Home care audit preparation: ready every day, not every few years

September 23, 2026

For many home care agencies, an audit works like this. A letter arrives. Someone pulls the caregiver files, and whoever can be spared stops their real work to go through them, finding the expired certificate, the missing signature, the background check that was never filed. They fix what they can, send what was asked for, and promise themselves it will be different next time.

It usually is not, because the preparation happened for the audit rather than for the agency. Once the audit is over, the files slowly drift again.

The agencies that find audits boring are the ones that have made audit-readiness a normal state rather than a project. This article is about how to get there, with or without new software.

A note on rules: this explains what the rules say, using Virginia as the worked example. It is not legal advice. Requirements differ by state, by payer, and by whether you are licensed as a home care organization or certified as a Medicare home health agency, so check each point against your own licence and contracts.

In Virginia, a personal care agency that bills Medicaid answers to three layers of rules at once, and they are not the same rules:

Your licence, from the Virginia Department of Health: the Regulations for the Licensure of Home Care Organizations, 12VAC5-381.
Medicaid, from the Department of Medical Assistance Services (DMAS), if you provide waiver services: the provider rules in 12VAC30-120-930.
Federal law, which applies to everyone: the I-9, and the rule that Medicare and Medicaid pay nothing for services furnished by an excluded person. Medicare's conditions of participation (42 CFR Part 484) apply only if you are a Medicare-certified home health agency. A licensed personal care agency that is not Medicare-certified answers to its licence and its Medicaid contract, not to Part 484.

Mixing these up is the most common way to prepare for the wrong audit, or to keep a file for the wrong number of years.

Know which audit you are preparing for

"Audit" can mean several different things, and each one asks for different files.

A licensing survey by your state's health department, checking that you meet the conditions of your licence. In Virginia these are unannounced, happen at least every two years, and a plan of correction is due within 15 working days of the report (12VAC5-381-80).
A Medicaid review, by the state Medicaid agency or a contractor working for it, checking that what you billed was allowed and documented.
A managed care plan audit, if you bill through one, checking against your contract with that plan.
An accreditation survey, if you hold one.

Find out which of these apply to you, and get the checklist each one uses. Many state agencies publish theirs. That list, not a generic one, is what your files should be built around.

What auditors usually look at

Most reviews come back to three piles of paper.

Caregiver files. Is every person who worked a visit qualified, screened and trained, with proof on file within the time the rules allow?

Client files. Is there a written record of the client's needs, a plan of care and the required consents, and are they current?

Visit and billing records. Did the visit you billed actually happen, for the length you billed, by a qualified caregiver? If your state uses electronic visit verification, this is where it gets checked.

The rest of this article focuses on the caregiver files, because they are where most agencies struggle. There is a file for every caregiver, those files change every month, and one bad file can call every visit that caregiver worked into question.

What goes in a caregiver file, and how long you keep it

Here is Virginia, rule by rule, because it shows how the layers stack. Your state will differ in the details, not in the shape.

In the file	Keep it	Required by (Virginia)
Identifying information, education and training history, employment history	3 years after they leave (licence)	Licence: 12VAC5-381-200 O
A written job description for the position	3 years after they leave	Licence: 12VAC5-381-200 G
Verification of any professional licence or certificate	3 years after they leave	Licence: 12VAC5-381-200 C, D, O
References: results of reasonable efforts to get them (licence); at least two references, one of which may be personal if they have had only one employer (Medicaid)	3 years after they leave (licence); see the Medicaid note below	Licence: 12VAC5-381-200 O; Medicaid: 12VAC30-120-930 B 19 a
Criminal record report and sworn disclosure statement. Obtained within 30 days of employment, not dated more than 90 days before hire, original report only, kept in a locked file. No direct client contact until it arrives unless they work under direct supervision of someone already cleared. Medicaid won't pay for their visits from day 31 until it arrives	3 years after they leave	Code of Virginia § 32.1-162.9:1; licence: 12VAC5-381-110; Medicaid: 12VAC30-120-930 B 19 b
Exclusion screening against the federal List of Excluded Individuals/Entities (LEIE), for new and existing employees and contractors; any hit reported to DMAS in writing immediately	See the Medicaid note below	Medicaid: 12VAC30-120-930 B 1 and B 19 d
Form I-9	3 years after hire or 1 year after they leave, whichever is later	Federal: 8 CFR 274a.2(b)(2)
Qualifications for the job (for a home attendant: nurse aide certification, an approved training program, or DMAS's personal care aide curriculum, among the options listed)	3 years after they leave	Licence: 12VAC5-381-290
Training hours: at least 12 hours of in-service training a year for personal care aides; 40 hours of initial training for aides at agencies that are not VDH-licensed	3 years after they leave	Licence: 12VAC5-381-360 G; Medicaid: 12VAC30-120-930 J 4–5
Orientation, covering the topics the rule lists (confidentiality, client rights, mandated reporting, emergency preparedness, infection control and others)	3 years after they leave	Licence: 12VAC5-381-200 I, O 9
TB screening for personal care aides, "as specified in the criteria used by VDH"	See the Medicaid note below	Medicaid: 12VAC30-120-930 J 6 g. We found no TB rule in the licensure regulation.
Child Protective Services Central Registry check, if they serve children	See the Medicaid note below	Medicaid: 12VAC30-120-930 B 19 e
Performance evaluations, on the schedule your own policy sets	3 years after they leave	Licence: 12VAC5-381-200 J, O 6
Any disciplinary action, and any adverse action by a licensing body	3 years after they leave	Licence: 12VAC5-381-200 O 7–8
Health information, kept separately inside the file	3 years after they leave	Licence: 12VAC5-381-200 S

