How Long Do You Have to Keep EVV Records?
Keep EVV visit records at least six years in most cases. State Medicaid rules usually run six years from payment, FLSA requires three, and audits extend the clock.
By Caregiver Scheduling Team ·
Keep EVV records for at least six years, and longer if an audit starts before the period ends. No single federal rule sets an EVV retention period. Instead, your state Medicaid provider agreement usually requires six years from payment, the FLSA requires three years for payroll records, and the False Claims Act lets the government look back six to ten years. When rules differ, keep everything for the longest one.
Which rules set the retention period?
Several overlap, and the longest one controls. Here are the ones that reach an EVV record.
| Rule | What it covers | Period | Source |
|---|---|---|---|
| State Medicaid provider rules | All records supporting a claim | Often 6 years from payment, extended through any audit started in that window (Ohio example) | Ohio Adm. Code 5160-1-17.2 |
| Federal Medicaid provider agreement | Records that disclose the extent of services furnished | No fixed period; the state sets it | 42 CFR 431.107 |
| False Claims Act | How far back a false-claim case can reach | 6 years, up to 10 | 31 U.S.C. 3731(b) |
| FLSA payroll records | Pay, hours, deductions | 3 years from last entry | 29 CFR 516.5 |
| FLSA time cards and schedules | Daily start and stop times, wage rate tables | 2 years | 29 CFR 516.6 |
| IRS employment tax records | Payroll tax filings and support | At least 4 years after the fourth-quarter return | IRS |
| HIPAA Security Rule documentation | Required policies, risk analyses, access logs | 6 years from creation or last effective date | 45 CFR 164.316 |
An EVV record is a time card, a claim support document and protected health information at once, so several rows apply to it. See home care record retention for the rest of your files.
What exactly counts as an EVV record?
Everything needed to show the visit happened as billed, plus every change made afterward. The Cures Act requires six data elements for each visit: service type, individual served, date, location, individual providing the service, and start and end times (42 U.S.C. 1396b(l)).
| Record | Why you need it |
|---|---|
| Original check-in and check-out, with method (GPS, telephony, device) | Proof of the visit as captured |
| Location data and geofence result | The location element, and your defense if it is questioned |
| Exceptions, reason codes and who approved them | Shows why a visit differed from the schedule |
| Every edit, with the before value, after value, user and timestamp | Shows corrections were documented, not hidden |
| Visit notes and task completion | Care delivered, which the claim depends on |
| Authorization in effect on the visit date | Basis for billing the units |
| Timesheet and payroll run built from the visit | Wage and hour compliance |
The edit trail matters most. Texas, for example, gives providers 95 calendar days from the date of service to complete visit maintenance (Texas HHS EVV Policy Handbook). An auditor will ask what a corrected visit looked like before, and who changed it. See EVV exception codes and EVV required data elements.
Does the state aggregator keep the records for me?
Partly, but don’t rely on it. The aggregator holds what your system sent, in the state’s format. It does not hold your edit history, notes, authorizations or payroll. The provider agreement puts the duty to keep records on you, not on the vendor or the state (42 CFR 431.107).
If you switch software, export the full visit history, including edits and exception codes, before the old contract ends. See switching home care software.
When does the retention clock start?
It depends on the rule, so count from the latest trigger. Ohio counts six years from the date of payment, not the date of service, and the clock pauses for any audit opened inside that window. FLSA payroll records count from the last entry. HIPAA documentation counts from the date it was created or last in effect, whichever is later.
Practical rule: keep each year’s EVV records for six full years after the last payment for that year, and keep everything while any audit or records request is open.
How should you store EVV records?
Electronically, backed up, searchable by client, caregiver and date, with access limited by role. If pulling one client’s visits for a date range takes days, your storage is the problem.
- Keep originals and edits in the same system.
- Put the retention schedule in your compliance calendar with a yearly review date.
- Document who may delete records and require a second approval. See the HIPAA checklist for home care.
How Caregiver Scheduling handles this
Every visit keeps its original check-in and check-out alongside each later edit, with the user and time of the change, in a permanent audit log. Exception reasons, approvals and notes are stored on the visit. The full history exports by client, caregiver or date range. $199/month for up to 10 caregivers or $299/month for up to 50, free for 30 days.
FAQ
Can I delete EVV data after the claim is paid? No. The retention clock usually starts at payment. Keep the record for the full period, and longer if an audit is open.
Who is responsible for keeping EVV data, the state or the agency? You are. The state aggregator holds a copy, but the provider agreement requires you to keep records that support every claim.
Do I have to keep the original visit data if it was corrected? Yes. Keep the original value, the corrected value, the reason code and who made the change. A corrected visit without its history looks like a fabricated one.
This article is general information, not legal advice. Check your state Medicaid agency’s record retention rules.