How to Hire a Health Information Technician: Credentials, Sourcing and Screening

Start from the work, not the title. O*NET lists Health Information Technician among the sample job titles for medical records specialists (SOC 29-2072), and the same sample-title list includes RHIT, HIM Clerk, Coder and Medical Coder. That spread is one reason a posting under this heading can range from records desk work to coding support. The career-side picture of the role belongs to our guide to what a health information technician does; this page stays on the hiring decision.

O*NET's task list for the occupation is your day-one checklist: identifying, compiling, abstracting and coding patient data using standard classification systems, and resolving or clarifying codes or diagnoses with conflicting, missing or unclear information by consulting doctors. Translate that into your own environment before you post. Name the records system and EHR the hire will work in, how a release-of-information request moves from validation to logging to delivery, and who they escalate to when documentation is incomplete.

Decide which band you are hiring. BLS counts a separate occupation, health information technologists and medical registrars (SOC 29-9021), where O*NET's sample tasks include assigning patients to diagnosis-related groups using computer software. BLS's projections table also lists a different typical entry education for the two bands: an associate's degree for health information technologists versus a postsecondary nondegree award for medical records specialists. Write the posting for the band you actually need.

Set schedule expectations up front. Per BLS, most medical records specialists work full time, and in always-open facilities such as hospitals they may work shifts including nights or weekends. If your department covers weekends or runs a release-of-information queue against turnaround commitments, say so before the interview, not after the offer.

Budget against a stand-in, because the BLS wage and projections tables we pulled carry no occupation titled health information technician. The closest groups are medical records specialists (SOC 29-2072; median $51,140) and health information technologists and medical registrars (SOC 29-9021; median $68,020), both OEWS May 2025 national figures. Neither is an HIT wage — label both as the nearest available stand-ins when you take either number into a budget meeting.

Then write the day-one list into the posting itself: systems named, setting named, the record types handled, and whether the seat touches coding support or release of information. Candidates self-select against reality, and your interview loop gets shorter.

Certification is a hiring decision, and the federal description of the occupation treats it that way. BLS says medical records specialists typically need a postsecondary certificate to enter the occupation, although some qualify with a high school diploma, and that certification may be required or preferred. BLS's projections table lists a postsecondary nondegree award as the typical entry education for medical records specialists and an associate's degree for health information technologists — so match your requirement to the band you are hiring.

The credential tied to the title on O*NET's own list is AHIMA's Registered Health Information Technician (RHIT). AHIMA requires RHIT exam candidates to generally complete the academic requirements, at an associate-degree level, of a Health Information Management program accredited by CAHIIM — and AHIMA does not accept health informatics degrees for RHIT. An RHIT line on a resume, if it verifies, points to the credential and the associate-level HIM academic background behind it.

BLS also gives you the market's posture: employers may prefer to hire medical records specialists who already have certification, or may expect applicants to earn certification shortly after being hired. Whether to require it on day one or fund it after the start date is your call as the employer. State it plainly either way in the posting.

The pay signal for requiring it comes from AAPC itself. AAPC's 2026 Medical Coding and Billing Salary Report, based on its 2025 U.S. survey, reports certified medical records specialists averaging $67,260 versus $55,721 for non-certified respondents — 20.7% more. Read that as a credential seller's self-reported member survey, not BLS data, and set it beside the labeled federal benchmarks in the section above.

Ask for the credential number with the application, not after the offer. AHIMA lets employers verify that health information professionals' credentials are current using the person's last name and credential number or AHIMA ID. Verification is cheap; a mis-claimed credential is not.

Verify before you post: eligibility and certification rules change. Confirm current RHIT eligibility and recertification details with AHIMA before a requirement reaches your job posting — and write "RHIT or equivalent HIM credential" only if you mean to accept equivalents.

Know who else is hiring from this pool. Per BLS, the largest employers of medical records specialists were hospitals (28%) and offices of physicians (18%), followed by professional, scientific and technical services (10%), administrative and support services (8%) and management of companies (7%). Hospitals and physician groups are your competition for experienced candidates — and they are also where those candidates currently sit.

The pressure is measurable from both directions. BLS projects health information technologists and medical registrars (SOC 29-9021), the closer BLS proxy for technologist-band seats, to grow 15.9% from 42,000 in 2025 to 48,600 in 2035, with about 3,000 openings per year on average. Medical records specialists (SOC 29-2072), the group that also includes records staff who do not code, are projected to grow 7.8% to 216,300 over the same window, with about 14,000 openings per year on average. In an AHIMA-commissioned NORC survey of about 2,500 health information professionals (fielded August 2023, released November 1, 2023), 66% reported persistent staffing shortages over the past two years, and 83% saw unfilled health information positions increase or persist over the past year.

