How to Hire a Risk Adjustment Coder: Credentials, Sourcing and Screening

Start from the shape of the work. AAPC describes its Certified Risk Adjustment Coder (CRC) credential as validating ICD-10-CM diagnosis coding that captures patients' complete health status in value-based care models. On day one that means reading across the record rather than a single visit — CMS's risk adjustment data collection period is generally the calendar year before the payment year — and finding every documented condition the payment model can count.

The federal standard underneath is worth knowing as the employer. Chapter 7 of the Medicare Managed Care Manual requires risk adjustment diagnoses to be documented in the medical record, result from a face-to-face visit, and be coded per ICD-10-CM guidelines. Your coder's job is to code what the record supports — and to leave unsupported conditions out.

The second day-one habit is the query. Code assignment follows the provider's diagnostic statement, not the coder's own clinical criteria, and when documentation conflicts, guideline I.A.19 directs the coder to query the provider. A candidate who describes asking rather than guessing is describing the habit this work runs on.

Currency is structural, not a bonus. ICD-10-CM diagnosis codes and ICD-10-PCS procedure codes update every October 1 — CMS has posted FY2027 files covering discharges and encounters from October 1, 2026 through September 30, 2027. Ask candidates how they handled the most recent October 1 code load; the answer tells you more about working habits than a certificate does.

Plan the ramp before the start date. OIG's 2000 guidance for physician practices says new coding and billing staff should be trained as soon as possible and work under an experienced employee until training is complete — pair your hire with your strongest coder and put the ramp in writing.

The candidate-side picture — what the work looks like, who employs these coders, retrospective vs prospective work and the credential — belongs to our career guide on what a risk adjustment coder does. Its explainer on HCC coding covers the model this work feeds.

Three credentials cover this seat. AAPC describes the CRC as validating ICD-10-CM diagnosis coding that captures patients' complete health status in value-based care models — the closest match to the work. AHIMA describes its CCS as demonstrating tested skills in data quality and accuracy and mastery of coding proficiency, and AAPC's CPC validates comprehensive coding knowledge across outpatient and physician services, including ICD-10-CM, CPT and HCPCS Level II. The practical bar for this seat is the CRC — or a CCS or CPC plus documented HCC experience you can test in an interview.

Whatever you pick, the requirement is yours to set — certification in this field is voluntary, and the push to hold one comes from employers. AAPC says no degree is required for medical coding, though certification and training are typically preferred by employers. BLS says medical records specialists typically need a postsecondary certificate to enter the occupation, and that employers may prefer certified hires or expect applicants to earn certification shortly after being hired — so your posting sets the bar, and states it plainly.

Read the suffixes carefully. AAPC's Exam Agreement states the Apprentice (A) designation applies to CPC and COC exams only, so a résumé line reading "CRC-A" does not correspond to an AAPC credential. Candidates who passed the CPC without two years of coding experience carry CPC-A status, which tells you they passed the exam and are still gaining on-the-job experience — a fit for a mentored seat, a harder call for a solo queue.

Verify the credential at the issuing body, never from a certificate image. AAPC's online tool lets employers check a member's credentials from the member ID and last name (or email and last name), returning the credential, earned date, renewal date and status. Its terms make the tool for individual verification only, so confirm the identifier belongs to the person you are checking. AHIMA verifies with the person's last name plus the credential number or AHIMA ID. Our guide to verifying credentials before you hire walks the workflow.

Verify before you post: credential rules, exam formats and renewal terms change. Confirm current CRC details with AAPC and current CCS details with AHIMA before a requirement reaches your job description.

Know the occupation you are hiring from. Per BLS, medical records specialists held about 200,700 jobs in 2025, and the largest employers were hospitals (28%), offices of physicians (18%), professional, scientific and technical services (10%), administrative and support services (8%) and management of companies (7%). The occupation also includes records staff who do not code, so read it as the market around the role rather than a headcount of coders.

