NEMT Record Retention and Audit Trails: What to Keep, How Long, Paper vs Digital (2027)

Record retention is where a lot of NEMT advice goes wrong. A common claim is that federal Medicaid rules make providers keep records for six years. They do not. The federal rule tells your state to put a records clause in your provider agreement. The actual retention period comes from your state Medicaid rules, your provider agreement, and any broker or managed care contract you sign, and those periods run from five to ten years. This guide covers what a trip record must contain, how long to keep it, what audit trail features your dispatch software should have, and when paper is still acceptable.

The short answer

• Where the retention period comes from: your state Medicaid rules and provider agreement, plus any broker or health plan contract. Federal law requires the agreement but does not set one period for every provider.
• Typical state periods: 5 years in Texas, Florida and Minnesota, 6 years in Ohio and New York, 10 years in California. Each one counts from a different starting date.
• Managed care adds time: health plans must keep certain records for at least 10 years, and the state can audit their subcontractors for 10 years after the contract ends. Expect those terms to show up in broker and plan agreements.
• A practical floor: keep trip and billing records for 10 years from the date of service, or until any open audit is closed, whichever is later. That covers the longest periods most operators will face.
• Paper vs digital: paper is allowed where your state and broker accept it. What matters is that the record is complete, legible, signed and produced when asked.

What federal law actually requires

Four federal rules come up in NEMT record retention. Only one of them is aimed at providers directly, and it does not name a number of years.

The provider agreement rule: 42 CFR 431.107

Under 42 CFR 431.107(b), every state Medicaid plan must include an agreement in which each provider agrees to "keep any records necessary to disclose the extent of services the provider furnishes to beneficiaries" and, on request, furnish those records and information about payments claimed to the state Medicaid agency, HHS, or the state Medicaid Fraud Control Unit. The rule sets the duty. Your state sets the period, usually in its provider agreement, administrative code, or provider manual.

What 42 CFR 431.17 covers (not providers)

Older articles, including earlier versions of this one, cited 42 CFR 431.17 as a six-year rule for providers. It is not. Section 431.17 governs the records the state Medicaid agency keeps on applicants and beneficiaries. It requires the agency to keep them while the case is active plus at least three years, and to produce them to auditors within 30 calendar days of a request. None of that applies to a transportation company's trip logs. Our audit readiness guide covers what auditors pull first and how to have it ready.

Managed care: 10-year periods

If your trips come through a Medicaid health plan or a broker working for one, managed care rules apply upstream of you. 42 CFR 438.3(u) requires health plans to keep certain records, including grievance and appeal records and the data they certify to the state, for at least 10 years, and to require their subcontractors to do the same as applicable. Under 42 CFR 438.230(c)(3), a plan's subcontractors must agree that the state, CMS and the HHS Inspector General can audit their records for 10 years from the end of the contract or the completion of any audit, whichever is later. A transportation broker that contracts with a plan is typically a subcontractor. A transportation company in the broker's network is usually treated as a network provider instead, but plans and brokers can pass the same 10-year language down in their provider agreements, and California writes a 10-year period into state law for Medi-Cal providers. Read the records clause before you sign.

The False Claims Act lookback

The federal False Claims Act allows a civil case up to 6 years after a false claim, or up to 3 years after the government learns the material facts, but never more than 10 years after the claim (31 U.S.C. 3731(b)). That is not a retention rule. It is the reason to keep records long enough to defend a trip that is questioned years later.

HIPAA: six years, but for policies, not trip records

The six-year figure that floats around NEMT content comes from HIPAA. 45 CFR 164.316(b)(2)(i) requires covered entities to keep Security Rule documentation, such as policies, procedures and risk analyses, for 6 years from creation or from when it was last in effect, whichever is later. 45 CFR 164.530(j)(2) sets the same period for Privacy Rule documentation. HIPAA does not set a retention period for trip records or claims. For the rest of your HIPAA program, see our HIPAA compliance guide for NEMT operators.

State examples: how long to keep Medicaid trip records

These are the general Medicaid provider retention rules in five states. They apply to NEMT providers enrolled in each program. Broker and health plan contracts can require longer.

State	Minimum retention	Counted from	Source
California	10 years	The later of the end of the plan contract, completion of any audit, or the date of service	Cal. Welf. & Inst. Code 14124.1
Florida	5 years	Date of service	Fla. Admin. Code 59G-1.054; Fla. Stat. 409.913(9)
New York	6 years	Date the service was furnished	18 NYCRR 504.3(a)
Ohio	6 years	Date payment was received, or until any audit started in that period is complete	Ohio Admin. Code 5160-1-17.2(D)
Texas	5 years	Date of service, and until all audits, appeals, investigations and court cases are resolved	TMHP provider notice, May 2025

Two details are easy to miss. First, the starting date differs. Ohio counts from payment, New York and Florida from the date of service, and California from whichever date comes last. Second, Texas and Ohio extend the period for open audits, so a five- or six-year clock does not mean you can shred on schedule if a review is open. Minnesota, covered below for its trip record rules, requires Medicaid providers to keep records at least five years after the initial billing date (Minn. R. 9505.2190).

