HPD Lead Paint Audits: XRF Records NYC Owners Need

HPD's lead-based paint rules require owners to keep lead records for 10 years and provide them to HPD when requested. The issue for most landlords isn't whether testing happened — it's whether they can prove it on short notice.

HPD's guidance states that testing must be completed in all units and common areas, and that owners must keep testing records for 10 years. HPD can and does proactively audit lead records — not just in response to a complaint. (HPD Lead-Based Paint)

"You MUST keep and maintain the testing records provided by your contractor for 10 years and provide them to HPD when requested." — HPD Lead-Based Paint Program

For many small-building owners, the real risk looks like this:

• Testing was done, but the report is buried in an old vendor email thread
• Common areas (hallways, stairwells, lobbies) were missed entirely
• Tenant access affidavits were never completed for refused units
• A new managing agent inherited the building and cannot locate prior owner records

Any one of these gaps can turn a completed testing program into an open HPD violation.

Local Law 31 — part of New York City's lead paint safety framework — requires XRF (X-ray fluorescence) testing for lead-based paint in:

• All rental units that meet the criteria (pre-1960 buildings, or pre-1978 if a child under 6 lives there)
• All common and public areas in those buildings

Testing must be performed by an EPA-certified inspector or risk assessor using an XRF analyzer at the 0.5 mg/cm² action level. Failure to comply can result in a Class "C" immediately hazardous violation — the most serious HPD violation category — with civil penalties of $1,500 per unit or common area per violation. (HPD Local Law 31 XRF FAQ)

Key takeaway: you need two things — (1) testing completed at every required location, and (2) a records package you can produce within days of a request.

HPD audits are not random. They are typically triggered by one of the following:

• An open HPD violation related to lead paint or peeling paint in a pre-1960 building
• A tenant complaint — especially in a unit where a child under 6 lives
• A change of ownership or managing agent that flags the building in HPD's system
• Annual certification failures — if you didn't file the required Annual Apartment Inspection certification, HPD may follow up
• Building-wide audit sweeps — HPD periodically targets specific community districts or building types

Even buildings with no outstanding violations can be selected. The safest position is to assume an audit request could come at any time and organize records accordingly.

When HPD initiates a records review, it typically issues a Record Production Order giving the owner 45 days to submit documentation. (HPD Lead-Based Paint)

Here are the record types you should be able to pull within a day:

Record Type	What It Proves	Who Should Have It
XRF inspection report(s)	Which units/common areas were tested and results	EPA-certified inspector/vendor
Inspector credentials	The inspector was properly certified	Inspector/vendor
Building/unit list used for testing	Full scope: every unit + common areas	Owner/manager
Access letters + scheduling log	Documented attempts to enter each unit	Owner/manager
No-access/tenant refusal affidavit	Inability to test a specific unit	Owner/manager + inspector
Exemption documentation (if applicable)	Presumption rebuttal or exemption status	Owner/manager
Annual notification records	Tenants received required annual lead notices	Owner/manager

Missing any of these doesn't just fail the audit — it can create new violations separate from the original testing requirement.

Use this structure per building — paper binder or shared digital folder, either works. The goal: any staff member can produce the full package in under an hour.

Folder 1 — Property Profile

• Building address, BIN, BBL, unit count, year built
• Managing agent name and contact info
• Date testing was completed

Folder 2 — XRF Testing Package

• Full XRF report(s) for each unit (do not store as one combined file)
• Common area testing documentation: hallways, stairwells, lobbies, laundry rooms, basement
• Inspector's certification and firm information
• Chain-of-custody or delivery confirmation for the reports

Folder 3 — Access and Scheduling

• Tenant notices (written, dated, delivered or mailed)
• Scheduling log showing appointment dates per unit
• No-access affidavits for any unit where entry was refused or not possible

Folder 4 — Ongoing Lead Compliance

• Annual apartment inspection certifications (filed with HPD)
• Annual tenant notification letters
• Turnover unit work records (lead-safe work practices during renovation)

If you want a broader view of your annual compliance obligations, start with the NYC small building owner compliance checklist.

Keep your system realistic and easy for anyone to use — not just you.

• Name files consistently: {Address}_{Unit}_{YYYY-MM-DD}_XRF.pdf (e.g., 123MainSt_Apt3B_2024-06-15_XRF.pdf)
• Scan paper copies immediately after delivery — vendors often still deliver hard copies
• Back up in two places: a shared cloud drive (Google Drive, Dropbox) plus a local or offsite copy
• Create a one-page index for each building listing all units and their testing status: tested, date, result, and file location

A clear index is what saves you when HPD sends a 45-day deadline. You shouldn't have to search — you should just print and send.

If HPD issues a violation after a records audit, the consequences can stack quickly:

• Class "C" immediately hazardous violation — requires correction within 24 hours for active lead hazards
• Civil penalties starting at $1,500 per unit for recordkeeping failures
• HPD emergency repair: if HPD performs lead hazard correction itself, it bills the owner and places a lien on the property
• Referral to the Department of Law for repeat or egregious violations

Recordkeeping penalties are often avoidable — they don't require an actual lead hazard to exist. They just require you not to produce paper on time. That's the part most owners underestimate.

For context on how penalties work across other compliance areas, see the Local Law 97 and Local Law 84 May 2026 deadline guide and the LL84 benchmarking deadline post.

If any of these apply to your building, address it before an audit request arrives:

• You can't confirm every unit and common area was tested
• You're missing the inspector's certification paperwork
• You inherited a building and don't have records from the prior owner
• You have open lead-related HPD violations right now
• Your building recently turned over more than two units and you didn't document lead-safe work practices

HPD's own guidance includes additional forms, FAQs, and contact information for the lead-based paint program. (HPD Lead-Based Paint)