Hiring Medical Billers, Coders and Revenue-Cycle Staff: The Employer Guide

Start from the work, not the title.

A medical coder assigns the diagnosis and procedure codes for patient care, population health statistics and billing purposes; BLS describes coders as acting as the liaison between health care providers and billing offices.

A medical biller calculates charges, generates bills, reviews documents such as charge slips to calculate fees due, and contacts customers about accounts.

Around that pair sit the rest of the revenue cycle.

Front-end roles — prior authorization, insurance verification and patient access — clear patients, referrals and payment expectations before service.

Back-end roles — accounts receivable follow-up, denial management, payment posting, charge entry and collections — work the claim after it goes out.

Credentialing specialists keep providers enrolled with payers, while coding auditors, CDI specialists and revenue integrity analysts watch the quality side.

Two placement rules keep the decision honest.

A combined billing-and-coding role puts both sides of the claim in one position — the natural first hire while volume is too small to split the work.

Split coding from billing once coding quality and claim follow-up each need a full workload, and let your own audit results and aging receivables tell you which side is short-handed first.

(The worker's side of that combined role — training, credentials, career path — lives in the medical billing and coding specialist career guide.)

Where the work lives is worth knowing too.

Medical records specialists held about 200,700 jobs in 2025, and BLS counts hospitals (28%) and offices of physicians (18%) among their employers, followed by professional, scientific and technical services (10%), administrative and support services (8%) and management of companies (7%).

Front-end hiring has a new clock to plan around.

CMS's Interoperability and Prior Authorization final rule (CMS-0057-F) requires impacted payers to send prior authorization decisions within 72 hours for expedited requests and seven calendar days for standard requests, with operational provisions generally starting January 1, 2026.

The payers in scope are Medicare Advantage organizations, state Medicaid and CHIP programs and their managed care plans.

Once you know which role you need, look at what candidates see: the medical coder, medical biller and billing and coding specialist listings show how employers describe the same work — setting, specialty mix, systems and credential expectations.

Start with the market you are hiring into.

In an AHIMA-commissioned NORC survey of about 2,500 health information professionals (fielded August 2023, released November 1, 2023), 66% of respondents reported persistent staffing shortages over the previous two years and 83% saw unfilled health information positions increase or persist over the past year.

Write the posting around the work, not the résumé stack: setting, specialty, code sets, systems and the credential line.

BLS says medical records specialists typically need a postsecondary certificate to enter the occupation, though some qualify with a high school diploma, and that certification may be required or preferred.

BLS also notes employers may prefer to hire certified applicants, or expect applicants to earn certification shortly after being hired.

If you will consider apprentice-status coders, say so in the posting.

A CPC-A tells you the candidate passed AAPC's CPC exam without two years of coding experience yet — the same exam, an apprentice designation rather than a different credential.

Expect paperwork on your side too: only an employer, supervisor or HR department can verify a coder's coding time for apprentice removal, on company letterhead, hand signed, dated with current contact information and provided as a non-editable PDF.

Source where credentialed people already gather.

AAPC says its members have access to nearly 400 local chapters that collectively host over 3,000 events per year, with finding or sharing job opportunities listed among the chapter benefits.

Structure helps on your side: build interview questions around scenarios from your own claim types, and score every candidate on the same work sample.

When the role is defined, post the job with pay, setting and credential expectations stated plainly.

Anchor the offer to labeled federal data, then adjust for your market and specialty.

BLS has no "medical coder" or "medical biller" occupation.

Use the closest available groups, each labeled as such.

• Coders: medical records specialists (SOC 29-2072, a group that also includes records staff who do not code) earned a median of $51,140 a year in May 2025, with the middle half earning between $43,490 and $64,820.
• Billers: billing and posting clerks (SOC 43-3021, all industries) earned a median of $48,500, with the middle half between $42,840 and $58,290.
• Billing and coding managers: medical and health services managers (SOC 11-9111) earned a median of $123,860, with the middle half between $94,700 and $166,100. That group spans all of healthcare management from clinic managers to hospital executives, so the median reads high for a billing-office seat.

Two movement numbers sit behind those medians.

BLS projects medical records specialists employment to grow 7.8% from 200,700 in 2025 to 216,300 in 2035, with about 14,000 openings a year on average.

Billing and posting clerks employment is projected essentially flat (-0.1%), but BLS still projects about 37,000 openings a year in that larger occupation.

Survey data fills in what the occupation codes hide — read it as a credential seller's self-reported survey, not BLS.

