Blog

ISO/IEC 27001 Lead Auditor Certification: Cost, Requirements & Career Guide

An ISO/IEC 27001 Lead Auditor certification qualifies a professional to plan, lead, and report third-party audits of an Information Security Management System (ISMS) against ISO/IEC 27001:2022.

Training runs for five days. Certification costs between $800 and $3,500 depending on delivery method and provider.

Passing the exam alone does not confer the Lead Auditor grade — every major scheme requires documented audit experience first.

Two clarifications before proceeding, because both are common points of confusion:

This guide covers the individual credential, not organizational certification. If the objective is certifying a company to ISO/IEC 27001, that is a separate process conducted by an accredited certification body against ISO/IEC 27006-1:2024, not a training course an individual attends.
This is the information security variant of the Lead Auditor qualification. Parallel Lead Auditor schemes exist for ISO 9001 (quality management), ISO 14001 (environmental management), ISO 45001 (occupational health and safety), and AS9100 (aerospace). Course content, competency domains, and registers differ. An ISO 9001 Lead Auditor certificate does not qualify the holder to audit an ISMS.

At a glance

Attribute	Detail
Governing standard	ISO/IEC 27001:2022 (93 Annex A controls across 4 themes)
Audit methodology standard	ISO 19011:2026, Edition 4, published Wednesday, May 27, 2026
Issuing bodies	PECB, CQI/IRCA, BSI Group, LRQA, SGS, TÜV SÜD, DNV, Bureau Veritas, Exemplar Global
Typical total cost	$799 (self-paced) to $3,850 (instructor-led with separate exam fee)
Training duration	5 days instructor-led, or self-paced
PECB exam format	80 multiple-choice questions, 3 hours, open-book, 70% pass mark, 7 competency domains
PECB experience requirement	5 years professional experience, 2 years in information security, 300 hours of audit activity
CQI/IRCA experience requirement	7 audits, 35 days total, 25 days on-site, 3 audits led as team leader
Certification validity	3 years
PECB renewal requirement	90 CPD hours per cycle plus $390 Annual Maintenance Fee

What is an ISO/IEC 27001 Lead Auditor?

An ISO/IEC 27001 Lead Auditor is a certified professional competent to lead an audit team assessing an organization’s ISMS against the requirements of ISO/IEC 27001:2022.

The role covers audit programme management, audit planning, evidence collection, non-conformity classification, and audit reporting.

The technical scope is defined by three standards working together. ISO/IEC 27001:2022 specifies ISMS requirements in Clauses 4 through 10 and lists 93 controls in Annex A.

ISO/IEC 27002:2022 provides implementation guidance for those controls. ISO 19011:2026 governs how the audit itself is conducted — audit principles, programme management, and auditor competence evaluation.

Annex A of ISO/IEC 27001:2022 restructured the control set substantially from the 2013 edition. The distribution is as follows:

Annex A theme	Clause range	Number of controls
Organizational	5.1–5.37	37
People	6.1–6.8	8
Physical	7.1–7.14	14
Technological	8.1–8.34	34
Total	—	93

The 2013 edition contained 114 controls across 14 domains. The 2022 revision consolidated these into four themes and introduced 11 entirely new controls, including 5.7 (threat intelligence), 5.23 (information security for cloud services), 8.9 (configuration management), 8.10 (information deletion), 8.11 (data masking), 8.12 (data leakage prevention), 8.16 (monitoring activities), 8.23 (web filtering), and 8.28 (secure coding).

The transition period has closed. ISO/IEC 27001:2013 certificates ceased to be valid after Friday, October 31, 2025.

Organizations that did not transition by that date lost certification and must complete a full initial certification audit to regain it.

Candidates should verify that any training course purchased in 2026 teaches the 2022 edition; courses still marketed against the 2013 edition are obsolete.

Which bodies issue ISO 27001 Lead Auditor certification?

No single organization owns the ISO 27001 Lead Auditor credential. ISO publishes the standard but does not certify individuals. Multiple independent bodies operate their own Lead Auditor schemes, each with distinct requirements, fee structures, and recognition.

This differs from certifications with a single governing authority — PMI for the PMP, ISACA for CISA and CISM, or (ISC)² for the CISSP.

The practical consequence is that “ISO 27001 Lead Auditor certified” is an incomplete statement; the issuing body determines what the credential signifies.

The principal schemes are:

PECB (Professional Evaluation and Certification Board): A Canadian-registered certification body offering the broadest online and self-paced catalogue. Operates a tiered credential structure from Provisional Auditor to Senior Lead Auditor.
CQI/IRCA (Chartered Quality Institute / International Register of Certificated Auditors): A UK-based professional register rather than a training provider. Certification places the auditor on a searchable public register, with graded membership tiers.
BSI Group (British Standards Institution): The UK national standards body. Delivers CQI/IRCA-certified courses and operates as an accredited certification body.
LRQA, SGS (Société Générale de Surveillance), TÜV SÜD, TÜV Rheinland, DNV, and Bureau Veritas: Global certification and inspection bodies that both train auditors and conduct third-party certification audits.
Exemplar Global: Successor to RABQSA, operating auditor competency certification primarily in North America and Australia.

PECB versus CQI/IRCA: the practical distinction

PECB issues a certificate; CQI/IRCA confers a register listing. The distinction matters for employability in different markets.

Factor	PECB	CQI/IRCA
Credential form	Certificate with tiered grades	Public register entry with graded membership
Audit experience required for Lead grade	300 hours of audit activity	7 audits totalling 35 days, 25 on-site
Team leader requirement	Not separately quantified	3 audits led, minimum 15 days, 10 on-site
Experience recency window	Not specified as a rolling window	Audits must fall within 5 years of application
Interim credential without experience	Provisional Auditor	Auditor and Provisional Auditor grades
Delivery	Self-paced, eLearning, live online, classroom	Predominantly classroom or virtual classroom via approved partners
Strongest recognition	Global, particularly North America, Africa, Middle East	United Kingdom, European Union, Commonwealth markets

CQI/IRCA accepts remote audits toward the experience requirement, counting remote audit time as on-site time. Audits must cover all elements of the audit cycle to qualify.

Accreditation body versus certification body

An accreditation body assesses and authorises certification bodies; a certification body audits and certifies organizations. The two terms are frequently conflated and describe different tiers of oversight.

