How to Hire a Medical Coder: Credentials, Sourcing and Screening

Start from the work itself. BLS describes medical coders as assigning the diagnosis and procedure codes for patient care, population health statistics and billing purposes, and acting as the liaison between health care providers and billing offices. O*NET's task list for medical records specialists adds identifying, compiling, abstracting and coding patient data using standard classification systems.

Day-one competence shows up in two habits. The first is assigning codes confidently in your setting — physician practice, facility outpatient or inpatient — from your own documentation. The second is knowing when to stop and ask: O*NET's tasks include resolving or clarifying codes or diagnoses with conflicting, missing or unclear information by consulting doctors.

Name your systems in the posting. O*NET lists 3M Encoder, AMA CodeManager and DRG grouping software among the categorization and classification software medical records specialists use, and candidates self-select when a posting names its EHR, encoder and practice-management stack. The candidate-side view of the role — training routes, specialties and career path — belongs to our career guide on what a medical coder does.

Currency is part of the job, not a bonus. ICD-10-CM diagnosis codes and ICD-10-PCS procedure codes update every October 1 — CMS has posted FY2027 files covering discharges and encounters from October 1, 2026 through September 30, 2027 — and CMS publishes Medicare NCCI procedure-to-procedure edits and medically unlikely edits with quarterly updates.

Ask candidates how they handled the most recent October 1 code load. The answer tells you more about working habits than any certificate on a résumé.

Certification is a hiring decision, and the federal description of the occupation treats it that way. BLS says medical records specialists typically need a postsecondary certificate to enter the occupation, though some qualify with a high school diploma, and that certification may be required or preferred. BLS also says employers may prefer to hire certified applicants, or expect applicants to earn certification shortly after being hired.

Two bodies issue the coder credentials this page covers. AAPC describes the CPC as validating comprehensive coding knowledge across outpatient and physician services, including ICD-10-CM, CPT and HCPCS Level II, compliance, payer rules and reimbursement. The CPC exam is 100 multiple-choice questions answered in four hours, and a 70% overall score is required to pass.

AHIMA's credentials are the other line. AHIMA describes the CCS as demonstrating tested skills in data quality and accuracy and mastery of coding proficiency, and requires holders to complete CEUs and pay a recertification fee over each two-year certification period. The CCS-P is the physician-based exam, covering ICD-10-CM and CPT/HCPCS content — and AHIMA's CCS and CCS-P exams delivered on or after May 1, 2026 require the 2026 code books.

Then there is the apprentice question. AAPC states that a candidate who passes the CPC exam without two years of coding experience carries apprentice status (CPC-A), which tells employers the person passed the exam but is still gaining on-the-job experience. Decide your stance before you post: a CPC-A is a fit for a junior seat with mentorship, and a harder call for a solo coder carrying a specialty queue alone.

If you hire a CPC-A, learn the paperwork before the offer. AAPC's removal paths are two years of coding employment; one year of employment plus education (Practicode or an 80-hour coding course); Practicode plus an 80-hour course; or AAPC's Job-Ready Program. Only an employer, supervisor or HR department can verify coding time — letters must be on company letterhead, hand signed and dated with current contact information, and provided as a non-editable PDF.

Two details decide whether your own coders qualify. Externship time counts, and coding experience before certification counts. And AAPC says job titles alone do not determine eligibility: the duties have to involve qualifying coding work using CPT, ICD-10-CM or HCPCS Level II — one more reason to write the duties precisely in the posting.

Verify before you post: credential and exam rules change — formats, code-book editions and recertification terms among them. Confirm current CPC details with AAPC, and current CCS and CCS-P details with AHIMA, before a requirement reaches your job posting.

Know the market you are hiring into. Per BLS, medical records specialists held about 200,700 jobs in 2025, and the largest employers were hospitals (28%) and offices of physicians (18%), followed by professional, scientific and technical services (10%), administrative and support services (8%) and management of companies (7%). That mix tells you who else hires from this occupation.