This hire also follows the payment. RADV audits exist to ensure risk-adjusted payment integrity and accuracy, and they verify that the diagnoses a Medicare Advantage organization submitted are supported by medical records — the same standard your hire will code to every day.

The pipeline is growing but tight. BLS projects employment of medical records specialists to go from 200,700 in 2025 to 216,300 in 2035 (7.8%), with about 14,000 openings per year on average. In an AHIMA-commissioned NORC survey of health information professionals (fielded August 2023, released November 1, 2023), 66% reported persistent staffing shortages over the previous two years, and 83% saw unfilled health information positions increase or persist over the past year.

The survey names the bottlenecks: local pay constraints ranked top-three recruiting issues for 59% of respondents, salaries not competitive with remote jobs elsewhere for 51%, and a limited local talent pool for 53%. If your commute radius is small, plan for the pool to be small too.

Source where credentialed coders already gather. AAPC says its members have access to nearly 400 local chapters that collectively host over 3,000 events per year, with finding or sharing job opportunities listed among the chapter benefits.

Then post where the specialty looks. Our guide to where to post billing and coding jobs compares the channels, and the risk adjustment coder jobs on this board show what candidates see — a live benchmark for your pay, systems and credential language.

Test the work, not the interview. The cleanest screen is a work sample drawn from your own de-identified records: give every finalist the same chart and the same question — which documented conditions does this record support — and score against a written rubric. For risk adjustment, build the sample around a condition that is named but never managed, because that is the exact judgment this job exists to make.

If you would rather buy the exercise than build one, AAPC markets Practicode Team Assessments to employers for evaluating candidates and staff on standardized real-world coding cases across 19+ specialties, tracking accuracy and speed. That description is AAPC's own as the vendor, not an independent evaluation. Our guide to testing coders before you hire covers the build-versus-buy question.

Whatever you use has to meet hiring-law basics: the EEOC says a test you require applicants to take must be necessary and related to the job, and may not exclude people based on protected characteristics. One rubric, applied to every candidate, keeps your comparisons defensible in the debrief.

In interviews, mine for the two day-one habits: the query and the unsupported condition. Ask the candidate to walk through a chart where the provider names a condition but the plan shows no management, and listen for a question back to the provider rather than a confident code. A second scenario on the most recent October 1 code update tests currency without trivia.

Set your own bar. Our research found no industry accuracy standard for this work in the sources we checked, so derive your standard from your own audit results and measure candidates against it consistently — a number borrowed from a blog post tells you nothing about your charts.

The exposure that makes this hire different is RADV. CMS conducts Risk Adjustment Data Validation audits of Medicare Advantage organizations to ensure risk-adjusted payment integrity and accuracy (42 CFR 422.311). The audits verify that diagnoses the organization submitted are supported by medical records, and CMS may collect overpayments for unsupported diagnoses after the final data submission deadline. For your team that converts into one operating rule: every condition a coder submits for risk adjustment has to be supported in the record.

CMS's documentation standard comes from chapter 7 of the Medicare Managed Care Manual: the diagnosis must be documented in the record, result from a face-to-face visit, and be coded per ICD-10-CM guidelines. Candidates and vendors may bring up MEAT checklists — frameworks like that are industry audit conventions, and neither the ICD-10-CM Official Guidelines nor CMS require them. Our explainer on MEAT criteria in HCC coding separates the convention from the rule.

Coding accuracy also has a fraud-and-abuse shadow. The False Claims Act (31 U.S.C. 3729) defines "knowingly" to include deliberate ignorance or reckless disregard of the truth, and requires no proof of specific intent to defraud. The operational reading for an employer is that the statute reaches conduct short of deliberate intent — which is why training, oversight and audit trails do the work good intentions cannot.