Accreditation bodies include UKAS (United Kingdom Accreditation Service) and ANAB (ANSI National Accreditation Board) in the United States. They do not certify companies or auditors directly.
Certification bodies include BSI, LRQA, SGS, DNV, TÜV SÜD, and Bureau Veritas. They conduct Stage 1 and Stage 2 audits and issue organizational certificates.

The requirements certification bodies must meet are specified in ISO/IEC 27006-1:2024, published in March 2024, superseding ISO/IEC 27006:2015 and its 2020 amendment. ANAB-accredited certification bodies were required to complete the transition by Tuesday, March 31, 2026.

ISO/IEC 27006-1:2024 introduced a change directly relevant to prospective auditors: the standard deleted the quantitative work-experience requirement previously imposed on ISMS auditors, including the four-year full-time practical workplace experience mandate present in the 2015 edition.

Competence is now assessed against defined criteria rather than a fixed year count. Individual scheme owners such as PECB and CQI/IRCA continue to apply their own numerical thresholds regardless.

ISO 27001 Auditor, Internal Auditor, and Lead Auditor compared

The three terms describe different audit scopes and require different training. An internal auditor audits their own organization.

A lead auditor leads audit teams, typically on behalf of a certification body or client. “ISO 27001 auditor” is a general descriptor rather than a defined credential grade.

Attribute	Internal Auditor	Auditor	Lead Auditor
Audit target	Own employer’s ISMS	Client or third-party ISMS as team member	Client or third-party ISMS as team leader
Audit type	First-party (internal)	Second-party or third-party	Second-party or third-party
Typical course length	2–3 days	5 days	5 days
Typical course cost	$400–$1,200	$800–$3,000	$799–$3,500
Team leadership	Not required	Not required	Required
Reports to	Internal management review	Audit team leader	Certification body or client
Suits	Information security managers, compliance officers	Auditors entering third-party practice	Consultants, certification body auditors

Internal audit is a mandatory requirement of ISO/IEC 27001:2022 under Clause 9.2, which requires organizations to conduct internal audits at planned intervals.

The internal auditor qualification exists to satisfy that clause. It does not qualify the holder to conduct certification audits on behalf of an accredited certification body.

Should candidates obtain Internal Auditor certification first?

Internal Auditor certification is the lower-cost entry point and typically requires 2 to 3 days of training rather than 5.

Candidates without prior audit experience commonly complete Internal Auditor training first, accumulate internal audit hours against Clause 9.2 requirements, then apply those hours toward the Lead Auditor experience threshold.

This sequence applies primarily to professionals already employed in an information security or compliance function.

Candidates intending to enter third-party certification auditing directly may proceed to Lead Auditor training, then certify at the Provisional grade while accumulating audit days.

Who requires ISO 27001 Lead Auditor certification?

The credential is required or strongly preferred for four role categories: third-party certification auditors, GRC consultants, internal audit leads, and information security managers responsible for ISMS oversight.

Certification body auditors conducting Stage 1 and Stage 2 audits on behalf of accredited bodies. Employment is conditional on demonstrable competence under ISO/IEC 27006-1:2024.
GRC and compliance consultants performing readiness assessments, gap analyses, and pre-certification audits for client organizations.
Internal audit leads managing an organization’s internal audit programme under Clause 9.2 of ISO/IEC 27001:2022.
Information security managers who own the ISMS and interact with external auditors during surveillance and recertification cycles.

The certification is not required for, and offers limited return to, several adjacent roles.

Security engineers, SOC analysts, penetration testers, and application security specialists derive minimal direct benefit; their work is technical rather than management-system oriented.

Professionals whose objective is implementing rather than auditing an ISMS should evaluate the Lead Implementer credential instead.

Prerequisites and experience requirements

No formal prerequisite gates the Lead Auditor exam itself. Substantial documented experience is required to hold the full Lead Auditor grade.

This distinction is the most commonly misreported aspect of the credential.

Requirements to sit the examination

PECB states no mandatory prerequisite for exam registration. The recommended preparation is a fundamental understanding of ISO/IEC 27001 and comprehensive knowledge of audit principles.

Candidates without that grounding typically complete ISO/IEC 27001 Foundation training first.

CQI/IRCA requires completion of an IRCA Certified Auditor/Lead Auditor course, or a relevant conversion course for auditors transitioning from another scheme, before certification application.

Provisional Auditor: the grade most candidates actually receive

Passing the PECB examination without prior audit experience confers the Provisional Auditor credential, not Lead Auditor. Upgrading to the full Lead Auditor grade requires four conditions to be satisfied.

The PECB requirements for the ISO/IEC 27001 Lead Auditor grade are:

Five years of total professional experience across any relevant discipline.
Two years of that experience specifically in information security management.
300 hours of documented audit activity.
A signed PECB Code of Ethics declaration.

The CQI/IRCA thresholds are structured differently, measuring audit days rather than hours:

Seven audits completed, totalling a minimum of 35 days.
Twenty-five of those days performed on-site, with remote audit time counted as on-site time.
Three audits led as audit team leader, totalling a minimum of 15 days with 10 days on-site.
All audits completed within five years of the application date, and after passing the training course.
Each audit covering all elements of the audit cycle — planning, conduct, reporting, and follow-up.

Provisional Auditor is a legitimate credential, not a consolation. It carries no CPD obligation and no Annual Maintenance Fee under PECB’s maintenance policy, which exempts Foundation, Provisional, and Transition credentials from both requirements.

How much does ISO 27001 Lead Auditor certification cost?

ISO 27001 Lead Auditor certification costs between $799 and $3,850 in total, depending on delivery method and provider.

Self-paced and eLearning routes occupy the lower band. Instructor-led classroom training through national standards bodies occupies the upper band.

The following provider comparison reflects published United States pricing:

Provider	Training cost	Exam fee	Total base cost
PECB partner (self-paced)	$799	Included, 2 attempts	$799
PECB partner (eLearning)	$899	Included, 2 attempts	$899
CertiProf	$1,800–$2,200	$500	$2,300–$2,700
PECB (live instructor-led)	$2,300–$2,800	Included	$2,300–$2,800
LRQA	$2,700–$3,500	Included	$2,700–$3,500
SGS	$2,400–$3,000	$600	$3,000–$3,600
BSI Group	$2,500–$3,200	$650	$3,150–$3,850

Pricing verified Thursday, August 27, 2026. Certification bodies revise fees periodically; confirm current pricing with the provider before purchase.

