You don't need to provide medical benefits to have a medical file. FMLA information, workers' comp information, and drug tests are all medical information that, under ADA, must be filed separately from the employee files. Many people take that to mean under separate lock and key.
I cannot speak to the records retention issue, but 1 year seems short to me. A drug test should be treated like a medical exam unless you can find legal authority that says otherwise.
If you store them en masse by year, I think you would really need to provide the absolute minimum of access to the files because anybody looking for any one record will have to page through many more, and inadvertently and unnecessasrily see a lot of other medical information.