Medical coding is not a state licensed profession anywhere in the United States. There is no state board that fingerprints coders or issues a coding license the way a nursing board or a real estate board does for its professions. That absence of licensure does not mean coders go unscreened. A coder routinely sits in front of a patient’s full medical record and submits the codes that trigger a bill to a federal health program, and that combination is exactly what drives employers, clearinghouses, and billing companies to build their own screening programs around HIPAA access rules, federal exclusion databases, and standard criminal history checks rather than a licensing requirement.
Why coders get screened without a license requirement
A medical coder’s job is to translate clinical documentation into standardized codes used for billing and statistical reporting. Doing that work means direct, repeated access to protected health information, often for thousands of patients a coder will never meet. The Health Insurance Portability and Accountability Act treats that kind of access as a security decision an employer has to make deliberately. The HIPAA Security Rule’s workforce security standard at 45 CFR 164.308 requires covered entities and their business associates, which commonly includes third party coding and billing vendors, to implement procedures for authorizing and supervising workforce members who work with electronic protected health information, and to have a process for determining whether a given workforce member’s access is appropriate. HIPAA itself does not name a criminal background check as a mandatory control, but it does require covered entities to make and document a reasoned decision about who gets access, and a background check is one of the standard ways employers satisfy that workforce clearance expectation.
The HIPAA Privacy Rule adds a related administrative duty. Under 45 CFR 164.530, covered entities must train every member of their workforce on their privacy policies and procedures and apply appropriate sanctions against workforce members who violate them. A coder who never completes that training, or whose employer never verifies who they are before granting system access, creates a documentation gap that can matter during a HIPAA audit or a breach investigation, independent of whether a criminal record ever surfaces.
Federal exclusion screening is the step that actually has teeth
The screening requirement that carries the most practical weight for coders is exclusion screening, not criminal history. Anyone involved in billing a federal health care program, including coding and billing staff, can trigger liability for an employer if that person is listed on the Department of Health and Human Services Office of Inspector General’s List of Excluded Individuals and Entities. The OIG’s own guidance on exclusion authorities explains that an excluded individual generally may not receive payment, directly or indirectly, for any item or service billed to a federal health care program, and that prohibition reaches support staff whose work is part of the claim, not just the treating provider whose name appears on it. Employers check the LEIE database before hiring and then on a recurring basis afterward, since someone can be added to the list after they are already employed.
The System for Award Management maintains a separate exclusions record covering parties barred from federal contracts and programs more broadly, searchable through SAM.gov’s exclusions search. A coder working for a billing company that contracts with a federal program, or for a practice that bills Medicare or Medicaid, can reasonably be checked against both the OIG list and SAM at the same time, since the two databases are built for different exclusion authorities and do not always overlap.
State Medicaid programs run their own layer of exclusion screening on top of the federal list, and the OIG publishes specific guidance for state Medicaid agencies on how often they expect providers and their billing staff to be checked. A billing company or coding vendor serving multiple states should not assume a single federal check satisfies every state Medicaid agency’s own screening cadence, since states have set different recheck intervals for providers and the staff who submit claims on their behalf.
What a typical employer screen looks like for a coding hire
Outside of HIPAA and exclusion checks, the screening a coder goes through looks like a standard office hiring screen rather than a clinical licensure screen. The table below summarizes what most employers in this field verify and why, since no state licensing board sets a baseline for this role.
| Screening element | What it covers | Why it applies to coders |
|---|---|---|
| Criminal history check | County, state, and federal criminal records appropriate to where the coder lives and works | Standard employer due diligence for a role with access to sensitive personal and financial data, not a licensing mandate |
| Identity verification | Confirming the applicant is who they claim to be, often including a Social Security number trace | Remote coding roles rarely involve an in person interview, so identity confirmation substitutes for the visual check an office hire would otherwise get |
| OIG LEIE and SAM exclusion check | Federal program exclusion status | Required in substance for anyone whose work results in claims billed to Medicare, Medicaid, or other federal health programs |
| Education and certification verification | Confirming coding coursework and credential status directly with the issuing organization | Coding credentials are the industry’s substitute for licensure, so verifying they are genuine and current matters more here than in a licensed profession |
| Driving record (MVR) | State motor vehicle record | Only relevant if the role involves driving, such as an auditor who visits practice sites; most remote coding roles do not need this |
| Drug test | Standard pre employment panel where the employer’s policy calls for one | Less universal for remote, non clinical coding roles than for roles with direct patient contact, and varies by employer policy |
Credential verification deserves particular attention because coding has no government issued license to fall back on. Coders typically hold a certification from an industry credentialing body rather than a state license, most often through the American Academy of Professional Coders or the American Health Information Management Association. Those organizations issue and track credentials such as Certified Professional Coder or Certified Coding Specialist, and employers verify an applicant’s credential status directly with the issuing body rather than taking a resume claim at face value. Because no state agency is validating these credentials the way a licensing board validates a nursing or medical license, that verification step functionally replaces a step that a licensed profession would get from its state board.