Standalone exam fees, where the exam is not bundled with training, range from $500 to $700.

What training packages include

Self-paced and eLearning packages from PECB-authorised partners typically bundle four components: official PECB courseware, two examination attempts, the first-year Annual Maintenance Fee, and access to the ISO/IEC 27001:2022 standard text.

Live instructor-led courses add facilitated case study work and, in most cases, a supervised examination sitting.

Candidates should confirm whether a quoted price includes the examination. BSI, SGS, and CertiProf bill the exam separately; PECB and LRQA generally bundle it.

Recurring costs after certification

Maintaining an active PECB Lead Auditor credential costs $390 per three-year cycle in Annual Maintenance Fees. Comparable renewal fees across other schemes range from $300 to $500 per cycle.

Continuing Professional Development carries no mandatory cash cost under PECB’s policy. Qualifying activities include project experience hours, implementation and consulting tasks, training delivered or attended, private study, coaching, and conference attendance.

Auditors employed in an audit function typically accrue the required hours through routine work.

Is free ISO 27001 Lead Auditor certification available?

No accredited ISO 27001 Lead Auditor certification is available at no cost. Every recognised scheme — PECB, CQI/IRCA, BSI, LRQA, SGS — requires payment for training, examination, or both.

Free resources that do exist include ISO/IEC 27001 awareness and foundation-level introductory material, sample examination questions published by training providers as marketing material, and public summaries of Annex A control structures.

None of these produce a certificate recognised by an accreditation body. Search results advertising “free ISO 27001 Lead Auditor certification” generally lead to unaccredited certificates of completion, which certification bodies and employers do not accept as evidence of auditor competence.

How to become an ISO 27001 Lead Auditor

The certification pathway consists of six sequential steps.

Select a certification scheme. Choose PECB for self-paced or accelerated online delivery, or CQI/IRCA for register-based recognition in UK and EU markets. Verify with the intended employer which scheme is accepted before purchasing training.
Confirm the course teaches ISO/IEC 27001:2022. Courses built on the 2013 edition are obsolete following the transition deadline of Friday, October 31, 2025.
Complete the training course. Five days instructor-led, or self-paced equivalent. Content covers ISO 19011:2026 audit principles, ISO/IEC 27001:2022 Clauses 4–10, Annex A control evaluation, audit planning, evidence sampling, non-conformity classification, and audit reporting.
Pass the examination. PECB requires 70% across 80 multiple-choice questions in 3 hours.
Apply for the credential appropriate to current experience. Candidates meeting the full experience threshold apply directly for Lead Auditor. Candidates without it receive Provisional Auditor.
Accumulate and document audit activity, then apply to upgrade. Record audit dates, client scope, standard audited, role performed, and days on-site. PECB requires 300 hours; CQI/IRCA requires 35 days across 7 audits, with 3 led as team leader.

How long does certification take?

Examination-ready certification takes 5 days of training plus preparation time. Full Lead Auditor grade takes considerably longer, gated by the experience requirement rather than the course.

The training and examination component can be completed within one to four weeks. The experience component — 300 audit hours under PECB, or 35 audit days under CQI/IRCA — typically requires 12 to 36 months for a professional auditing part-time, and less for a full-time certification body auditor.

Candidates should expect the credential to be a multi-year progression rather than a single-week acquisition.

The ISO 27001 Lead Auditor examination

The PECB ISO/IEC 27001 Lead Auditor examination comprises 80 multiple-choice questions across 7 competency domains, lasts 3 hours, is open-book, and requires 70% to pass.

Question construction is split evenly by cognitive level: 50% of items measure comprehension, application, and analysis; 50% measure evaluation.

The paper combines standalone questions with scenario-based sets, in which a brief organizational case is followed by five linked questions. Each question offers three options.

Permitted reference materials during the examination are limited to three categories: a printed copy of ISO/IEC 27001, official training course materials, and personal notes taken during the course.

Delivery is available remote-proctored through the PECB Exams application with continuous webcam monitoring, or paper-based in person through PECB-accredited training partners.

Candidates should note a format change that outdated guides continue to misreport. PECB previously administered this examination as 12 essay-type questions.

The current candidate handbook specifies the 80-question multiple-choice structure. Preparation material written against the essay format tests the wrong skill.

What is the ISO 27001 Lead Auditor exam pass rate?

PECB does not publish pass rate statistics for the ISO/IEC 27001 Lead Auditor examination.

No official figure exists in PECB’s candidate handbook, certification maintenance policy, or public documentation.

Third-party pass rate figures circulating on training provider websites are unsourced and should be treated as marketing claims rather than data.

Candidates evaluating difficulty should instead reference the published structure: a 70% threshold, open-book conditions, and an even split between application-level and evaluation-level questions.

Examination dumps and question banks

Examination dumps offer limited practical value for this examination and violate the PECB Code of Ethics that certified professionals are required to sign.

Two structural factors reduce their utility. First, the examination is open-book, so recall of specific fact statements provides minimal advantage.

Second, 50% of items test evaluation — judging whether an auditor’s proposed action is appropriate in a given scenario — which memorised answer keys do not develop.

Candidates seeking practice material should use provider-published sample questions and scenario exercises drawn from ISO 19011:2026 audit methodology.

Renewal and recertification requirements

PECB Lead Auditor certification remains valid for 3 years and requires 90 CPD hours plus a $390 Annual Maintenance Fee per cycle to renew.

CPD requirements scale by credential tier under PECB’s certification maintenance policy:

Credential tier	CPD hours per 3-year cycle
Foundation, Provisional, Transition	0
Implementer, Auditor, Assessor, Manager	60
Lead Auditor, Lead Implementer	90
Senior Lead	180
Master	270

Ninety hours across three years equates to approximately 30 hours annually. Qualifying activities are broadly defined: project experience, implementation or consulting tasks, training attended or delivered, private study, coaching, and seminar or conference attendance.

Consequences of lapsed maintenance

Failure to submit CPD hours or pay the Annual Maintenance Fee triggers automatic suspension for 12 months, followed by revocation.

