Documentation that survives a Medicaid audit: a checklist for NEMT and adult day providers

Every Medicaid provider eventually gets the letter: a records request, a post-payment review, or an audit covering months of claims. For a small transportation company or adult day center, the outcome depends almost entirely on one thing. Can the records show, claim by claim, that the service was delivered as billed?

This is a practical checklist for NEMT and adult day providers. It is not legal advice, and it does not replace your state's provider manual or your broker or plan contract, which set the specific rules you are measured against. It is a way to check whether your records would hold up if someone asked for them tomorrow.

The federal baseline

The starting point is the provider agreement. Federal regulation at 42 CFR 431.107(b) requires state Medicaid plans to make providers agree to keep "any records necessary to disclose the extent of services the provider furnishes to beneficiaries," and to furnish information about those records and claims to the state Medicaid agency, CMS, or the state Medicaid fraud control unit on request.

Everything else, from required fields to signature rules to how long you keep records, comes from your state, your waiver, and your contracts. Retention periods in particular differ, so find the period in your provider agreement and contracts and follow the longest one that applies.

NEMT draws particular scrutiny. The U.S. Government Accountability Office's 2016 review of Medicaid NEMT found that states reported challenges with program integrity and oversight of transportation vendors, and Congress added federal NEMT provider and driver requirements in 2021.

The four questions every record must answer

Whether it is a trip or a day of attendance, reviewers are testing the same four questions. We wrote about this in the record is the product:

• Who received the service, and were they eligible and authorized?
• When was it delivered: date and actual times, not scheduled ones?
• Where did it happen: pickup and drop-off addresses, or the center?
• Says who: which staff member or driver delivered it, and what evidence confirms it?

Checklist for NEMT providers

For every trip

• Member name and Medicaid ID, matched to the trip authorization or broker trip number.
• Date of service and level of service (ambulatory, wheelchair, stretcher, or as your contract defines them).
• Pickup and drop-off addresses, matching the authorization or with a documented reason for any change.
• Actual pickup and drop-off times, captured at the stop rather than reconstructed later.
• Driver and vehicle used, which should match the vehicle and driver rosters on file.
• Mileage, if you bill by the mile, consistent with the route.
• Proof of delivery as your contract requires, often a member or facility signature, with a documented reason when a signature could not be obtained.
• Outcome for every trip that did not complete: no-show, cancellation, or member refusal, with the time and who recorded it.

For every driver and vehicle

• Valid driver's license on file and current.
• Exclusion screening against the HHS-OIG List of Excluded Individuals/Entities and any state list, with dates checked.
• Driving history and your process for drug law violations, which section 1902(a)(87) of the Social Security Act requires providers to have, as summarized in this CMS bulletin.
• Vehicle registration, insurance, and inspection records your state or broker requires.
• Training records your contract requires.

Checklist for adult day providers

For every participant

• Current eligibility and service authorization, with authorized days or units and the effective dates.
• The current service or care plan, signed and dated as your state requires, and reviewed on schedule.
• Intake assessment and any required reassessments.

For every day of attendance

• Participant name and date.
• Arrival and departure times, captured when they happen.
• Who recorded the check-in and check-out, by name or role.
• Services delivered that day that your state requires you to log, such as meals, personal care, nursing, or activities, tied to the plan.
• Absences and partial days, with reasons where your rules require them.

The federal EVV mandate does not generally cover adult day services, since they are not delivered through an in-home visit, but your state may have its own requirements. See EVV in 2026.

Habits that make records hold up

• Capture at the moment. A timestamp taken at the door or the curb beats a recollection typed in later.
• Attribute every entry. Anonymous entries are easy for a reviewer to discount.
• Never overwrite. Correct with a new entry that shows who changed what, when, and why. The original stays visible.
• Reconcile before billing. Compare delivered services to authorizations before claims go out. A mismatch caught in-house is a correction. Caught in an audit, it is a recoupment.
• Make retrieval boring. Practice pulling ninety days of trips or six months of attendance. If it takes a week, fix it before someone asks.

Where software helps, and where it does not

No software makes a provider compliant. Compliance comes from following your state's rules every day. Good tools make the right habits the default. Prasar Health builds ZeitRide and Adult Day Genie, two independent products, around capture-at-the-moment, attributed, append-only records, because those are the properties reviewers test. Whatever system you use, hold it to the checklist above.

Frequently asked questions

What records does Medicaid require providers to keep?

Federally, 42 CFR 431.107(b) requires providers to keep any records necessary to disclose the extent of services furnished and to provide them on request. The specific fields, signatures, and formats come from your state, waiver, and contracts.

How long should Medicaid providers keep records?

It depends on your state provider agreement and your broker or managed care contracts. Find the retention period in each and follow the longest one that applies to you.

What should an NEMT trip record include?

Member and authorization, date, level of service, pickup and drop-off addresses, actual pickup and drop-off times, driver and vehicle, mileage if billed, and the proof of delivery your contract requires, such as a signature.

What should adult day attendance records include?

Participant, date, actual arrival and departure times, who recorded them, services delivered as your state requires, and absences, all tied to a current authorization and service plan.

Can I correct a record after the fact?

Yes, but corrections should be new, attributed entries that keep the original visible, showing who changed what, when, and why. Silent overwrites are what make records hard to defend.