Screening is the other duty. OIG says entities should check the LEIE before employing or contracting with anyone and periodically afterward — and because OIG updates the list monthly, screening each month best minimizes potential overpayment and civil monetary penalty liability. Anyone who hires a person or entity on the LEIE may face civil monetary penalties, and OIG's General Compliance Program Guidance lists monthly screening of the LEIE and state Medicaid exclusion lists among its examples of routine monitoring. OIG's FAQ adds that the payment ban applies regardless of who submits the claims and covers all administrative and management services the excluded person furnishes — language that reaches coding staff. Our guide to OIG exclusion screening covers the workflow.

Once hired, the Privacy Rule (45 CFR 164.530(b)(1)) requires a covered entity to train all members of its workforce on its PHI policies and procedures as necessary and appropriate for their functions. New workforce members must be trained within a reasonable period after joining, and the training must be documented. OIG's physician-practice guidance also recommends at least an annual coding and billing training program for everyone involved in coding and billing.

These rules belong to CMS, the OIG and HHS, and they change. Confirm your screening, documentation and audit setup with your compliance advisor or health-care counsel.

All three models work; they fail differently. In-house gives you the tightest oversight, which matters in a role where one unsupported code is the risk. Remote widens the pool past your commute radius. Outsourcing converts a hiring problem into a vendor-oversight problem.

The remote datapoints come from the AHIMA/NORC survey: 40% of respondents said their organization increased remote workers while addressing recruitment problems, and 21% named lack of remote or hybrid flexibility as the most impactful driver of turnover. If you hire remote, HIPAA's safeguards travel with the work. The Security Rule's workstation-use and physical-safeguard policies apply to all workstations that access ePHI, home workstations included, and its technical safeguards include unique user identification, automatic logoff and encryption (an addressable specification) as access controls, plus audit controls. Settle equipment, workspace and access policy before the first remote start date. The worker-side view of remote risk adjustment coding is on the career guide.

Outsourcing changes the paperwork more than the duties. A vendor that handles your PHI sits in HIPAA's business-associate lane: HHS lists billing, claims processing and practice management among the activities that make a vendor a business associate. A BAA must contain the elements in 45 CFR 164.504(e), and the vendor must hold BAAs with its own subcontractors before PHI flows to them. Have counsel confirm the terms of your arrangement.

If the decision spans your whole revenue cycle rather than one coder seat, the hub guide to hiring billing and coding staff works the in-house, remote and outsourced question across every role. The verification, testing and exclusion-screening steps above do not change with the model — only who performs them does.

Retention starts with why coders leave. In the 2023 AHIMA/NORC survey, compensation was the top driver of health information turnover; burnout ranked second, named most impactful by 28% of respondents — and by 41% in revenue-cycle vendor settings, where it ranked first. Another 21% named lack of remote or hybrid flexibility as the most impactful driver.

What organizations actually changed: 45% increased pay, 40% increased the number of remote workers, 28% increased training opportunities and 22% leaned more on automation and machine learning, while 20% took no action.

Training is the lever that compounds. The annual October 1 ICD-10-CM update makes education structural for risk adjustment coders rather than optional, and OIG's guidance recommends at least an annual coding and billing training program. Covering credential renewal is the concrete second move — AHIMA, for one, requires CCS holders to complete CEUs and pay a recertification fee over each two-year certification period, and employers who absorb that cost take one renewal decision off the employee's plate.

Publish the ladder. BLS says medical records specialists may advance to health information technologist or medical and health services manager roles after completing a higher certification program or earning a degree in health information technology. For a risk adjustment coder that path can run through senior coding, audit and coding-management seats.

And weigh what an empty seat costs. AHIMA's 2023 survey release says health information understaffing has led to reduced reimbursement, increased claims denials, lowered patient data quality and slower information releases, with shortages described as notable in revenue cycle management.

Employer information, not coding, billing-compliance, legal or tax advice. The rules named here belong to CMS, the OIG, HHS, the EEOC, AAPC and AHIMA, and they change. Confirm screening, training, pay and contracting decisions with the agency or body named, and with health-care counsel where the call is yours.