Section 431.17 - [Effective 6/3/2024] Maintenance of records(a)Basis and purpose. This section, based on section 1902(a)(4) of the Act, prescribes the kinds of records a Medicaid agency must maintain, the minimum retention period for such records, and the conditions under which those records must be provided or made available.(b)Content of records. A State plan must provide that the Medicaid agency will maintain or supervise the maintenance of the records necessary for the proper and efficient operation of the plan. The records must include all of the following: (1) Individual records on each applicant and beneficiary that contain all of the following: (i) All information provided on the initial application submitted through any modality described in § 435.907 of this chapter by, or on behalf of, the applicant or beneficiary, including the signature on and date of application.(ii) The electronic account and any information or other documentation received from another insurance affordability program in accordance with § 435.1200(c) and (d) of this chapter.(iii) The date of, basis for, and all documents or other evidence to support any determination, denial, or other adverse action, including decisions made at application, renewal, and as a result of a change in circumstance, taken with respect to the applicant or beneficiary, including all information provided by, or on behalf of, the applicant or beneficiary, and all information obtained electronically or otherwise by the agency from third-party sources.(iv) The provision of, and payment for, services, items and other medical assistance, including the service or item provided, relevant diagnoses, the date that the service or item was provided, the practitioner or provider rendering, providing or prescribing the service or item, including their National Provider Identifier, and the full amount paid or reimbursed for the service or item, and any third-party liabilities.(v) Any changes in circumstances reported by the individual and any actions taken by the agency in response to such reports.(vi) All renewal forms and documentation returned by, or on behalf of, a beneficiary, to the Medicaid agency in accordance with § 435.916 of this chapter, regardless of the modality through which such forms are submitted, including the signature on the form and date received.(vii) All notices provided to the applicant or beneficiary in accordance with § 431.206 and §§ 435.917 and 435.918 of this chapter.(viii) All records pertaining to any fair hearings requested by, or on behalf of, the applicant or beneficiary, including each request submitted and the date of such request, the complete record of the hearing decision, as described in § 431.244(b) , and the final administrative action taken by the agency following the hearing decision and date of such action.(ix) The disposition of income and eligibility verification information received under §§ 435.940 through 435.960 of this chapter, including evidence that no information was returned from an electronic data source.(2) Statistical, fiscal, and other records necessary for reporting and accountability as required by the Secretary.(c)Retention of records. The State plan must- (1) Except as provided in paragraph (c)(2) of this section, provide that the records required under paragraph (b) of this section will be retained for the period when the applicant or beneficiary's case is active, plus a minimum of 3 years thereafter.(2) For beneficiaries described in section 1917(a)(1)(B), (b)(1)(B) and (b)(1)(C) of the Act, provide that the records required under paragraph (b) of this section will be retained until the State has satisfied the requirements of section 1917(b) of the Act (relating to estate recovery).(d)Accessibility and availability of records. The agency must- (1) Maintain the records described in paragraph (b) of this section in an electronic format; and(2) Consistent with paragraph (e) of this section, and to the extent permitted under Federal law, make the records available to the Secretary, Federal and State auditors and other parties who request and are authorized to review such records within 30 calendar days of the request (or longer period specified in the request), except when there is an administrative or other emergency beyond the agency's control.(e)Release and safeguarding information. The agency must provide safeguards that restrict the use or disclosure of information contained in the records described in paragraph (b) of this section in accordance with the requirements set forth in subpart F of this part.44 FR 17931, Mar. 23, 1979, as amended at 51 FR 7210, Feb. 28, 1986