No state licenses or fingerprints medical coders directly
Employers researching this role sometimes assume there must be a state rule somewhere, given how much sensitive data a coder touches. There is not. Medical coding is not included among the professions that state health licensing boards regulate, and a search of state health department and licensing board sites turns up no fingerprint based criminal history requirement tied specifically to the coder title, the way there is for nurses, pharmacists, or home health aides. Where a coder is employed directly inside a hospital or health system, that employer’s own facility level background check and badge access policy applies, but that is an employer choice, not a statutory licensing requirement reaching the coder’s job title.
This matters for remote hiring in particular, since coding is one of the more common fully remote roles in healthcare administration. An employer cannot rely on a state board’s prior vetting, because none occurred, and cannot assume a different state’s rule reaches a coder who works from home in a state where the employer has no physical office. The practical result is that the employer’s own screening policy, built around HIPAA access controls, exclusion checks, and a standard criminal history and identity check, is the only vetting a remote coder goes through before getting system access to patient records.
FCRA duties when using a third party background check
When an employer or staffing agency uses a consumer reporting agency to run a coder’s background check rather than doing it in house, the Fair Credit Reporting Act sets specific duties that apply regardless of the role. The Federal Trade Commission’s guidance on background checks for employers lays out the sequence: provide a clear, standalone disclosure to the applicant, get written authorization separate from the general job application, and if information in the report may lead to turning the applicant down, send a pre adverse action notice with a copy of the report and a copy of the Summary of Your Rights Under the Fair Credit Reporting Act, give the applicant a reasonable chance to respond, and then send an adverse action notice if the decision stands. A background check does not uncover a disqualifying record in every case, and what shows up, along with how far back it can reach, depends on state law. Employers evaluating criminal history results should also be mindful of guidance from the Equal Employment Opportunity Commission on consideration of arrest and conviction records in employment decisions, which cautions against blanket exclusion policies that are not tied to the specific duties of the job.
Exclusion from a federal health program carries its own separate consequence under 42 CFR part 1001, which sets out the scope and effect of OIG exclusion authorities. An excluded individual’s exclusion is not limited to the specific job they held when excluded, which is part of why ongoing exclusion monitoring, not just a one time check at hire, is standard practice for coding and billing staff.
Frequently asked questions
Do medical coders need a state license?
No. Medical coding is not a state licensed profession anywhere in the United States, and there is no state fingerprint or criminal history rule tied specifically to the coder title the way there is for licensed clinical roles.
Why do employers still run background checks on coders if there is no license requirement?
Coders have direct access to protected health information and submit the codes that drive claims to federal health programs. HIPAA’s workforce security and training requirements, combined with federal exclusion screening duties, give employers a strong reason to screen the role even without a licensing mandate behind it.
Does HIPAA require a criminal background check for coders?
HIPAA does not name a criminal background check as a required control. The Security Rule requires covered entities to have procedures for authorizing and supervising workforce access to electronic protected health information, and a background check is a common way employers document that they made a deliberate access decision, but it is not spelled out as mandatory in the rule itself.
Should a coding employer check the OIG exclusion list?
Yes. Anyone whose work results in claims billed to Medicare, Medicaid, or another federal health program should be checked against the OIG List of Excluded Individuals and Entities before hire and on a recurring basis afterward, since billing for an excluded person’s work can create liability for the employer.
How do employers verify a coding credential if there is no state license to check?
Employers generally contact the issuing credentialing organization directly to confirm that a certification such as Certified Professional Coder or Certified Coding Specialist is genuine, active, and in good standing, since there is no state licensing board lookup tool to do that verification instead.
Is a remote medical coder screened any differently than an in office coder?
The screening elements are generally the same, but identity verification matters more for a fully remote hire, since there is no in person interview to confirm the applicant’s identity the way an in office hiring process would.
Related reading: Does HIPAA Require Background Checks? What the Rule Actually Says and Healthcare Exclusion Screening: OIG LEIE and SAM Checks.
Reveal Background helps employers build FCRA compliant screening programs for healthcare administrative roles. Learn more at Reveal Background.
This article is general information, not legal or medical advice. Employers should consult qualified counsel about how HIPAA, FCRA, and exclusion screening requirements apply to their own hiring process.
