How to Hire an HIM Director: Credentials, Sourcing and Screening

You are hiring someone to own the integrity of your patient records and the people who code them, not a senior coder with a new title. The day-one test: can this person run health information as an operation — records that are complete and trusted, a coding team that produces, and access that stays inside policy.

BLS describes health information managers as the people who ensure that databases of patient records are complete, accurate, and accessible only to authorized personnel. That sentence is the job description in miniature, and it is a fair first screen: ask each candidate which of those three words — complete, accurate, access-controlled — their last department was weakest on, and what they did about it.

The management half is concrete. O*NET's task list for medical and health services managers — the occupation group directors sit in — includes directing, supervising and evaluating staff work, conducting fiscal operations including budgets and rates for services, and establishing work schedules and assignments according to workload. Ask each finalist to walk through all three from their current seat.

The first 30 days should be a measurement tour, not a reorganization. A director inheriting a department needs to size the coding backlog, check release-of-information turnaround and read the audit calendar before changing anything material — candidates who start rearranging before measuring are telling you how their last department actually ran.

The stakes are not abstract. AHIMA's 2023 workforce release says health information understaffing has led to reduced reimbursement, increased claims denials, lowered patient data quality and slower information releases, with notable shortages in revenue cycle management. A director hire is partly a bet on bending that curve.

Expect the seat to include automation decisions too. In AHIMA's 2023 survey, 45% of respondents said their organization uses AI or machine learning tools for coding, documentation or other health information workflows. The split was 63% at organizations with more than 100 HI professionals versus 23% at those with 1 to 25 — so your candidates should have a position on where automation helps and where a human has to stay in the loop.

On education and experience, BLS says medical and health services managers typically need a bachelor's degree plus work experience in an administrative or clinical role in a healthcare facility, though some employers hire with an associate's degree and others prefer a master's. Set the line by the span of the department you are hiring for: a two-person HIM function and a multi-facility department are different asks.

If you need the role itself defined — reporting lines, what an HIM department contains, how the title differs from a coding manager — the career guide to what an HIM director does owns that question. This page stays on the hiring decision.

The credential whose description matches this seat is AHIMA's Registered Health Information Administrator (RHIA). AHIMA says RHIAs manage people and operational units and help prepare budgets — director work. The eligibility routes AHIMA lists for the RHIA exam generally run through education: completing a CAHIIM-accredited HIM program at the baccalaureate or master's level, or an approved post-baccalaureate certificate.

The Registered Health Information Technician (RHIT) sits below it on the education ladder: to sit for the RHIT exam, AHIMA generally requires candidates to complete the associate-degree academic requirements of a CAHIIM-accredited HIM program. An RHIT with years of supervising coders and running HIM operations is a different resume than a new RHIA — decide which pattern your department needs and say so in the posting.

One check before you write either acronym into a requirement: the RHIA eligibility AHIMA lists is academic. If a candidate tells you management experience substitutes for the degree on the RHIA itself, confirm that against AHIMA's current eligibility rules before you rely on it — credential and eligibility rules change, and the issuing body owns them.

Whatever letters a resume carries, verify them. AHIMA lets employers verify that health information professionals' credentials are current using the person's last name and credential number or AHIMA ID. Run that check before the offer, not after the start date.

For the mechanics across the other bodies — AAPC's lookup, what a CPC or CPC-A on a coder's resume actually shows — our guide to verifying credentials before you hire walks the steps. And keep the posting line honest: a certification is an employer expectation, not a license.

Start with the market you are hiring into. The clearest recent picture comes from an AHIMA-commissioned NORC survey of about 2,500 health information professionals, fielded in August 2023 and released that November. In it, 66% reported persistent staffing shortages over the past two years, and 83% saw an increase or persistence in unfilled health information positions over the past year.

The same survey ranked a limited local talent pool among the top-three recruiting issues for 53% of respondents, local pay constraints for 59%, and national pay constraints — salaries not competitive with remote jobs elsewhere — for 51%. Whatever your zip code, assume the strongest local resume may not exist in it, and widen the aperture in this order.