The pressure is measurable. BLS projects employment of medical records specialists to grow 7.8% to 216,300 by 2035, with about 14,000 openings per year on average. In an AHIMA-commissioned NORC survey of health information professionals (fielded August 2023, released November 1, 2023), 66% reported persistent staffing shortages over the past two years, and 83% saw unfilled health information positions increase or persist over the past year.

Source where credentialed coders already gather. AAPC says its members have access to nearly 400 local chapters that collectively host over 3,000 events per year, with finding or sharing job opportunities listed among the chapter benefits. AHIMA is a federation of state-level Component Associations, with state associations such as CHIA in California and NYHIMA in New York.

Registered apprenticeships are a documented pipeline: the DOL's Office of Apprenticeship recognizes Medical Coder/Biller as an apprenticeable occupation (RAPIDS code 1114CB), and Bulletin 2018-33 (March 16, 2018) revised it to a competency-based approach. Partnering with a local program, or hosting externs, is how apprentice-level candidates meet you before they hit the open market.

It also helps to see the market from the candidate's side. The medical coder jobs on this board show how competing employers describe setting, specialty mix, systems and credential expectations — a free benchmark for your own posting.

Verify the credential at the issuing body — never from a certificate image or a résumé line. AAPC's online credential verification tool lets employers check a member's AAPC credentials or status using the member ID and last name (or email and last name), and returns the credential, earned date, renewal date and status. AHIMA verifies credentials with the person's last name plus the credential number or AHIMA ID. Ask for the member ID or credential number during your application process.

The lookup reflects apprentice status: AAPC says that once apprentice removal is approved, the credential updates to CPC within its verification systems. Read the tool's terms before you build a workflow on it. AAPC's is for verifying an individual's credentials only — compiling data or other commercial use is prohibited, and AAPC cannot guarantee absolute accuracy, so confirm the identifier belongs to the person you are checking.

Then test the work, not the interview polish. AAPC markets Practicode Team Assessments to employers for evaluating candidates and staff on standardized real-world coding cases across 19+ specialties, tracking accuracy and speed — one structured option, described by AAPC itself. A work sample built from your own de-identified claim types works just as well, as long as every finalist gets the same exercise.

Whatever you use has to meet hiring-law basics: the EEOC says a test you require applicants to take must be necessary and related to the job, and may not exclude people based on protected characteristics. Scenario questions drawn from your own claim mix — a conflicting note, a payer rejection, an unclear operative report — tell you more about judgment than a trivia round. Score every candidate on the same rubric so your comparisons survive the debrief.

Two compliance duties come with every coder hire: exclusion screening before the start date, and HIPAA training once they join. Start with the OIG's List of Excluded Individuals/Entities (LEIE). OIG says entities should check the LEIE before employing or contracting with individuals and periodically afterward — and because OIG updates the list monthly, OIG says screening each month best minimizes potential overpayment and civil monetary penalty liability. OIG's General Compliance Program Guidance, which OIG publishes as voluntary, nonbinding guidance, lists monthly screening of the LEIE and state Medicaid exclusion lists among its examples of routine compliance monitoring.

The exposure is concrete. OIG states that anyone who hires an individual or entity on the LEIE may be subject to civil monetary penalties, and that health care entities should routinely check the list for new hires and current employees. OIG's exclusions FAQ adds that the payment ban applies regardless of who submits the claims and covers all administrative and management services the excluded person furnishes — language that reaches billing and coding staff.

Coding accuracy itself has a fraud-and-abuse shadow. The False Claims Act (31 U.S.C. 3729) defines "knowingly" to include deliberate ignorance or reckless disregard of the truth, and requires no proof of specific intent to defraud. For an employer, the operational reading is that the statute reaches conduct short of deliberate intent to defraud — one reason OIG's guidance leans on training, audits and oversight rather than good intentions.

OIG's 2000 compliance guidance for individual and small group physician practices recommends at least an annual coding and billing training program for everyone involved in coding and billing. It also says new coding and billing staff should be trained as soon as possible and work under an experienced employee until training is complete. That last sentence is the CPC-A employer's job in miniature: pair the apprentice with your strongest coder and put the ramp in writing.

