it could not be destroyed (45 CFR 164.504(e)(2)(ii)(J)). If you must keep trip records for Medicaid or the broker, ask the broker to confirm in writing how you hold them.

Tax and business records

The IRS says to keep records that support a tax return until its period of limitations runs out (IRS guidance, updated June 30, 2026).

Situation	Keep records
Most returns	3 years after filing
Income left off the return was more than 25% of the gross income shown	6 years
Bad debt deduction or worthless securities loss	7 years
Employment tax records	At least 4 years after the tax was due or paid, whichever is later
Vans and other property	Until the limitations period ends for the year you sell or dispose of it
No return filed, or a fraudulent return	Indefinitely

The property row matters for a fleet. Keep the purchase papers, depreciation records, and improvement receipts for each van until the limitations period ends for the year you sell it, generally 3 years after that return is filed. Your lender or insurer may want records longer. See NEMT business taxes.

Paper, electronic, video, and GPS records

Programs differ on the form records may take:

• Minnesota accepts microfilm or electronic copies in the fourth and fifth years after billing (Minnesota Rules 9505.2190).
• Texas may ask for original documents with a business records affidavit, or copies notarized with one, at the requester’s choice.

If you scan paper trip logs, keep every page readable in full, including signatures. Check that your state and each broker accept copies before you shred the paper.

GPS points, odometer data, and app trip logs are part of each trip’s record, so keep them for the same period. Video is a record too. Colorado’s NEMT law, HB26-1328 (in effect since July 1, 2026), says providers do not have to keep or produce video beyond the standard retention period in their own operating procedures, and missing video outside that period is not noncompliance. The state may still ask for recordings narrowly tied to a program integrity review, without warning. Write a video retention period into your policies and procedures, and see Colorado’s camera law.

When you close, sell, or lose records

• Closing. Records outlive the company. Decide who holds them, where, and who pays for storage before you close.
• Selling. In Minnesota, the seller stays responsible for records of services before the transfer unless law or a written agreement with the buyer says otherwise (Minnesota Rules 9505.2190). Put records custody and access in the purchase agreement. See how to sell a NEMT business.
• Losing records. New York’s transportation manual (effective August 25, 2023) requires providers whose records are damaged by fire, flood, or other disaster to notify the Office of the Medicaid Inspector General. The notice covers the event, the records lost, the dates of service affected, and proof. OMIG asks for its Statement of Damaged, Lost or Destroyed Records within 30 calendar days after discovery, and the claims stay open to audit.

Destroying records the right way

Once a record is past the longest period that applies and is not tied to an open audit, appeal, investigation, or lawsuit, you may destroy it. Do it securely:

• Health information. HIPAA requires policies for the final disposal of electronic health information and the devices that hold it, and for wiping devices before reuse (45 CFR 164.310(d)(2)).
• Background check reports. Reports you buy from a screening company are consumer reports under federal credit reporting law. The FTC Disposal Rule requires reasonable measures when you discard them, such as shredding, burning, or pulverizing paper and destroying or erasing electronic files (16 CFR 682.3).
• A destruction log. Write down what you destroyed, the date range, how, and who did it.

How to set up a retention schedule, step by step

1. List every rule that applies. Include your state Medicaid rule, each broker and health plan agreement, HIPAA if it applies, and IRS and employment rules.
2. Pick the longest period for each record type. Note when its clock starts: the ride, billing, payment, or the end of a contract.
3. Write it down. Put the schedule in your policies and name the person responsible.
4. File so one trip comes out whole. File trip records by date of service, and driver and vehicle files by person and van.
5. Test retrieval. Once a quarter, pull one trip from several years ago with its log, claim, remittance, driver file, and van record.
6. Place holds. Freeze everything tied to an audit, appeal, investigation, or lawsuit, and lift the hold in writing only when the matter closes.
7. Destroy on a schedule. Once a year, shred or wipe what has passed its period and is not on hold, and log it.

The free trip log template and the trip documentation guide cover what each record must contain.