Look inside first. BLS says medical records specialists — the occupation group that holds your coders and records staff — may advance to health information technologist or medical and health services manager roles after completing a higher certification program or earning a degree in health information technology. Your next director may already run your coding queue; the degree or program is the gap you can sponsor.

Work the professional side too. AHIMA is a federation of state-level Component Associations; AHIMA notes additional state dues may apply for CHIA in California or NYHIMA in New York. Joining the one for your state is another way to reach HIM professionals a generic posting may not.

Then post against the seat, not the title: setting, department size, the systems your team runs, the credential line you settled above, and whether the role is on-site, hybrid or remote. Our guide to where to post billing and coding jobs compares the channels, and it pays to browse the HIM director jobs candidates already see on this board before you finalize the wording.

Budget calendar time for the search. BLS projects employment of medical and health services managers — the occupation group, which includes managers well beyond HIM — to grow 24.2% from 2025 to 2035, with about 62,300 openings per year on average. That is demand for the occupation group, not a count of director vacancies, but it tells you experienced candidates are interviewing you while you interview them.

Screen this seat in three passes — a structured interview, a scenario-based work sample and references — and score every candidate on the same sheet so the comparison survives the debrief.

Build the interview around the department rather than generic leadership. Four prompts that work at director level:

• You inherit our HIM department on Monday — what do you measure in the first 30 days, and what do you refuse to change until you understand it?
• Chart completion slipped badly after a system migration — walk me through your first week of response.
• An external audit questions the coding on a high-profile account — what happens in your department in the next 48 hours?
• A longtime coder's quality review slips after a payer policy change — what do you do?

You are listening for sequencing, escalation judgment, how they develop staff, and whether they can explain a metric precisely enough that you could recompute it. Directors who speak only in adjectives are describing a department they never measured.

The work sample settles the experience claim. Hand finalists a sanitized audit excerpt, a release-of-information turnaround report or a coder quality-review summary drawn from your own operation, and ask for a short written read. Keep the exercise job-related and run every finalist through the same steps. For the coding-knowledge half of the seat, our guide to testing coders before you hire covers the work-sample formats.

References close the loop, and this seat carries exactly the authority OIG's guidance flags. OIG's 1998 compliance guidance for third-party medical billing companies says that for new employees with discretionary authority over compliance-related decisions, billing companies should conduct a reasonable and prudent background investigation including a reference check, and should require applicants to disclose criminal convictions or exclusion actions. A hospital or clinic is not that guidance's subject, but an HIM director holds the kind of discretionary authority it describes, so the step travels well.

Two checks belong before any offer: verify the AHIMA credential as described above, and run the exclusion screening described in the next section. Do not let a start date settle either one.

Two rule sets attach to this hire, and they run in different directions: exclusion screening is about the person you are hiring, while the HIPAA training duties are what you are hiring them to run. The employer trap is assuming a director title makes either optional — it does neither.

Exclusion first, because the stakes are concrete. OIG states that anyone who hires an individual or entity on its List of Excluded Individuals/Entities may be subject to civil monetary penalties, and that health care entities should routinely check the list for new hires and current employees.

Check before the offer, then keep checking. OIG says entities should check the LEIE before employing or contracting with individuals and periodically afterward, and because OIG updates the list monthly, screening each month best minimizes potential overpayment and civil monetary penalty liability. OIG publishes the list as an online searchable database, a downloadable CSV and monthly supplement files.

The payment ban reaches management work, not just claims. Per OIG, the ban applies regardless of who submits the claims and covers all administrative and management services furnished by the excluded person. The federal list is not the only one either: OIG notes that many state Medicaid programs have their own exclusion authorities and maintain their own state exclusion lists, so run both.

OIG's 2023 General Compliance Program Guidance — voluntary, nonbinding guidance — lists monthly screening of the LEIE and state Medicaid exclusion lists, regular screening of state licensure and certification databases, and an annual review of policies and procedures among its examples of routine compliance monitoring. That rhythm is a workable template for the checks your new director will inherit or run.

Then the duties the seat will run for you. The HIPAA Privacy Rule requires a covered entity to train all members of its workforce on its PHI policies and procedures as necessary and appropriate for their functions. New workforce members must be trained within a reasonable period after joining, and members affected by a material policy change within a reasonable period after the change. The rule sets no fixed annual frequency, and the entity must document that training was provided.