During suspension, the professional retains the credential on record but is prohibited from promoting or claiming certified status.

If outstanding CPD hours and fees are not submitted within the 12-month suspension window, PECB revokes the certification, and the individual forfeits the right to claim PECB certified status.

Reinstatement after revocation requires recertification from the beginning.

Continued adherence to the PECB Code of Ethics is a standing condition of certification independent of CPD and fee compliance.

ISO 27001 Lead Auditor salary data

ZipRecruiter reports a United States average annual salary of $102,886 for the ISO 27001 Lead Auditor job title as of 2026, with a 25th percentile of $79,600 and a 75th percentile of $130,100.

Percentile	Annual salary (USD)
Low range	$32,500
25th percentile	$79,600
Average	$102,886
75th percentile	$130,100
High range	$147,000

The hourly equivalent of the average figure is $49.46.

These figures require two qualifications. First, the United States Bureau of Labor Statistics does not track “ISO 27001 Lead Auditor” as a distinct occupational category; the closest classification is Information Security Analysts.

Salary data for this title therefore originates from job-posting aggregators rather than government wage surveys, and aggregator methodology varies in how it handles contract rates, partial-year postings, and regional weighting.

Second, the certification rarely functions as a standalone qualification. It typically appears in job specifications alongside a broader role — GRC analyst, IT auditor, information security manager, or compliance lead — where the salary reflects the composite role rather than the certificate in isolation.

ISO 27001 Lead Auditor versus Lead Implementer

Lead Auditor certifies competence to evaluate an ISMS. Lead Implementer certifies competence to build and operate one.

The two credentials address opposite sides of the certification relationship.

Attribute	Lead Auditor	Lead Implementer
Primary function	Auditing and verifying compliance	Developing and maintaining the ISMS
Typical position	External evaluator or third-party assessor	Internal security team or engaged consultant
Core competencies	Audit planning, evidence gathering, report writing, analytical judgement	Technical implementation, project management, risk management
Key deliverables	Audit plans, non-conformity findings, audit reports	Policies, controls, risk assessments, Statement of Applicability
Interaction with Annex A	Evaluates whether controls are implemented and effective	Selects, implements, and justifies control application
Relationship to PDCA cycle	Concentrated in Check	Concentrated in Plan and Do

Lead Implementer holders produce the Statement of Applicability, the document recording which Annex A controls apply, which are excluded, and the justification for each decision.

Lead Auditor holders assess whether that document is complete, justified, and consistent with the organization’s risk assessment methodology.

A substantial proportion of GRC practitioners eventually hold both credentials. Candidates uncertain of sequence should select according to current role: implementers building an ISMS toward first certification benefit more from Lead Implementer; professionals already conducting or preparing for audits benefit more from Lead Auditor.

ISO 27001 Lead Auditor versus CISA

CISA certifies broad information systems audit competence across any framework. ISO 27001 Lead Auditor certifies competence to audit one specific management system standard.

The two are complementary rather than competing.

Attribute	ISO 27001 Lead Auditor	CISA (Certified Information Systems Auditor)
Issuing body	Multiple (PECB, CQI/IRCA, BSI, LRQA, SGS)	ISACA (single authority)
Scope	ISO/IEC 27001:2022 ISMS audits	Information systems audit, control, and assurance generally
Examination fee	$500–$700 standalone	$575 member, $760 non-member
Experience requirement	300 audit hours (PECB) or 35 audit days (CQI/IRCA)	5 years of IS audit, control, or security experience
Renewal cycle	3 years	Annual, with a 3-year CPE cycle
Recognition	Strongest in ISO certification and management-system contexts	Strongest in enterprise IT audit and financial-services contexts

Professionals whose work centres on ISO/IEC 27001 certification audits require the Lead Auditor credential; CISA does not qualify a person to audit on behalf of an accredited certification body.

Professionals conducting broad IT audit work across frameworks — SOC 2, PCI DSS, internal control environments — derive wider applicability from CISA.

SOC 2 warrants a brief distinction here, as it is frequently compared with ISO/IEC 27001 in vendor procurement.

SOC 2 is an attestation reported under AICPA standards by a licensed CPA firm; ISO/IEC 27001 is a certification issued by an accredited certification body against a management system standard.

An ISO 27001 Lead Auditor credential does not authorise the holder to perform SOC 2 attestation work, which requires CPA licensure.

The audit methodology standard changed in 2026

ISO 19011:2026, Edition 4, was published on Wednesday, May 27, 2026, superseding ISO 19011:2018, which is now withdrawn. Lead Auditor training and practice reference this standard for audit principles, audit programme management, and auditor competence evaluation.

The revision introduced several changes that alter audit practice:

Remote and hybrid auditing is formally recognised as a standard operating mode rather than an exception. Annex A was expanded with guidance on digital evidence collection through collaborative platforms, videoconferencing, cloud systems, and electronic records.
Digital evidence handling carries explicit information security obligations, covering confidentiality, traceability, and access control over audit documentation.
Audit planning is now expressly risk-based. Frequency, sampling approach, and process selection must be formally justified against criticality and historical performance, rather than applied uniformly.
Evaluation shifted from process existence to system effectiveness, requiring auditors to assess performance outcomes and the prevention of systematic deviation.
Auditor competence criteria now include digital skills — electronic record analysis, cloud data navigation — alongside remote interview technique.
Climate change considerations were incorporated, consistent with recent ISO amendments across management system standards.

Candidates purchasing training in late 2026 should confirm the course reflects ISO 19011:2026.

Material referencing the 2018 edition describes a withdrawn standard, particularly regarding remote audit treatment.

Frequently asked questions

Is ISO 27001 Lead Auditor certification worth it?

The credential is a stated requirement in most third-party ISMS audit and GRC consulting job specifications. Return is highest for professionals in audit-focused roles and limited for technical security roles such as SOC analysis or penetration testing.

How much does ISO 27001 Lead Auditor certification cost?

Between $799 and $3,850 total. Self-paced PECB routes cost $799 to $899, including two examination attempts. Instructor-led courses through BSI, LRQA, or SGS cost $2,400 to $3,850, with some providers billing the examination separately at $500 to $700.