HIPAA training is the other duty that comes with the hire. The Privacy Rule (45 CFR 164.530(b)(1)) requires a covered entity to train all members of its workforce on its PHI policies and procedures as necessary and appropriate for their functions. New workforce members must be trained within a reasonable period after joining — and the rule sets no fixed annual frequency. The training must be documented, and the Security Rule adds a security awareness and training program for all workforce members including management.

Billing companies carry one more line. OIG's 1998 billing-company guidance calls for a reasonable and prudent background investigation, including a reference check and disclosure of criminal convictions or exclusion actions, for new employees with discretionary authority over compliance-related decisions.

These rules belong to the OIG and HHS, and they change. Confirm your screening, training and audit setup with your compliance advisor or health-care counsel before you rely on it.

All three models can work; they fail differently. In-house gives you the tightest oversight, which matters most for apprentice-level coders. Remote widens the pool beyond your commute radius. Outsourcing moves the hiring problem to a vendor — and adds a vendor-oversight problem of its own.

The remote datapoints come from the AHIMA/NORC survey: 40% of respondents said their organization increased its number of remote workers while addressing recruitment problems, and 21% named lack of remote or hybrid flexibility as the most impactful driver of turnover. If you hire remote, HIPAA's safeguards travel with the work: the Security Rule's workstation-use and physical-safeguard policies apply to all workstations that access ePHI, home workstations included. Settle equipment, workspace and access policy before the first remote start date.

Outsourcing changes the paperwork more than the underlying duties. HHS lists billing, claims processing and practice management among the activities that make a vendor a HIPAA business associate when PHI is involved, and BAAs must contain the elements in 45 CFR 164.504(e). The business associate must have a BAA with any subcontractor that creates, receives, maintains or transmits PHI before disclosing PHI to it — and since the HITECH Act and HHS's 2013 Omnibus final rule, business associates have been directly liable for certain HIPAA violations.

If the decision spans your whole billing operation rather than one coder seat, the hub guide to hiring billing and coding staff works the in-house, remote and outsourced question across every role. Whichever model you pick, the verification and screening steps above do not change — only who performs them does.

Retention starts with why coders leave. In the 2023 AHIMA/NORC survey, compensation was the top driver of health information turnover; burnout ranked second, named most impactful by 28% of respondents — and by 41% in revenue-cycle vendor settings, where it ranked first. Local pay constraints (59% of respondents) and salaries not competitive with remote jobs elsewhere (51%) ranked among the top-three recruiting issues, and a limited local talent pool ranked there for 53%.

What organizations actually changed: 45% increased pay, 40% increased the number of remote workers, 28% increased training opportunities and 22% increased reliance on automation and machine learning, while 20% took no action. Training is the lever with a compounding return — OIG's physician-practice guidance also recommends it for everyone involved in coding and billing.

Certification support is the second lever, and the pay signal comes from AAPC itself: AAPC's 2026 salary report, built on its 2025 survey, reports certified medical records specialists averaging $67,260 versus $55,721 for non-certified respondents, 20.7% more. Read that as a credential seller's self-reported member survey — not BLS data — and set it beside the labeled federal benchmark at the top of this page. Covering CEUs and recertification costs also removes the friction of renewal cycles: AAPC requires CPC holders to keep an annual membership and earn 36 CEUs every two years, and AHIMA requires CEUs and a recertification fee over each two-year CCS certification period.

Publish the ladder. BLS says medical records specialists may advance to health information technologist or medical and health services manager roles after completing a higher certification program or earning a degree in health information technology. A coder who can see the next seat has one more reason to build their tenure with you.

And weigh what an empty seat costs. AHIMA's 2023 survey release says health information understaffing has led to reduced reimbursement, increased claims denials, lowered patient data quality and slower information releases, with shortages described as notable in revenue cycle management. Backfilling slowly compounds those losses quietly.

Employer information, not coding, billing-compliance, legal or tax advice. The rules named here belong to the OIG, HHS, CMS, the DOL, the EEOC, AAPC and AHIMA, and they change. Confirm screening, training, pay and contracting decisions with the agency or body named, and with health-care counsel where the decision is yours.