AAPC's 2026 salary report, built on its 2025 survey, reports certified medical records specialists averaging $67,260 versus $55,721 for non-certified respondents, a 20.7% gap.

Budget the package, not just the wage.

BLS's Employer Costs for Employee Compensation release (June 2026) puts private-industry compensation at $46.89 per hour worked, with benefits averaging 30.0% of the total ($14.07) — and 31.5% for full-time private workers.

Expect pay pressure too: in the 2023 AHIMA/NORC survey, local pay constraints (59% of respondents) and salaries not competitive with remote jobs elsewhere (51%) ranked among the top-three recruiting issues, and a limited local talent pool ranked there for 53%.

Our research found no published market norms for bonus, incentive or per-chart pay structures; whatever you adopt becomes your own policy.

Have the wage-hour questions — overtime, regular rate, exempt status — confirmed with the DOL Wage and Hour Division or counsel before you finalize a pay plan.

All three models work; they fail in different ways.

In-house gives you direct control of a team you hire, train and screen.

Remote widens the pool: in the 2023 AHIMA/NORC survey, 40% of respondents said their organization increased its number of remote workers as it addressed recruitment issues.

Outsourcing trades headcount for a vendor relationship governed by a business associate agreement and a service contract.

If you outsource, the compensation structure has Medicare rules of its own.

Medicare may pay a billing agent in the provider's name only if the agent's compensation is not related in any way to the dollar amounts billed or collected and is not dependent on actual collection, among other conditions (42 CFR 424.73(b)(3)).

CMS's Claims Processing Manual says those conditions do not apply when the agent merely prepares bills and does not receive and negotiate the provider's checks — which means percentage-of-collections fees are a permitted structure where Medicare payments go to the provider's own account.

OIG, separately, has a longstanding concern that percentage-based billing arrangements may increase the risk of upcoding.

Read both against your own arrangement and confirm the structure with health-care counsel before you sign.

Remote hires pull HIPAA's safeguards home with them.

The Security Rule's workstation-use and physical-safeguard policies apply to every workstation that accesses ePHI — home workstations included — so settle equipment, workspace and access policy before the first remote start date.

The technical safeguards — unique user identification, automatic logoff, encryption and audit controls — are the remote-access checklist to work through.

Offshore staffing has two federal anchors to know.

HHS notes the HIPAA Rules contain no requirements specific to ePHI handled outside the United States, but that offshore risks must be considered in the Security Rule risk analysis when a cloud provider stores ePHI abroad under a BAA.

And the Medicaid statute bars states from making Medicaid payments for items or services to any financial institution or entity located outside the United States.

Payer contracts can add their own limits — read yours, and ask counsel where the answers are unclear.

Test the job, not the interview polish.

AAPC markets Practicode Team Assessments to employers for evaluating candidates and staff on standardized, real-world coding cases across 19+ specialties, tracking accuracy and speed — one structured option; a work sample built from your own claim types works too.

Whatever you use, give every finalist the same exercise.

Verify credentials at the issuing body — never from a certificate image.

AAPC's online verification tool confirms a member's credentials using the member ID or email plus last name, and returns the credential, earned date, renewal date and status; once apprentice removal is approved, AAPC says the credential updates to CPC in its verification systems.

AHIMA verifies credentials with the person's last name plus the credential number or AHIMA ID.

Read each tool's terms: AAPC's is for verifying an individual's credentials only, compiling data or other commercial use is prohibited, and AAPC cannot guarantee absolute accuracy — so confirm the identifier belongs to the person you are checking.

For credentials from other bodies (ACDIS, NHA, HFMA, AAHAM, NAMSS), ask the issuing body how to confirm a credential is current.

Then screen for exclusion, before day one and on a cycle.

OIG says entities should check the List of Excluded Individuals/Entities (LEIE) before employing or contracting with anyone and periodically afterward — and because OIG updates the LEIE monthly, OIG says screening each month best minimizes potential overpayment and civil monetary penalty liability.

OIG's compliance guidance lists monthly screening of the LEIE and state Medicaid exclusion lists among its examples of routine compliance monitoring, and OIG publishes the LEIE as a searchable database, a downloadable CSV and monthly supplement files.

The stakes are concrete: OIG says anyone who hires an individual or entity on the LEIE may be subject to civil monetary penalties, and health care entities should routinely check the list for new hires and current employees.

OIG's exclusions FAQ adds that the payment ban applies regardless of who submits the claims and covers all administrative and management services the excluded person furnishes — language that reaches billing and coding staff.