Do candidates need experience to become an ISO 27001 Lead Auditor?

No experience is required to sit the examination or receive the Provisional Auditor credential. The full Lead Auditor grade requires 300 documented audit hours plus 5 years of professional experience including 2 years in information security under PECB, or 7 audits totalling 35 days under CQI/IRCA.

How long is ISO 27001 Lead Auditor certification valid for?

Three years. Renewal requires 90 CPD hours and payment of the $390 Annual Maintenance Fee for PECB Lead-level credentials. Lapsed certifications enter a 12-month suspension before revocation.

Can ISO 27001 Lead Auditor certification be completed online?

Yes. PECB-authorised partners deliver self-paced and eLearning routes from $799, and the examination is available remote-proctored through the PECB Exams application with continuous webcam monitoring. CQI/IRCA courses are delivered predominantly through classroom or virtual classroom formats.

What is the difference between ISO 27001 Lead Auditor and Lead Implementer?

Lead Auditor certifies competence to independently evaluate an ISMS against ISO/IEC 27001:2022. Lead Implementer certifies competence to design, implement, and maintain one. Auditors verify; implementers build.

Does an ISO 27001 Lead Auditor course satisfy PCI QSA requirements?

No. Qualified Security Assessor status is administered by the PCI Security Standards Council and requires separate QSA training, employment by a QSA company, and PCI DSS-specific qualification. ISO 27001 Lead Auditor training does not contribute toward QSA certification.

How should candidates prepare for the ISO 27001 Lead Auditor exam?

Study ISO/IEC 27001:2022 Clauses 4 through 10 and the 93 Annex A controls, review audit methodology under ISO 19011:2026, and practise scenario-based judgement questions. Because the examination is open-book, preparation should prioritise applied evaluation over memorisation, and candidates should index their reference copy of the standard for rapid clause lookup.

Sources:

October 5, 2026

Medical Coding and Billing Certification: Cost & Types 2027

Medical coding and billing certification is issued by three independent credentialing bodies — AAPC, AHIMA, and NHA — not by the schools that prepare candidates for their exams.

Exam fees range from $129 for the NHA Certified Billing and Coding Specialist to $499 for the AAPC Certified Professional Coder with two attempts included.

Passing the CPC exam without verified work experience does not award the CPC credential; it awards CPC-A, an apprentice designation that remains visible on AAPC’s public verification directory until specific experience requirements are documented.

Two clarifications before proceeding, because both affect which credential a candidate should pursue:

Medical billing and medical coding are separate occupations. AAPC certifies them separately: the Certified Professional Coder (CPC) for coding, the Certified Professional Biller (CPB) for billing. Training programs market them as one subject. Employers post them as different jobs.
A school’s accreditation is not the certification. Institutional accreditation determines federal financial aid eligibility. The credential itself comes from AAPC, AHIMA, or NHA after a candidate passes their examination, regardless of which program provided the preparation.

At a glance

Attribute	Detail
Certifying bodies	AAPC, AHIMA, NHA
Standard-setting bodies (do not certify individuals)	AMA (CPT), CMS (HCPCS Level II, reimbursement rules), WHO (ICD)
Entry-level credentials	CPC (AAPC), CCA (AHIMA), CBCS (NHA)
Advanced credentials	CCS (AHIMA), CPMA, CRC, CEMC (AAPC), RHIT/RHIA (AHIMA)
Exam fee range	$129 (CBCS) to $499 (CPC, two attempts)
Minimum hard prerequisite	High school diploma (CCA, CBCS); none stated for CPC
Code sets tested	ICD-10-CM, CPT, HCPCS Level II; ICD-10-PCS for inpatient credentials
BLS median pay, 2024	$50,250 per year ($24.16 per hour)
Projected job growth, 2024–2034	7 percent, with about 14,200 annual openings
Renewal	36 CEUs per 2 years (AAPC); 10 CE credits per 2 years (NHA)

What is medical coding and billing certification?

Medical coding and billing certification is a credential awarded by an independent certifying organization that verifies a candidate’s competence in translating clinical documentation into standardized code sets and processing the resulting reimbursement claims.

The three organizations that issue these credentials in the United States are AAPC, AHIMA, and NHA.

Certification is distinct from licensure. No U.S. state licenses medical coders. This means certification is not legally required to perform coding work, but it functions as the practical hiring standard, and the U.S. Bureau of Labor Statistics lists a postsecondary nondegree award as the typical entry-level education for medical records specialists.

Medical billing and medical coding are two different jobs

Coding and billing are sequential functions in the revenue cycle, performed by different people in most organizations of meaningful size. Coding converts documentation into codes. Billing converts codes into payment.

A coder reads the clinical record and assigns codes from three primary sets:

ICD-10-CM — diagnosis codes, used across all U.S. healthcare settings
CPT — Current Procedural Terminology, five-digit Category I, II, and III codes owned and published by the American Medical Association, covering outpatient procedures and services
HCPCS Level II — national alphanumeric codes maintained by CMS covering supplies, durable medical equipment (DME), prosthetics, and injectable drugs

A biller takes those codes and manages the claim through to payment. The billing workflow involves distinct artifacts and processes:

CMS-1500 (formerly HCFA-1500) — the standard claim form for professional physician services
UB-04 (CMS-1450) — the standard institutional claim form for hospitals and inpatient facilities
Clearinghouses — intermediary platforms such as Availity and Change Healthcare that scrub and batch electronic claims before payer submission
EOB and ERA — Explanation of Benefits and Electronic Remittance Advice, detailing allowed amounts, covered charges, deductibles, and coinsurance
Denial management and A/R aging — appeal workflows tracking accounts receivable at 30, 60, and 90-plus days
Prior authorization and pre-certification — coverage verification performed before elective procedures

Coding attracts approximately six times the interest of billing, though both functions employ substantial numbers of people.

Who issues medical coding certifications?

Three organizations issue the credentials employers recognize, and each has a distinct institutional orientation.

