How to Hire a Medical Billing And Coding Specialist: Credentials, Sourcing and Screening

The title describes two jobs sharing one seat. On the coding side, BLS describes medical coders as assigning the diagnosis and procedure codes used for patient care, population health statistics and billing, and acting as the liaison between health care providers and billing offices. O*NET's task list for the same occupation adds identifying, compiling, abstracting and coding patient data with standard classification systems, and resolving or clarifying codes when documentation is conflicting, missing or unclear by consulting the doctor.

On the billing side, the work runs from charge calculation through follow-up. BLS describes billing and posting clerks as calculating charges, generating bills, reviewing documents such as charge slips and hospital records to calculate fees due, and contacting customers about accounts. O*NET adds verifying the accuracy of billing data and revising errors. AAPC's description of its CPB credential names the same span from the billing seat: claim submission, payment posting, insurance guidelines and revenue cycle workflows.

Day one in your office is defined by your setup, not the title. Before the start date, write down the code sets and systems in use — your EHR, practice-management system and clearinghouse — your payer mix, the visit and claim types your specialty generates most, and who the hire should ask when documentation is unclear. A candidate can hold a strong credential and still need time on your specific setup. Plan for that ramp instead of assuming the credential covers it.

OIG's 2000 compliance guidance for physician practices sketches the ramp explicitly: new coding and billing staff should be trained as soon as possible and work under an experienced employee until training is complete. In a small practice, the experienced employee may be you or an outside partner. Name that person before day one, and put the training plan in writing so it survives turnover.

Two boundaries keep the seat realistic. This person is not a compliance program — the compliance section below covers the oversight a one-person billing office needs. And the seat is not the whole revenue cycle: front-end work like prior authorization and eligibility checks, and back-end depth like denial management, can each outgrow a combined role. (For the worker's-side view — training paths, credential options and career questions — see what a medical billing and coding specialist does in the career guide.)

Start with what you are asking for: a certification issued by a credentialing body such as AAPC or NHA. BLS's Licenses, Certifications, and Registrations discussion for medical records specialists describes voluntary certification that employers may require or prefer. BLS also says employers may prefer to hire certified applicants or expect applicants to earn certification shortly after being hired. Setting the requirement — which credential, and by when — is yours to make in the posting.

Match the credential to the split of work. If the seat is mostly coding, the natural ask is AAPC's CPC, which AAPC describes as validating comprehensive coding knowledge across outpatient and physician services, including ICD-10-CM, CPT and HCPCS Level II, compliance, payer rules and reimbursement. The exam behind it is concrete: 100 multiple-choice questions answered in four hours, with an overall score of 70% required to pass. A CPC holder has cleared a broad, timed test of those exact code sets.

If the seat leans billing, AAPC's CPB (Certified Professional Biller) validates expertise in the medical billing process: claim submission, payment posting, insurance guidelines and revenue cycle workflows. In a mostly-billing seat, that map matches the day better than a coding-only credential would.

For the combined seat itself, NHA's CBCS (Certified Billing and Coding Specialist) is aimed at the both-halves job by name. NHA's eligibility rules require a high school diploma or equivalent, plus one of the following: completion of a billing and coding training program within the last 5 years, or supervised billing and coding work experience. The experience thresholds are 1 year within the last 3, or 2 years within the last 5. Read eligibility rules like a hiring manager: they tell you what holders had to document before sitting for the exam.

Decide your stance on CPC-A résumés before the first interview. AAPC says a candidate who passes the CPC exam without two years of coding experience carries apprentice status — CPC-A — which tells employers the person passed the exam but is still gaining on-the-job experience. The removal routes later: two years of coding employment; one year of employment plus education through Practicode or an 80-hour coding course; Practicode plus an 80-hour course; or AAPC's Job-Ready Program. Your signature is part of that path — only an employer, supervisor or HR department can verify a coder's coding time, on company letterhead, hand signed and dated, with current contact information, as a non-editable PDF.

Whatever you require, verify it at the issuing body — never from a certificate image. AAPC's online verification tool confirms a member's credentials or status using the member ID and last name, or email and last name, and returns the credential, earned date, renewal date and status. Read the tool's terms: it is for verifying an individual's credentials, compiling data or other commercial use is prohibited, and AAPC cannot guarantee absolute accuracy — confirm the identifier belongs to the person you are checking. AHIMA verifies its credentials with the person's last name plus the credential number or AHIMA ID. For credentials from other bodies — NHA's CBCS among them — ask the issuing body how to confirm a credential is current.

Exam and eligibility rules change with each cycle. Confirm the current credential, exam and eligibility details with AAPC, NHA or whichever body you require, before the requirement goes into a posting or an offer letter.