Understaffing has a price tag attached. AHIMA's 2023 survey release says health information understaffing has led to reduced reimbursement, increased claims denials, lowered patient data quality and slower information releases, with shortages described as notable in revenue cycle management.

The survey also explains why the pool feels thin from one zip code. Local pay constraints ranked among the top-three recruiting issues for 59% of respondents, salaries not competitive with remote jobs elsewhere for 51%, and a limited local talent pool for 53%. A role you cannot fill locally may still be fillable remotely — the next sections take that up.

Source where health information people already gather. AHIMA is a federation of state-level Component Associations, with state associations such as CHIA in California and NYHIMA in New York — a state-level layer of the profession worth watching when you source locally. Then post where these candidates look: our guide to where to post billing and coding jobs compares the boards, and the health information technician jobs on this board show what competing postings offer before you write your own.

Two lower-cost channels are worth setting up before you need them. Local HIM programs at the associate-degree level — the CAHIIM-accredited programs RHIT exam eligibility runs through — are a pipeline worth opening before a seat opens. Your own records and billing clerks are internal candidates for a technician seat, too — a defined training path inside your department is a sourcing channel, not just a retention one.

Screen in a fixed order so every candidate gets the same checks in the same sequence. First the credential: verify with the issuing body, never from a certificate image or a resume line. AHIMA verifies with the person's last name plus the credential number or AHIMA ID, so collect both at application. If the seat blends into coding and the candidate holds an AAPC credential instead, the same rule holds — verifying credentials before you hire walks through AAPC's lookup and its terms.

Second, the exclusion screen, before the offer goes out. OIG says entities should check the LEIE before employing or contracting with individuals and periodically afterward, and OIG publishes the list as an online searchable database, a downloadable CSV and monthly supplement files. Section five below takes the full duty, including the monthly cadence and the state Medicaid lists.

Third, test the work itself. If the seat includes coding support, a structured exercise beats interview polish — our guide to testing coders before you hire covers building and scoring one. AAPC also markets Practicode Team Assessments to employers for evaluating candidates and staff on standardized real-world coding cases across 19+ specialties, tracking accuracy and speed — one vendor option, described by AAPC itself.

For the records side, build a release-of-information work sample and give every finalist the same one. Ask the candidate to walk a request end to end: how they confirm who is asking, how they match the request to the record set, how they log the disclosure, and what they do when the documentation is ambiguous. You are listening for a candidate who stops and escalates rather than guesses — the same instinct O*NET describes as consulting doctors when information is missing or unclear.

Score everything on one rubric and keep the same test for every candidate. Consistency is what makes your debrief comparisons real, and a written rubric settles it when two interviewers disagree. If you add background checks or a screening vendor, confirm your disclosure and authorization steps with health-care counsel before you run them.

Two duties come with this hire, and one of them is the reason the role exists: your technician will handle protected health information and disclosure requests all day, every day. The compliance work splits into exclusion screening before the start date and HIPAA privacy and security duties once they join. Name the regulators up front — the OIG keeps the federal LEIE, state Medicaid programs keep their own exclusion lists, and HHS's Office for Civil Rights administers the HIPAA rules.

Start with the OIG's List of Excluded Individuals/Entities. OIG says entities should check the LEIE before employing or contracting with individuals and periodically afterward — and because OIG updates the list monthly, OIG says screening each month best minimizes potential overpayment and civil monetary penalty liability. OIG publishes the list as an online searchable database, a downloadable CSV and monthly supplement files, so the cadence it describes is mechanically easy to run.

The exposure is concrete. OIG states that anyone who hires an individual or entity on the LEIE may be subject to civil monetary penalties, and that health care entities should routinely check the list for new hires and current employees. OIG's FAQ adds that the payment ban applies regardless of who submits the claims and covers all administrative and management services the excluded person furnishes — a scope that reaches administrative seats like this one. OIG's General Compliance Program Guidance lists monthly screening of the LEIE and state Medicaid exclusion lists, and regular screening of state licensure and certification databases, among its examples of routine compliance monitoring.

HIPAA training is the duty that starts on day one. The Privacy Rule (45 CFR 164.530(b)(1)) requires a covered entity to train all members of its workforce on its PHI policies and procedures as necessary and appropriate for their functions. New workforce members must be trained within a reasonable period after joining, and members affected by a material policy change within a reasonable period after the change — the rule sets no fixed annual frequency. The training must be documented.