Body	Full name	Orientation	Flagship credential
AAPC	American Academy of Professional Coders	Physician practice, outpatient	CPC
AHIMA	American Health Information Management Association	Hospital, inpatient, health information management	CCS
NHA	National Healthcareer Association	Entry-level, billing-weighted	CBCS

Three further organizations govern the code sets themselves without certifying individual coders. Confusing them with certifying bodies is common:

AMA (American Medical Association) owns and publishes the CPT code set.
CMS (Centers for Medicare & Medicaid Services) maintains HCPCS Level II, sets reimbursement rules, and publishes National Correct Coding Initiative (NCCI) edits.
WHO (World Health Organization) develops and maintains the ICD classification system, including ICD-10 and ICD-11.

A candidate cannot become “AMA certified” or “CMS certified” in coding. Those designations do not exist.

The code sets you will work in

Coding credentials test fluency across specific code sets, and which sets appear on an exam depends on the credential’s setting orientation.

Code set	Scope	Setting
ICD-10-CM	Diagnoses	All settings
ICD-10-PCS	Procedures	Inpatient hospital only
CPT (Category I, II, III)	Procedures and services	Outpatient, physician services
HCPCS Level II	Supplies, DME, prosthetics, injectables	All settings
MS-DRG	Inpatient prospective payment classification	Inpatient hospital
Modifiers (-25, -59, -XS, -50)	Alter a code’s description without changing its definition	All settings

ICD-10-PCS applies exclusively to inpatient hospital procedure reporting. An outpatient physician-practice coder holding a CPC will typically never assign an ICD-10-PCS code.

This distinction determines whether the CPC or the CCS is the appropriate credential for a given career target.

The code sets update annually. The FY 2026 ICD-10-CM update added 487 new diagnosis codes effective Wednesday, October 1, 2025, covering additions including war operations injuries and specified food allergies.

The FY 2027 update takes effect Thursday, October 1, 2026. Coders purchase current codebooks each year; certification does not expire when codes change, but competence requires tracking the annual cycle.

What CPC-A means and why it matters more than the exam

CPC-A is the apprentice designation AAPC assigns to candidates who pass the Certified Professional Coder examination without documented coding experience.

The “-A” suffix appears on the credential and in AAPC’s public verification directory, and it remains until the candidate submits documentation satisfying one of five defined removal pathways.

This is the most consequential mechanic of the credential and the one most frequently omitted from program marketing.

A candidate who pays $425 for the exam, passes it, and expects to be a Certified Professional Coder will instead be a Certified Professional Coder – Apprentice.

Hiring managers in coding departments read the distinction.

How to remove the CPC-A apprentice designation

Five documented pathways remove the apprentice designation. Candidates may combine them.

Pathway	Requirement	Cost
Work experience	Two years of on-the-job coding experience	—
Education plus experience	80 or more contact hours of coder training, plus employer verification of at least one year of on-the-job experience	Varies by program
Practicode	AAPC web-based platform using redacted real medical records; counts toward one year of experience	$250–$300
Project Xtern	Placement at one of approximately 200 approved official extern sites for three to twelve months, accumulating 80 hours	—
Letters of recommendation	Two signed letters on AAPC’s Apprentice Removal Template — one from an employer documenting coding experience, one from a co-worker addressing application of CPC concepts	—

For the education-plus-experience pathway, documentation accepted includes an unofficial transcript, an instructor letter, or a diploma evidencing the 80 contact hours.

Externships are accepted as a form of experience for the letters pathway.

The Practicode limitation most guides omit

Practicode substitutes for one year of experience, not two. Because the standalone work-experience pathway requires two years, Practicode alone does not remove the apprentice designation.

It must be paired with a second qualifying element — typically one year of verified employment, or the 80-contact-hour education requirement.

Project Xtern carries a parallel limitation. It accumulates relevant hours and generates the employment relationship needed for a recommendation letter, but participation alone does not satisfy a removal pathway.

Candidates should confirm current requirements directly with AAPC before purchasing Practicode, as scheme rules are revised periodically.

Which medical coding and billing certification should you get?

The appropriate credential depends on target setting and current experience level. CPC suits physician practice and outpatient work.

CCA suits candidates with no experience seeking the lowest-barrier legitimate credential.

CCS suits experienced coders targeting hospital inpatient work. CBCS suits candidates whose training program bundles it and whose target roles are billing-weighted.

	CPC (AAPC)	CCA (AHIMA)	CCS (AHIMA)	CBCS (NHA)
Setting orientation	Physician practice, outpatient	Entry-level, both settings	Hospital, inpatient, advanced	Billing-weighted
Exam fee	$425 one attempt; $499 two attempts	$199 member; $299 non-member	$299 member; $399 non-member	$129
Membership dues	$222/yr professional; $157/yr student	Optional	Optional	Not required
Questions	100 multiple choice	105 (90 scored, 15 pretest)	107 (97 scored, 10 pretest)	100 multiple choice
Time limit	4 hours	2 hours	4 hours	3 hours
Passing standard	70 percent	300 scaled score	300 scaled score	Not published as percentage
Reference materials	Open codebook (ICD-10-CM, CPT, HCPCS Level II)	Closed	Closed	Closed
Hard prerequisite	None stated	High school diploma	Experience or prior credential required	High school diploma plus training program
Apprentice designation applies	Yes (CPC-A)	No	No	No
Renewal cycle	36 CEUs per 2 years	AHIMA CEU cycle	AHIMA CEU cycle	10 CE credits per 2 years

CPC — the outpatient standard

The Certified Professional Coder is AAPC’s flagship credential and the most frequently named certification in physician-practice job postings.

The examination consists of 100 multiple-choice questions administered over four hours, with a 70 percent passing threshold and open access to the ICD-10-CM, CPT, and HCPCS Level II codebooks.

The open-codebook format changes what the exam measures. Candidates are not tested on memorization of individual codes.

They are tested on navigation speed, guideline application, and correct modifier selection under time pressure — four hours for 100 questions allows approximately 2.4 minutes per question.

The CPC-A consequence applies to every candidate who sits the exam without verified experience.

CCA — the lowest-barrier legitimate credential

The Certified Coding Associate is AHIMA’s entry-level generalist credential, and a high school diploma is its only hard eligibility requirement.

At $199 for AHIMA members, it carries the lowest total entry cost of any credential examined here.

AHIMA recommends, but does not mandate, that candidates hold at least one of the following: six months of hands-on coding experience; completion of an AHIMA-approved coding program (PCAP); or completion of other coding training covering anatomy, medical terminology, ICD coding, and CPT coding.