Start with where the occupation already works. BLS says medical records specialists held about 200,700 jobs in 2025, with hospitals (28%) and offices of physicians (18%) the largest employers, followed by professional, scientific and technical services (10%), administrative and support services (8%) and management of companies (7%). The group also includes records staff who do not code, so read it as the field's neighborhood rather than a coder census.

The local pool can run thin, and the survey numbers say so plainly. In an AHIMA-commissioned NORC survey of about 2,500 health information professionals (fielded August 2023, released November 1, 2023), 66% of respondents reported persistent staffing shortages over the previous two years, and 83% saw unfilled health information positions increase or persist over the past year. Local pay constraints (59%) and salaries not competitive with remote jobs elsewhere (51%) ranked among the top-three recruiting issues, along with a limited local talent pool (53%).

Source where credentialed people already gather. AAPC says its members have access to nearly 400 local chapters that collectively host over 3,000 events per year, with finding or sharing job opportunities listed among the chapter benefits. AHIMA is a federation of state-level Component Associations — a state-level professional community to network with as well. Then write the posting so it survives a ten-second scan: setting, specialty, systems, credential expectation, pay range stated plainly.

Watch the movement numbers while you search. BLS projects medical records specialists employment to grow 7.8% from 200,700 in 2025 to 216,300 in 2035, with about 14,000 openings per year on average. Billing and posting clerks — the all-industries occupation that includes billing work — is projected essentially flat at -0.1% (418,000 in 2025 to 417,700 in 2035), with about 37,000 openings per year on average. Those annual openings keep candidates moving even where total employment is not.

Before you write yours, see what candidates see: the medical billing and coding specialist jobs page shows how other employers describe this seat — setting, specialty mix, systems and credential expectations — the fastest calibration for your own posting.

Screen in stages, each cheaper than the next: résumé review, skills test, structured interview, then credential verification and exclusion screening before any offer. A structured process compares candidates on the same evidence — and employment tests carry rules of their own.

If you require a test, the EEOC says it must be necessary and related to the job, and may not exclude people based on protected characteristics. Title VII, the ADA and the ADEA prohibit discriminatory employment tests and selection procedures, and the ADA requires reasonable accommodation in test administration for qualified applicants with disabilities absent undue hardship. Title VII also bars adjusting scores, using different cutoff scores, or otherwise altering test results on the basis of race, color, religion, sex or national origin. The practical version of all three: give every finalist the same exercise, scored the same way.

The most job-related test is the job itself. Build a short work sample from redacted versions of your own claims — code two or three encounters from your specialty, work one remittance advice with a denial on it, correct a small batch of claim errors. Score against an answer key built from your own documentation and payer rules; the standard is yours to set, and the periodic audits in the compliance section are what check it. If you would rather buy a structured exercise, AAPC markets Practicode Team Assessments to employers for evaluating candidates and staff on standardized, real-world coding cases across 19+ specialties, tracking accuracy and speed.

Run the interview on scenarios from your own claim types. A strong answer checks the guideline and payer policy before choosing, and asks the provider rather than assuming when documentation is unclear — consulting doctors to resolve conflicting, missing or unclear information is a core task of this occupation in O*NET's listing. Ask how the candidate stays current, too: ICD-10-CM and ICD-10-PCS codes update every October 1, so "how do you handle the annual update?" has a concrete answer.

For the compliance-sensitive side of the seat, OIG's 1998 guidance for third-party billing companies adds a background-investigation step. It applies to new employees with discretionary authority over compliance-related decisions: companies should conduct a reasonable and prudent background investigation including a reference check, and should require applicants to disclose criminal convictions or exclusion actions. Pair that with the exclusion screening in the next section before an offer goes out.

Slow down for quiet signals: code-set knowledge that stays vague no matter how you probe, résumés that name no setting or specialty, and a credential that does not verify. None is automatically disqualifying. Each is a question to ask before you spend a seat on it.

Start before day one. OIG says entities should check the List of Excluded Individuals/Entities (LEIE) before employing or contracting with anyone and periodically afterward — and because OIG updates the LEIE monthly, screening each month best minimizes potential overpayment and civil monetary penalty liability. OIG's General Compliance Program Guidance lists monthly screening of the LEIE and state Medicaid exclusion lists, regular screening of state licensure and certification databases, and annual review of policies and procedures among its examples of routine compliance monitoring. The stakes are concrete: OIG says anyone who hires an individual or entity on the LEIE may be subject to civil monetary penalties, and health care entities should routinely check the list for new hires and current employees.

The screening covers billing seats even when the person never touches a claim form. OIG's exclusions FAQ says the federal payment ban applies regardless of who submits the claims and covers all administrative and management services the excluded person furnishes — language that reaches billing and coding staff.