We did not find a Florida or Texas rule that sets a 10-year period for NEMT trip records, despite claims elsewhere. If a contract you signed says 10 years, the contract controls.

What an NEMT trip record must contain

Most states and brokers define the contents of a trip log in a provider manual or contract. Two examples show the range.

New York pays ambulette providers only for services documented in contemporaneous records, which must include the recipient's name and Medicaid ID, the trip origin and destination, the date and time of service, and the name of the driver (18 NYCRR 505.10(e)(8)).

Minnesota is far more detailed. Under Minn. Stat. 256B.0625, subd. 17b, each trip record must be in English, legible to a reasonable person, and include:

• The recipient's name and the date of service
• The driver's printed name or provider number, plus the driver's dated signature attesting that the record and the miles are accurate
• The dated signature of the recipient or an authorized party, or of the medical provider at the destination. If no one will sign, the driver must note that signatures were requested and not provided.
• Origin and destination addresses and the mileage for the most direct route, plus how that route was determined
• The mode of transportation and the vehicle's license plate number
• Pickup and drop-off times
• Odometer readings at pickup and at drop-off
• The name of any extra attendant

Minnesota can recover payments for trips not documented this way, and it applies these requirements to audit findings back to January 1, 2020.

Brokers set their own lists on top of state rules. One example: a 2022 Modivcare provider manual for Kansas required a daily trip log with the trip number for each leg, provider and vehicle numbers, driver name and signature, member name and signature, attendant name and signature if used, actual arrival times at pickup and drop-off, a no-show indicator, and total mileage. It also required providers to produce driver and vehicle records within three days of a request. Your current broker manual is the document that governs your trips, so check it rather than relying on any single example.

Audit trail features to require in dispatch software

If you keep trip records electronically, the software's audit trail is part of the record. If you bill health plans electronically, you are generally a HIPAA covered entity, and the Security Rule already requires some of this for systems that hold electronic patient information: a unique user ID for each person (45 CFR 164.312(a)(2)(i)), audit controls that record and examine activity (164.312(b)), protection against improper alteration or destruction (164.312(c)(1)), and regular review of activity logs (164.308(a)(1)(ii)(D)). Beyond that baseline, these are the features that make a record hold up when a broker or state auditor asks questions:

• One login per person. No shared dispatcher or driver accounts. Every create, edit, status change, export and claim submission should log under a named user.
• System-set timestamps. Pickup, drop-off, dispatch and claim times should come from the system or the driver app, not from typed entries.
• Full change history. Each edit should keep the old value, the new value, who changed it, when, and why. A log that only shows a record was opened is not enough.
• Locked billed fields. After a trip is billed, lock date of service, addresses, mileage, times, authorization number, procedure code and amount. Corrections should go through a logged workflow that keeps the original entry.
• GPS and signature capture tied to the trip. GPS trip verification and signature capture are only useful as evidence if each point and signature is stamped with time and linked to the trip ID.
• Export logs. Record who sent which file to which broker or clearinghouse, and when.
• Retention and portability. The system should keep records for your longest retention period, and your contract should say how you get a complete export, including audit logs, if you cancel. If the vendor holds the only copy, your retention plan depends on their uptime and their contract.

For how specific platforms handle these features, see our NEMT software rankings.

Where EVV fits

The federal electronic visit verification (EVV) mandate from the 21st Century Cures Act covers Medicaid personal care and home health services that require an in-home visit, as described on Medicaid.gov. It does not cover NEMT. States can go further. Minnesota added nonemergency medical transportation to its state EVV law in 2026 Minn. Laws ch. 121, art. 10, effective January 1, 2027, or on federal approval, whichever is later. From that date, EVV records can satisfy Minnesota's trip documentation rule if they include every required element. If you run in Minnesota, confirm your dispatch system's EVV support and data export before that date.

Paper vs digital records

No federal rule bans paper trip logs, and no single rule allows them in all 50 states. The answer depends on your state and your broker. Minnesota's statute is explicit: trip documentation "may be collected and maintained using electronic systems or software or in paper form but must be made available and produced upon request." Some brokers also run their own driver apps or portals for trip data, such as MTM's MTM Link Driver app. If your broker contract requires one, that settles the question for those trips.