The examination comprises 105 questions, of which 90 are scored and 15 are unscored pretest items, delivered in two hours at Pearson VUE testing centers with a passing scaled score of 300.

One procedural constraint distinguishes the CCA exam and affects pacing strategy: candidates cannot navigate backward between questions or flag items for later review.

Each question must be answered before advancing.

CCS — the inpatient credential with real prerequisites

The Certified Coding Specialist is AHIMA’s advanced credential for inpatient and acute care chart coding, and it is not an entry-level certification.

Candidates must satisfy at least one of five eligibility routes:

Complete coursework in anatomy and physiology, pathophysiology, pharmacology, medical terminology, reimbursement methodology, intermediate or advanced ICD diagnostic coding, and CPT/HCPCS procedural coding, plus one year of direct coding experience.
Accumulate a minimum of two years of related coding experience applying codes directly.
Hold the CCA credential plus one year of coding experience.
Hold a coding credential from another certifying organization plus one year of coding experience.
Hold a current CCS-P, RHIT, or RHIA credential.

The examination comprises 107 questions, of which 97 are scored, and 10 are pretest items, delivered over four hours with a passing scaled score of 300.

Exam fees are $299 for AHIMA members and $399 for non-members, with retake fees identical to initial fees.

The CCS appears frequently on “best certifications for beginners” listicles. Its published eligibility requirements exclude beginners.

CBCS — NHA’s billing-weighted entry credential

The Certified Billing and Coding Specialist is issued by the National Healthcareer Association at an examination cost of $129, the lowest of the four credentials compared here.

Eligibility requires a high school diploma or equivalent plus completion of a medical billing and coding training program covering medical terminology, coding systems, reimbursement methods, and anatomy and physiology.

The examination comprises 100 multiple-choice questions delivered over three hours, covering medical terminology, ICD-10, CPT, and HCPCS coding, billing procedures, compliance, and insurance claims. Administration is available in person or through Live Remote Proctoring.

Renewal occurs every two years and requires 10 continuing education credits plus a $185 renewal fee, with an additional $60 for each further NHA credential held.

Candidates holding multiple NHA certifications need only 10 CE credits total to maintain all of them.

The CBCS is commonly bundled into vocational and community college programs. It carries less recognition than the CPC in physician-practice coding roles, which candidates should weigh against its lower cost.

CPB — if the objective is billing rather than coding

The Certified Professional Biller is AAPC’s dedicated billing credential, covering claim creation, denial appeals, and revenue recovery rather than code assignment.

Candidates whose target roles involve accounts receivable, denial management, and payer communication should compare the CPB against the CPC directly rather than defaulting to the coding credential.

RHIT and RHIA — the degree-dependent track

The Registered Health Information Technician and Registered Health Information Administrator are AHIMA credentials tied to completed academic degrees — associate level for RHIT, bachelor’s level for RHIA.

These are health data management credentials rather than production coding credentials, and they open supervisory and health information management pathways that CPC and CCA do not.

Specialty credentials for later career stages

Three AAPC specialty credentials commonly follow initial certification, and none function as entry points:

CRC (Certified Risk Adjustment Coder) — hierarchical condition category (HCC) risk adjustment coding
CPMA (Certified Professional Medical Auditor) — medical record auditing and compliance review
CEMC (Certified Evaluation and Management Coder) — E/M leveling specialty

What does medical coding and billing certification cost?

Certification cost divides into two components that candidates routinely conflate: examination and credentialing fees, which range from $129 to $647, and training program costs, which range from a few hundred dollars for self-study to several thousand for accredited degree programs.

The credential is issued on the basis of the exam, not the program.

Examination and credentialing fees

The following figures reflect published pricing as of Thursday, August 27, 2026.

Credential	Exam fee	Membership	Minimum total entry cost
CBCS (NHA)	$129	Not required	$129
CCA (AHIMA)	$199 member / $299 non-member	Optional	$199
CCS (AHIMA)	$299 member / $399 non-member	Optional	$299
CPC (AAPC)	$425 one attempt / $499 two attempts	$157 student / $222 professional	$582 student / $647 professional

AHIMA retake fees match initial examination fees. AAPC’s $499 option includes a second attempt, which reduces cost relative to paying $425 twice.

Training program costs

Training is the larger and more variable expense. Four delivery models exist:

Self-study — current-year codebooks (ICD-10-CM, CPT, HCPCS Level II) plus practice examinations, typically several hundred dollars, with no institutional support
Certifying-body courses — AAPC and AHIMA both sell preparation courses aligned to their own examinations
Community college certificates — generally the lowest-cost accredited option, often financial-aid eligible
For-profit online programs — the highest-cost option, frequently marketed with job-placement language

Advertisers bidding at that level are institutions monetizing federally aid-eligible enrollments.

Financial aid, FAFSA, and what aid eligibility does not indicate

Federal financial aid requires enrollment at an institution holding recognized institutional accreditation. Self-study, AAPC’s own courses, and most non-degree preparation programs are not federal aid eligible.

Aid eligibility indicates that an institution has met accreditation standards for institutional operation. It does not indicate examination pass rates, employment outcomes, or credential recognition.

Candidates evaluating an aid-eligible program should request the same disclosures they would request from any program: which credential examination it prepares for, whether the examination fee is included, whether the curriculum satisfies AAPC’s 80-contact-hour requirement, and what verifiable placement data exists.

Is free medical coding and billing certification available?

No certifying body issues a credential without an examination fee. Free training material is widely available; free certification is not. The lowest published examination fee among recognized credentials is $129 for the NHA CBCS.

Free resources that do exist include introductory coding tutorials, CPT and ICD-10-CM code lookup tools, and sample examination questions published by preparation providers.

What “accredited” actually means in medical coding

Three separate approvals are marketed as “accreditation” in this field, and they authorize different things. None of them issue a coding credential.

Type	Granted by	What it determines	What it does not do
Institutional accreditation	Regional or national accreditors	Federal financial aid eligibility; degree recognition	Does not issue a coding credential
PCAP approval	AHIMA	Program alignment with AHIMA credential preparation	Does not issue a coding credential
Curriculum approval	AAPC	Satisfies the 80-contact-hour education requirement in the CPC-A removal pathway	Does not issue a coding credential

The credential is issued by AAPC, AHIMA, or NHA after a candidate passes their examination. A candidate who self-studies and passes the CPC examination holds the identical credential as a candidate who completed a $15,000 degree program and passed the same examination.