The Medicaid note. The licence says a personnel record is kept for at least three years after employment ends (12VAC5-381-200 Q). DMAS says a provider keeps "business and professional records sufficient to document fully and accurately the nature, scope, and details of the services provided" for at least six years from the last date of service, and until any audit that starts in that window is finished (12VAC30-120-930 B 12). The rule does not say in so many words whether that reaches personnel files. But a caregiver's qualifications are how you show a billed visit was allowed. So if you bill Medicaid, the safe course is to keep caregiver files for six years from that caregiver's last visit, and to ask your own adviser whether you must.

Client records have their own clocks: five years after discharge under the licence (12VAC5-381-280 I). For a Medicare-certified home health agency, five years after discharge under the federal conditions (42 CFR 484.110(c)). Either is extended where another rule sets a longer period.

What we did not find, so it is not on the list. Virginia's licensure and Medicaid rules that we read do not require CPR or first aid certification for personal care aides, and do not require a driver's licence or auto insurance on file. Your own policy, your insurer or a payer contract may. Treat those as your rules, not the state's.

Why checking expiry dates is not enough

Most tracking systems, including most spreadsheets, track one thing: when each document expires. That catches the certificate that lapsed last month. It does not catch the problems auditors actually find:

The document belongs to someone else, or the name does not match.
The date of birth or ID number on the document does not match the file.
The document was already out of date on the day the person was hired.
The form is unsigned, or a page is missing.
The person saw clients before their background check came back, without the direct supervision that the rules require in that gap.

Each of these looks fine on a list of expiry dates. Each one is a finding.

The fix is to check what a document says, not just when it expires, against what you know about that person: their name, their date of birth, their hire date, their role. You can do this by hand when a document comes in. It is slow, but it is far cheaper than finding the problem during an audit.

A monthly routine

Audit-readiness comes from a routine small enough that it actually happens. Once a month:

Run exclusion checks on everyone. Check every current employee and contractor against the federal exclusion list (the LEIE). Virginia's Medicaid rule requires screening new and existing staff, but it does not say how often (12VAC30-120-930 B 1). Monthly is a sensible pace because federal programs pay nothing for any service an excluded person furnishes (42 CFR 1001.1901(b)). A check done a year ago proves nothing about last month's visits. (The federal rule that says "monthly", 42 CFR 455.436, is the state's duty to check its providers, not a rule about your staff.)
Look ahead at expirations. Anything expiring in the next 60 days gets a reminder now, not when it has lapsed.
Check every new document when it arrives. Check its contents against the person, as above, before it is filed.
Pull a few files at random and audit them yourself. Use the auditor's own checklist. Whatever you find, the auditor would have found.
Match a sample of visits to bills. Pick a few billed visits and trace each back to a qualified caregiver and a verified visit.

Keep a one-line log of each month's routine: date, who did it, what they found, what was fixed. That log is itself evidence that your agency takes compliance seriously.

Build the audit package before anyone asks for it

When an auditor sends a request, they usually want a specific set of documents for a specific sample of people, in a specific order. The agencies that answer quickly have already decided how that package looks.

Keep one folder layout for every caregiver, in the same order as the auditor's checklist, so any file can be handed over as it is.
Know how you will produce a sample. If the auditor names ten caregivers, how long does it take you to assemble their ten complete files? Time it once, in a practice run.
Keep an index. A one-page list at the top of each file showing what is in it and when each item was last checked.

On the day

Give one person the job of being the auditor's point of contact.
Hand over exactly what is asked for, complete, in the order asked.
Keep a log of everything you handed over and when.
If something is missing, say so plainly and say when you will have it. Do not produce a document that did not exist before the audit.

What we built for a home care agency

We built MediSvault for a home care agency in Virginia working under Medicaid and Medicare requirements. It is built to do the routine above as a background process instead of a person's afternoon:

A document path for every applicant record, so every file is built the same way from the day someone applies.
AI that reads each submitted document and checks it against that person's own information, which catches the mismatches an expiry-date list misses.
Step-by-step screens for HR to keep watch over employees and contractors.
Monthly automated audit searches on employees, run by the system on a schedule.
A one-button audit package, which assembles the audit record in the form the auditor asks for, when it is asked for.

It is built on the agency's own system, and nobody is billed per user.

If you want this built for your agency: Angry Keyboard builds software around how your business already works. We bid the job, with one written estimate before any money moves. What we build, you own, and nobody is billed per seat.