Where paper is allowed, the requirements are the same as for digital:

• Complete. Every element your state and broker require, on every trip.
• Legible and contemporaneous. Written at the time of the trip, readable by someone who was not there. New York requires contemporaneous records, and Minnesota requires records legible to a reasonable person.
• Signed. Driver and rider (or facility) signatures where required, with a note when a signature could not be obtained.
• Retrievable. Produced within the time the requester sets. Florida requires records to be available during normal business hours (Fla. Stat. 409.913(9)), and the Kansas broker manual above required driver and vehicle records within three days.

The practical differences are retrieval speed and loss risk. Paper takes longer to pull for an audit sample, and a missing page cannot be recovered. Digital records are faster to search but only as reliable as the access controls, backups and audit logs behind them. If you scan paper and destroy the originals, check your state rule first, since some states set conditions on substituting electronic copies. Minnesota's general record rule, for example, says microfilm or electronically stored records satisfy its requirements in the fourth and fifth years after billing (Minn. R. 9505.2190), while its NEMT statute allows electronic trip records from the start.

Retention table: what to keep and for how long

Record	Minimum rule	Practical hold
Trip logs, signatures, GPS data, claims and remittances	Your state Medicaid rule (5 to 10 years in the examples above), plus any open audit	10 years from date of service, or until all audits close
Broker and health plan trips	The records clause in your contract; plans keep certain records 10 years (42 CFR 438.3(u))	Contract period, at least 10 years
Software audit logs and change history	No separate period in the rules above; they support the trip record	Same as the trip record they cover
HIPAA policies, risk analyses, training records	6 years from creation or last effective date (45 CFR 164.316, 164.530)	6 years after each version is retired
Driver vehicle inspection reports (only if FMCSA rules apply)	3 months (49 CFR 396.11)	Longer if your broker or state requires it
Vehicle maintenance records (only if FMCSA rules apply)	1 year, and 6 months after the vehicle leaves your control (49 CFR 396.3(c))	Life of the vehicle plus 6 months
Driver qualification files (only if FMCSA rules apply)	Employment plus 3 years (49 CFR 391.51(c))	Also follow your broker's credentialing file rules

The "practical hold" column is our recommendation, not a legal requirement. FMCSA rows apply only to commercial motor vehicles in interstate commerce, which leaves out many minivan and wheelchair van fleets. See our FMCSA Part 396 guide for the test.

Common audit failures and how to prevent them

• Scheduled times recorded as actual times. An auditor comparing GPS data to a log will catch it. Record actual arrival and drop-off times.
• Estimated mileage. Bill the mileage your state defines, usually the most direct route, and keep the method you used to calculate it.
• Missing signatures with no explanation. If a rider cannot sign, document why, following your state's and broker's rules.
• Untraceable edits. A changed trip with no record of who changed it, or why, invites a recoupment on that trip and a closer look at the rest.
• Records that leave with a vendor. Get a full export, including logs, before you cancel any dispatch or billing system.

A simple control: each month, pull a sample of billed trips and check each one for a user ID on every edit, system timestamps, signatures, GPS data and a matching claim. Our NEMT billing, claims and cash flow guide covers internal review in more depth, and grant audit risks in NEMT billing covers the extra documentation that grant-funded trips need.

Frequently asked questions

How long do NEMT providers have to keep trip records?

It depends on your state and contracts. Among the examples above, Texas, Florida and Minnesota set 5 years, Ohio and New York 6, and California 10. Managed care and broker contracts often add a 10-year term. Keeping trip and billing records 10 years from the date of service, or until any audit closes, covers most operators.

Does 42 CFR 431.17 require providers to keep records for six years?

No. 42 CFR 431.17 covers the state Medicaid agency's own records on applicants and beneficiaries, kept while a case is active plus at least three years. Provider record duties come from 42 CFR 431.107 and the state rules that implement it. The six-year figure usually traces back to HIPAA documentation rules, which do not cover trip records.

Are paper trip logs still allowed?

Where your state and broker accept them, yes. There is no 50-state rule either way. Paper records must still be complete, legible, contemporaneous, signed where required and produced on request. If your broker contract requires trips to be recorded in its app or portal, follow the contract.

Does electronic visit verification apply to NEMT?

Not under the federal mandate, which covers personal care and home health services. Minnesota has added NEMT to its state EVV law, effective January 1, 2027, or on federal approval, whichever is later. Check your state Medicaid agency for its own plans.

What happens to my records if I switch dispatch software?

Your retention duty stays with you, not the vendor. Before you cancel, export every trip record, signature, GPS file and audit log in a format you can open without the old system, and confirm the export is complete. Put export terms in the contract when you sign, not when you leave.

We cover NEMT compliance changes, including state EVV rollouts and broker contract updates, in our weekly newsletter. Subscribe to The NEMTrepreneur Dispatch.