Record Retention Policy

 Why we have this policy

When you work with us on credentialing, provider enrollment, payer contracting, state licensing, accreditation readiness, compliance monitoring, or background screenings, we create and receive records on your behalf. Some of those records are ones you may need later for a Medicare, Medicaid, state licensing, or health plan audit. Some contain protected health information (PHI) that we hold as your business associate. This policy explains what records we keep, how long we keep them, how we protect them, and how we dispose of them when they are no longer needed. We keep records as long as the law, our agreements with you, and good business practice require, and no longer.

What records we keep

Our records fall into a few groups. Engagement records include your service agreement, business associate agreement, invoices, and our correspondence with you. Work files include the applications, CAQH profiles, Medicare and Medicaid enrollment submissions, state licensure applications, payer contracting packets, portal confirmations, and approval letters we prepare or receive for you. Deliverables include the compliance reports, policy manuals, readiness workbooks, audit findings, and training materials we produce. Screening records include the confirmations and eligibility results from background screenings we facilitate. Where an engagement involves a review of claims, billing, or clinical documentation, we may temporarily hold PHI belonging to your clients or patients, and we handle it under the business associate agreement between us.

How long we keep them

The periods below are minimums. Where your agreement with us, a health plan contract, or a court order requires a longer period, we follow the longer period.

We keep service agreements, business associate agreements, and invoices for seven years after the agreement ends. We keep credentialing, enrollment, licensing, and contracting work files, including every submission and confirmation, for seven years after your engagement closes or after our last submission for you, whichever is later. We keep the reports, manuals, workbooks, and other deliverables we produce for you for seven years after your engagement closes. We keep claims, billing, coding, and compliance review work papers for ten years from the date of the claims or services reviewed. We keep background screening confirmations and results for five years after the screening. We keep general correspondence not tied to an engagement for three years. PHI we hold as your business associate is kept only for as long as the engagement requires and is returned to you or destroyed when it ends.

These periods track the retention rules our clients are held to, including the seven-year Medicare documentation period in 42 CFR 424.516(f), state Medicaid record retention requirements, which vary by state and commonly run five to seven years, the ten-year period that Medicaid managed care plans apply to claims records under 42 CFR 438.3(u), and the six-year HIPAA documentation period in 45 CFR 164.316 and 164.530. Keeping our files on the same clock means that if you are audited years after we finished your enrollment, the submission history is still available to you.

How we protect your records

Records are stored in access-controlled systems and are available only to the members of our team who need them for your engagement. Records containing PHI or personal information are encrypted in transit and at rest, are never stored on removable media or personal devices, and are limited to the minimum necessary for the work. Our team is trained on HIPAA and on this policy, and every team member signs an acknowledgement of their obligations. Vendors that store or destroy records for us do so under written agreements, including business associate agreements where PHI is involved.

What happens to PHI when your engagement ends

When an engagement that involved PHI closes, we return the PHI to you or destroy it, as your business associate agreement provides, and we do not keep copies. In the limited situations where PHI is embedded in work papers we must retain to document our work, we de-identify it where practicable, keep only what is necessary, document the reason, and continue to apply HIPAA safeguards for as long as it is held.

How we dispose of records

When a retention period ends and no legal hold applies, we destroy the records securely. Paper is cross-cut shredded, on site or by a bonded vendor that provides a certificate of destruction. Electronic records are deleted from our systems and from any synchronized locations, and devices and media are sanitized before reuse or disposal using methods consistent with NIST Special Publication 800-88. Every destruction event is approved in advance and logged. These practices are consistent with the HIPAA Security Rule, the federal FCRA Disposal Rule, and applicable state data disposal laws.

Legal holds

If we learn of litigation, a government or payer audit or investigation, a subpoena, or a dispute that involves your records, we suspend destruction of the affected records until the matter is resolved, even if their retention period has ended.

Requesting your records

You may request copies of the submissions, confirmations, and deliverables we hold for your organization at any time during their retention period. Send requests to info@helpinghandstc.com from an authorized representative of your organization. Requests that involve PHI are handled under your business associate agreement and applicable law.

Changes to this policy

We review this policy at least once a year and update it when laws, payer requirements, or our practices change. The current version is always posted on this page with its effective date.

Questions

Helping Hands Credentialing, 1840 West 49th Street #723, Hialeah, Florida 33012. Email info@helpinghandstc.com or call (888) 483-8044.