The Security Rule adds a security awareness and training program for all workforce members including management, with addressable specifications for security reminders, protection from malicious software, log-in monitoring and password management. The annual rhythm comes from OIG's guidance, which recommends compliance-program training at least annually for board members, officers, employees, contractors and, where applicable, medical staff, guided by an annual training plan.

Decide who owns what before the start date. In a large organization the HIM director may run training and access controls while a separate compliance officer owns the program; in a small one the seats blend, and it falls to you to decide who signs off on what. Work that split out with your compliance contact or health-care counsel — this page describes the rules, not your compliance plan.

Same discipline, three delivery models, and the director seat changes shape in each. Choose on department size, setting and how much of the work is systems rather than paper — not on principle.

In-house keeps the director next to your coders, your record systems and your audit calendar, and keeps escalations inside the building. Remote widens the candidate pool past your zip code — in the AHIMA/NORC survey, 40% of respondents said their organization responded to recruiting problems by increasing remote workers — and it moves patient records into a home workspace.

That move is manageable, but it is not free. The Security Rule's physical safeguards — policies on workstation use and physical safeguards for all workstations that access ePHI — reach home workspaces. Its technical safeguards add unique user identification, automatic logoff and encryption to the access checklist, alongside audit controls. Settle equipment, workspace and access expectations in the offer, not in the first week of training.

Outsourcing is a different animal for HIM than for billing. You can contract coding support or release-of-information vendors, but a vendor takes tasks, not the seat: how record integrity, privacy duties and audit response split between you and the vendor is the decision to work out before anything is signed.

If a vendor will touch PHI, the contract questions arrive before the first record moves. HHS lists billing, claims processing and practice management among the activities that make a vendor a HIPAA business associate when PHI is involved. The business associate agreement then has to carry the elements the rule sets out: permitted uses and disclosures, safeguards, breach reporting, subcontractor flow-down, and return or destruction of PHI at termination when feasible. Have health-care counsel read any agreement before you sign.

Whichever model you pick, the department around this seat — coders, billers, front end, AR — is its own staffing question. Our guide to hiring billing and coding staff works through the role mix and the outsourcing decision for the rest of the revenue cycle.

Retention starts with knowing why they leave. In the 2023 AHIMA/NORC survey, compensation was the top-ranked driver of health information turnover. Burnout ranked second most impactful, named by 28% of respondents — and ranked first by 41% in revenue cycle vendor settings. Another 21% named lack of remote or hybrid flexibility as the most impactful driver.

The same survey shows what organizations changed when recruiting got hard: 45% of respondents said their organization increased pay, 40% increased remote workers, 28% increased training and 22% relied more on automation or machine learning, while 20% said it took no action. Those four levers are a workable retention agenda for a director too. Price the seat honestly, make the flexibility question explicit, fund the credentials and training, and treat automation as a decision the director helps make rather than one that lands on the department unexplained.

Workload is the quiet third rail. AHIMA's workforce release ties understaffing to reduced reimbursement, increased claims denials, lowered patient data quality and slower information releases — the exact failure modes that pile onto a short-staffed HIM department and land on the person running it. Watch the department's own vacancy and backlog numbers after every departure, and refill against those numbers rather than against a generic approval process.

Training closes the loop, and it is a duty anyway. OIG recommends compliance-program training at least annually, guided by an annual training plan — budget the director's own continuing education into that same plan instead of treating it as a personal expense.

On pay, use the labeled federal numbers as a bracket, not a target. BLS OEWS May 2025 puts medical and health services managers (SOC 11-9111, all industries — the closest available group) at a median of $123,860 a year, with the middle half earning $94,700 to $166,100. The group spans the whole occupation, hospital executives included, so bracket with it and price against your market, your facility size and the department the seat actually runs.

Employer information, not coding, billing-compliance, legal or tax advice. The exclusion and HIPAA rules named here belong to the OIG and HHS OCR, and credential rules belong to the bodies that issue them — they change. Confirm your screening, training and hiring decisions with the agency or body named and with your own counsel.