Medicaid Records Retention in New York

For healthcare providers, managed care organizations, and social service agencies throughout New York State, Medicaid records represent some of the most sensitive and highly regulated documentation in existence. New York Medicaid — administered jointly by the New York State Department of Health and the federal Centers for Medicare & Medicaid Services (CMS) — imposes strict records retention requirements on providers who bill the program. Understanding New York Medicaid records retention requirements is essential not only for regulatory compliance but also for protecting patient privacy and managing the risk of audit and recoupment actions.

New York City’s healthcare system is one of the largest in the country, and Medicaid is the dominant payer for millions of New Yorkers in the Bronx, Brooklyn, Queens, Staten Island, and northern Manhattan. Hospitals, physician practices, home health agencies, behavioral health providers, and Medicaid Managed Care Organizations (MMCOs) throughout the metro area must all navigate the complex landscape of Medicaid records retention — and plan for secure destruction of records once they reach the end of their retention period.

New York Medicaid Records Retention Requirements

The New York State Department of Health’s Office of the Medicaid Inspector General (OMIG) requires that providers retain records relating to Medicaid claims for at least six years from the date of service or the date of payment, whichever is later. This six-year requirement is more stringent than the standard HIPAA minimum of six years from creation or last effective date, and New York providers must apply whichever requirement results in a longer retention period.

Documents that must be retained under New York Medicaid requirements include:

• Medical records, clinical notes, and treatment plans for Medicaid beneficiaries
• Claims and billing records, including encounter data for managed care
• Prior authorization requests and approvals
• Explanation of Benefits (EOB) documents and remittance advices
• Cost reports (for hospitals and nursing facilities)
• Contracts and agreements related to Medicaid service delivery
• Employee credentialing and supervision records relevant to service delivery

Notably, the six-year clock restarts if a claim is amended, disputed, or subject to an audit or investigation. During any open audit or fraud investigation, records must be retained indefinitely until the matter is resolved. Our compliance shredding services can help you manage records destruction in coordination with your legal and compliance teams.

HIPAA and Medicaid: Overlapping Privacy Requirements

New York Medicaid records are subject to both HIPAA and state Medicaid privacy requirements. The more protective standard applies in cases of conflict. For paper-based Medicaid records, this means:

• Records must be stored securely during the retention period, with access limited to authorized personnel
• Disposal must use secure destruction methods — HIPAA requires that paper PHI be destroyed so it cannot be reconstructed
• Disposal must be documented — organizations should retain evidence of destruction for compliance purposes

For most New York healthcare providers, the practical requirement is cross-cut shredding of paper Medicaid records by a certified vendor. Strip-cut shredding is generally not considered sufficient for HIPAA-compliant destruction of protected health information. New York Shredding Document Destruction, Inc. uses industrial-grade cross-cut equipment and provides a certificate of destruction after every service, giving your organization the documentation it needs for HIPAA and Medicaid compliance.

Medicaid Audit Risk and the Importance of Complete Records

The New York OMIG conducts thousands of audits annually of Medicaid providers across the state. Medicaid audits focus on whether claims were properly documented, services were medically necessary, and billing was accurate. Organizations that cannot produce complete records for the six-year retention period face recoupment of Medicaid payments — sometimes running into hundreds of thousands or even millions of dollars.

For paper-based records, this means taking a systematic approach to storage and organization during the retention period, and not destroying any records until the full retention period has expired. Organizations with high volumes of Medicaid patients — community health centers in the South Bronx, large hospital systems in Brooklyn, home health agencies serving Nassau County — often accumulate enormous volumes of paper Medicaid documentation that must be organized, stored, and eventually destroyed in compliance with OMIG requirements.

A professionally managed shredding program with scheduled pickup and documented destruction helps ensure that records are not destroyed prematurely — and that when destruction does occur, it is verifiable. Explore our how it works page to understand our chain-of-custody process from pickup to destruction.

Practical Records Management for New York Medicaid Providers

Managing Medicaid records effectively requires a structured program. Here are key steps for New York healthcare organizations:

1. Create a Medicaid-specific records retention schedule. Document every category of Medicaid-related record your organization maintains, with specific retention periods and applicable regulatory citations. Include both clinical and administrative records.
2. Label records by patient, date of service, and retention expiration. Clear labeling enables efficient retrieval during audits and systematic destruction when records expire.
3. Implement secure storage during retention. Medicaid records containing PHI must be stored in locked, access-controlled environments. Map your storage locations and restrict access to authorized personnel.
4. Coordinate destruction with your compliance and legal teams. Before destroying any Medicaid records, confirm that no audit, litigation hold, or open investigation applies to those records. Document the legal clearance before proceeding.
5. Use certified shredding and retain certificates. Retain the certificate of destruction from your shredding vendor as part of your compliance documentation. File it with your Medicaid compliance records.

Managed Care Organizations and Encounter Data Requirements

Medicaid Managed Care Organizations (MMCOs) operating in New York — including major plans serving New York City communities — have additional records retention obligations beyond those of individual providers. MMCOs must retain encounter data, capitation records, and network provider documentation, and are subject to CMS, OMIG, and New York State Department of Health oversight.

For large MMCOs with operations across New York City and the surrounding metro area, managing physical Medicaid records requires a robust program that includes both digital and paper components. New York Shredding provides flexible service options for organizations with large volumes of Medicaid records requiring destruction, including scheduled shredding, one-time purge events, and secure collection programs. Our services page details available options for healthcare organizations.

Whether you are a solo practitioner in the Hudson Valley, a multi-site behavioral health provider in Brooklyn, or a large hospital system managing Medicaid records across multiple facilities, New York Shredding offers certified, documented destruction services that support your New York Medicaid records retention compliance. Contact us for a custom quote based on your volume and service frequency needs.

Why New York Businesses Choose New York Shredding

For over a decade, New York Shredding Document Destruction, Inc. has helped businesses across New York City, Long Island, Westchester, and the Hudson Valley protect their sensitive information through certified, HIPAA-compliant shredding services. Our industrial-grade shredding equipment, locked on-site consoles, and Certificate of Destruction give your business the proof it needs for any compliance audit.

Whether you need scheduled shredding, a one-time purge, or hard drive destruction, we serve all five boroughs and surrounding areas with fast, reliable service. Request a free quote today and get your office on a shredding schedule that keeps you protected year-round.

Ready to get started? Contact New York Shredding for a free quote, or explore our full range of shredding services designed to support New York Medicaid records retention compliance.