OIG's 1998 billing-company guidance adds a background-investigation step for new employees with discretionary authority over compliance-related decisions: a reference check and disclosure of criminal convictions or exclusion actions.

Training starts on day one, and part of it is regulation.

The HIPAA Privacy Rule (45 CFR 164.530(b)(1)) requires training all members of the workforce on the entity's PHI policies and procedures, as necessary and appropriate for their functions.

New workforce members must be trained within a reasonable period after they join — and the rule sets no fixed annual frequency.

The "at least annually" habit comes from OIG's General Compliance Program Guidance, which recommends compliance-program training at least annually for all employees and contractors, guided by an annual training plan.

The Security Rule adds a security awareness and training program for all workforce members including management.

And the Privacy Rule's "workforce" is broader than payroll: employees, volunteers, trainees and other people whose conduct is under your direct control, whether or not you pay them — contractors who touch your PHI are inside these duties.

Document the training you deliver; the rule requires it, and confirm current HIPAA training expectations against HHS OCR's guidance.

OIG's physician-practice guidance sketches the ramp: new coding and billing staff should be trained as soon as possible and work under an experienced employee until training is complete.

Put the pairing and the training plan in writing so the standard survives turnover.

Then measure the work with defined metrics and set targets from your own baseline — the definitions are public, the targets are yours.

HFMA's MAP Keys (2023 edition) define 29 revenue-cycle KPIs in five groups, including these four:

• Clean Claim Rate (CL-1) — claims that pass edits requiring no manual intervention on the first scrub, divided by the claims accepted into the claims processing tool for billing.
• Remittance Denial Rate (AR-5) — total claims denied divided by total claims remitted, counting actionable denials that can be corrected and resubmitted.
• Net Days in A/R (FM-1) — net A/R divided by average daily net patient service revenue.
• Cost to Collect (FM-6) — total revenue cycle cost divided by total patient service cash collected.

Use them as a shared vocabulary with your team — and with a billing company, if you outsource — and rebuild your targets each year from your own audit results and payer mix.

Retention is where the pay conversation earns itself back.

In the 2023 AHIMA/NORC survey, compensation was the top driver of health information turnover.

Burnout ranked second, named most impactful by 28% of respondents — and by 41% in revenue-cycle vendor settings, where it ranked first.

And 21% named lack of remote or hybrid flexibility as the most impactful driver.

Among survey respondents, 45% said their organization increased pay, 40% increased the number of remote workers, 28% increased training opportunities and 22% increased reliance on automation and machine learning, while 20% said their organization was taking no action.

The same release names the cost of leaving seats empty: understaffing tied to reduced reimbursement, increased claims denials, lowered patient data quality and slower information releases, with shortages described as notable in revenue cycle management.

Backfill slowly and the losses compound quietly.

A billing company is an employer and a business associate at once, and both halves carry homework.

Billing, claims processing and practice management are among HHS's examples of activities that make a vendor a business associate when PHI is involved.

That makes a business associate agreement with every client foundational, and any subcontractor that creates, receives, maintains or transmits PHI for you needs its own BAA before PHI flows.

Since the HITECH Act and HHS's 2013 Omnibus final rule, business associates have been directly liable for certain HIPAA violations, including failing to enter BAAs with their own subcontractors.

Two more rules attach early.

If you will submit claims into Medicaid on a provider's behalf, state Medicaid plans must require any agent, clearinghouse or other alternate payee that submits claims for a provider to register with the state and the HHS Secretary (42 U.S.C.

1396a(a)(79)).

And if a client routes Medicare payments through you, the billing-agent compensation condition from the outsourcing section above applies.

Have health-care counsel review your service agreements, and confirm registration steps with the state Medicaid agency before your first client goes live.

Growth, then, is a staffing problem dressed as a sales problem.

The shortage data above — 66% of surveyed health information professionals reporting persistent shortages, with shortages described as notable in revenue cycle management — describes both the market you sell into and the labor market you hire in.

Report client results in defined metrics from the start; the MAP Keys definitions above serve as a client-facing vocabulary as well as an internal dashboard.

And when you hire your own billers and coders, everything in this guide applies to you twice: once as the employer, and once as the business associate your clients trust with their PHI.

Employer information, not coding, billing-compliance, legal or tax advice. The rules named here belong to their agencies — OIG, HHS OCR, CMS and the DOL — and they change. Confirm screening, training, contracting and pay decisions with the agency or payer named, and with a CPA or health-care counsel where classification, tax or contracts are involved.