The structural trap for small employers is segregation of duties: one person coding and billing is also one person with no internal check. OIG's General Compliance Program Guidance recommends that small entities that cannot support a compliance officer designate a compliance contact who, whenever possible, should not be involved in billing, coding or claim submission, and who reports at least quarterly to the owner or CEO. Hiring one person to run the whole claim does not satisfy that suggestion — wrap the seat in oversight you can evidence instead: owner review of deposits and adjustments, and periodic record audits.

OIG's 2000 guidance for physician practices recommends a baseline audit and then periodic audits at least once a year, suggesting as a basic guide five or more medical records per federal payor or five to ten records per physician. OIG's guidance recommends rather than requires; the General Compliance Program Guidance is published as voluntary, nonbinding guidance. In a one-person billing office, though, that audit is the only second pair of eyes on the coding work — which is the reason to put it on the calendar anyway.

Training is the piece with a rule behind it. The HIPAA Privacy Rule requires a covered entity to train all members of its workforce on its PHI policies and procedures, as necessary and appropriate for their functions. New workforce members must be trained within a reasonable period after joining; the rule sets no fixed annual frequency. Document the training you deliver — the rule requires it. The Security Rule adds a security awareness and training program for all workforce members, including management. OIG's guidance is where the at-least-annual coding and billing training habit comes from, and it is the cycle that matches the annual code-update rhythm.

Employer information, not coding, billing-compliance, legal or tax advice. The rules named here belong to their agencies — OIG and HHS OCR — and they change. Confirm screening, training and audit decisions with the agency named, and with health-care counsel where the application to your own practice is unclear.

All three models can staff this seat; they differ in supervision, PHI control and what you are actually buying. In-house puts supervision in the building — and supervision matters here, because OIG's guidance has new coding and billing staff working under an experienced employee until training is complete. A pairing across the hall is simpler than one across a VPN.

Remote widens the pool: in the 2023 AHIMA/NORC survey, 40% of respondents said their organization increased its number of remote workers as it addressed recruitment problems. Remote also moves part of HIPAA home with the hire. The Security Rule's workstation-use and physical-safeguard policies apply to every workstation that accesses ePHI, home workstations included. Its technical safeguards — unique user identification, automatic logoff, encryption and audit controls — are the remote-access checklist to settle before the first start date.

Outsourcing trades the hire for a vendor relationship. Billing, claims processing and practice management are among HHS's examples of activities that make a vendor a business associate when PHI is involved. Any subcontractor that creates, receives, maintains or transmits PHI on the vendor's behalf needs its own BAA before PHI flows, and since the HITECH Act and HHS's 2013 Omnibus final rule, business associates have been directly liable for certain HIPAA violations. Pricing is a separate evaluation: our research found no primary benchmark for outsourced billing fees, so score proposals against your own claim volume, payer mix and the fully loaded cost of a hire. The wider trade-offs between building and buying sit on the hub for hiring billing and coding staff.

If a vendor proposes offshore staff, two federal anchors matter. HHS notes the HIPAA Rules contain no requirements specific to ePHI handled outside the United States, but that offshore risks must be considered in the Security Rule risk analysis when a cloud provider stores ePHI abroad under a BAA. Separately, the Medicaid statute bars states from making Medicaid payments for items or services to any financial institution or entity located outside the United States. Payer contracts can add limits of their own — read yours, and ask counsel where the answers are unclear.

Know what actually drives people out. In the 2023 AHIMA/NORC survey, compensation was the top driver of health information turnover. Burnout ranked second, named the most impactful driver by 28% of respondents — and by 41% in revenue-cycle vendor settings, where it ranked first. Lack of remote or hybrid flexibility was the most impactful driver for 21% of respondents. The same release ties understaffing to reduced reimbursement, increased claims denials, lowered patient data quality and slower information releases — an empty seat in this office costs you in all four.

What organizations do about it, per the same survey: 45% of respondents said their organization increased pay, 40% increased the number of remote workers, 28% increased training opportunities, and 22% increased reliance on automation and machine learning. Another 20% said their organization was taking no action.

For this seat, the levers are concrete. Budget the annual update — ICD-10-CM and ICD-10-PCS codes change every October 1, and staying current is part of the job. Keep training on the calendar: OIG's guidance recommends at least an annual coding and billing training program for everyone involved in coding and billing, and training is one of the things surveyed organizations actually increased. Say out loud where the role goes: BLS notes medical records specialists may advance to health information technologist or medical and health services manager roles after completing a higher certification program or earning a degree in health information technology. A combined seat with no next step is a training ground for someone else's practice.

If you hired a CPC-A, finish what you started. The apprentice-removal paperwork runs through you — only an employer, supervisor or HR department can verify the coding time — and the routes include two years of coding employment or combinations of employment, Practicode and coursework. The signature costs you minutes. Supporting that credential upgrade is one of the cheapest retention moves available to a small practice.

Whatever mix of pay, flexibility and training you choose, decide it before the resignation letter, not after. In a one-person billing office, the vacancy starts costing the day the seat empties.