Two more layers finish the picture. OIG's General Compliance Program Guidance says compliance-program training should reach all board members, officers, employees, contractors and medical staff at least annually, guided by an annual training plan — guidance language, but the cadence OIG describes. And the Security Rule adds a security awareness and training program for all workforce members including management, with addressable specifications covering security reminders, protection from malicious software, log-in monitoring and password management.

One definition matters more for a technician seat than for a pure billing desk. HIPAA's "workforce" includes employees, volunteers, trainees and other people whose conduct is under the covered entity's or business associate's direct control, whether or not it pays them. Under that definition, an unpaid intern in your HIM department is inside your training and safeguards duties from their first shift.

Release of information is where the role and the rules meet daily. Build the ROI workflow into your privacy policies, train the technician to those policies as their functions require, and keep the documentation of that training. Confirm the details with the bodies named: exclusion screening workflows with your compliance advisor, and privacy and security policies with your compliance officer or health-care counsel. This page describes the rules; it is not a compliance plan for your operation.

All three models can work; they fail differently. In-house keeps your oversight tightest, which matters most while a new technician is learning your release-of-information and disclosure workflows. Remote widens the pool past your commute radius — the survey constraint above, where 51% of respondents ranked local salaries not competitive with remote jobs elsewhere among their top-three recruiting issues, is the argument for it. Outsourcing moves the hiring problem to a vendor and adds a vendor-oversight problem of its own.

The remote datapoints come from the AHIMA/NORC survey. 40% of respondents said their organization increased its number of remote workers while addressing recruitment problems, and 21% named lack of remote or hybrid flexibility as the most impactful driver of turnover. If you hire remote, HIPAA's safeguards travel with the work. The Security Rule's workstation-use and physical-safeguard policies apply to all workstations that access ePHI, home workstations included. Its access-control specifications cover unique user identification, automatic logoff, addressable encryption and audit controls. Settle equipment, workspace and access policy before the first remote start date.

Outsourcing changes the paperwork more than the underlying duties. HHS lists billing, claims processing and practice management among the activities that make a vendor a HIPAA business associate when PHI is involved. BAAs must contain the elements in 45 CFR 164.504(e): permitted uses and disclosures, safeguards, breach reporting, subcontractor flow-down, return or destruction of PHI at termination if feasible, and authority to terminate for material breach. If a records or release-of-information vendor will touch PHI on your behalf, put the arrangement in front of counsel before the first record moves.

If the decision spans your whole records-and-revenue operation rather than one technician seat, the hub guide to hiring billing and coding staff works the in-house, remote and outsourced question across every role. Whichever model you pick, the verification and screening steps above do not change — only who performs them does.

Retention starts with why they leave. In the 2023 AHIMA/NORC survey, compensation was the top driver of health information turnover; burnout ranked second, named most impactful by 28% of respondents — and by 41% in revenue-cycle vendor settings, where it ranked first. A further 21% named lack of remote or hybrid flexibility as the most impactful driver.

What organizations actually changed when recruitment got hard: 45% increased pay, 40% increased the number of remote workers, 28% increased training opportunities and 22% increased reliance on automation and machine learning, while 20% took no action. Training is the lever with a compounding return for this seat — the technician's value to you grows with every workflow they master, from release logs to disclosure accounting to coding support.

Publish the ladder. BLS says medical records specialists may advance to health information technologist or medical and health services manager roles after completing a higher certification program or earning a degree in health information technology. AHIMA's RHIA sits on that path. Its exam eligibility generally requires completing a CAHIIM-accredited HIM program at the baccalaureate or master's level, or an approved post-baccalaureate certificate. AHIMA describes RHIAs as managing people and operational units and helping prepare budgets. Funding the next credential builds your bench for a future HIM director seat — and gives the technician a reason to grow inside your department rather than somewhere else.

The cheap levers are the operational ones. Put the training calendar in writing and document what each technician completes — the documentation habit doubles as your Privacy Rule evidence. Cross-train across records, release of information and coding support so a vacancy never strands a single workflow. Give the seat a named next step: a senior technician slot, an HIM supervisor track, or a stated path toward the technologist band you did not hire for.

And weigh what an empty seat costs. AHIMA's 2023 survey release says health information understaffing has led to reduced reimbursement, increased claims denials, lowered patient data quality and slower information releases, with shortages described as notable in revenue cycle management. Backfilling slowly compounds those losses quietly.

Employer information, not coding, billing-compliance, legal or tax advice. The rules named here belong to the OIG, HHS, AHIMA, AAPC and BLS, and they change. Confirm screening, training, pay and contracting decisions with the agency or body named, and with health-care counsel where the decision is yours.