This distinction is the most commercially exploited confusion in the vertical. Programs market accreditation because it is the attribute they control; the credential is not.

How long does medical coding and billing certification take?

Examination preparation typically takes four weeks to twelve months depending on delivery format and prior healthcare background.

Reaching a fully credentialed, employable position takes longer, because the CPC-A apprentice designation requires documented experience that examination preparation does not provide.

Advertised program lengths span a wide range, and the range itself is meaningful:

Advertised program length	Typical format	Realistic scope
4 to 6 weeks	Intensive online, self-paced	Examination preparation only; assumes prior medical terminology knowledge
8 to 12 weeks	Structured online cohort	Examination preparation with guided instruction
3 to 6 months	Certificate program	Full curriculum including anatomy, terminology, and coding practice
9 to 12 months	Comprehensive certificate	Curriculum plus externship placement in some programs
18 to 24 months	Associate degree	Academic credential plus certification preparation

Two timelines should be assessed separately. Time to pass an examination is measured in weeks or months.

Time to remove a CPC-A designation is measured in one to two years, unless a candidate combines Practicode with a qualifying education or employment pathway.

Compressing both into a single advertised figure is the mechanism by which accelerated-program marketing overstates speed to employment.

Certificate, diploma, or associate degree?

No certifying body requires a degree. AAPC states no formal education prerequisite for the CPC examination.

AHIMA requires a high school diploma for the CCA. NHA requires a high school diploma plus completion of a training program for the CBCS.

A degree becomes relevant in three circumstances:

RHIT and RHIA eligibility, which are explicitly tied to completed associate and bachelor’s degrees, respectively
Health information management advancement, where supervisory and departmental roles commonly specify degree requirements
Federal financial aid access, since degree programs at accredited institutions are aid-eligible while standalone certification preparation generally is not

The certification examinations

Examination structure varies materially across the four credentials, and format affects preparation strategy more than content overlap suggests.

CPC examination format

The CPC examination presents 100 multiple-choice questions over four hours with a 70 percent passing threshold. Candidates may reference the ICD-10-CM, CPT, and HCPCS Level II codebooks throughout.

Open-codebook administration means preparation should prioritize three capabilities over memorization: locating codes rapidly through index and tabular navigation, applying coding guidelines and conventions correctly, and selecting appropriate modifiers.

Candidates commonly tab and annotate their codebooks in advance, within AAPC’s stated annotation rules.

AHIMA examination formats

Both AHIMA examinations use scaled scoring with a passing score of 300 and are administered at Pearson VUE testing centers.

	CCA	CCS
Total questions	105	107
Scored questions	90	97
Pretest questions	15	10
Time limit	2 hours	4 hours
Backward navigation	Not permitted	—

The CCA’s prohibition on backward navigation and question flagging requires a different pacing approach than examinations permitting review.

Two hours for 105 questions allows approximately 68 seconds per question with no opportunity to revisit.

What is the CPC examination pass rate?

AAPC does not publish an official first-attempt pass rate for the CPC examination. No figure appears in AAPC’s published examination documentation.

Pass rate percentages circulating on preparation-provider websites are estimates rather than disclosed data, and should be treated as marketing claims.

Candidates assessing difficulty should reference the published structure instead: a 70 percent threshold, open-codebook access, and 2.4 minutes per question.

What the examinations test beyond code assignment

Certification examinations assess regulatory and compliance knowledge alongside coding mechanics, because coders operate within a framework carrying legal consequences.

The compliance content spans:

HIPAA — Privacy, Security, and Breach Notification rules governing protected health information (PHI)
OIG compliance guidance — Office of Inspector General recommendations for preventing healthcare fraud, abuse, and improper billing
False Claims Act and Anti-Kickback Statute — federal statutes penalizing upcoding, unbundling, and kickback arrangements
Medical necessity and documentation integrity — the clinical justification CMS requires to substantiate billed services
NCCI edits — automated CMS edits, comprising Procedure-to-Procedure (PTP) edits and Medically Unlikely Edits (MUEs), that prevent improper code bundling

Upcoding and unbundling are not technical errors. They are billing practices with statutory exposure under the False Claims Act, which is why certification examinations test them and why employers weight credentialed candidates.

Medical coding and billing salary

The U.S. Bureau of Labor Statistics reports a median annual wage of $50,250 for medical records specialists as of 2024, equivalent to $24.16 per hour, across 194,800 positions.

Check Out Medical Billing and Coding Salary Guide 2027

Employment is projected to grow 7 percent from 2024 to 2034, described by BLS as much faster than the average for all occupations, with approximately 14,200 openings projected annually over the decade.

Metric	Value	Source year
Median annual pay	$50,250	2024
Median hourly pay	$24.16	2024
Total positions	194,800	2024
Projected growth	7 percent	2024–2034
Annual openings	~14,200	2024–2034 average
Typical entry education	Postsecondary nondegree award	2024

Candidates will encounter higher figures on training-provider websites. AAPC publishes its own member salary survey, which reports higher averages because it samples credentialed AAPC members specifically rather than the full occupational category BLS measures.

Both figures are accurate for their respective populations. The BLS number includes uncredentialed medical records staff; the AAPC number does not.

Salary also varies by credential, setting, and specialty. Risk adjustment coding (CRC) and auditing (CPMA) typically command premiums over general outpatient coding, though the magnitude varies by market and is not consistently published.

Remote and work-from-home coding

Remote medical coding is common among experienced coders and uncommon at entry level. Employers assign remote work after demonstrated accuracy, because production coding requires minimal supervision and quality is measured through audit rather than observation.

This compounds the CPC-A problem for career changers specifically targeting remote work. A candidate holding CPC-A with no production experience faces two simultaneous barriers: the apprentice designation and the general scarcity of entry-level remote positions.

Candidates should plan for an on-site or hybrid first role in most markets.

Will you actually get hired after certification?

Certification is necessary but not sufficient for employment in most coding markets. Employers commonly request one to two years of experience for positions advertised as entry-level, and the CPC-A designation signals the absence of that experience directly.

Five approaches address the experience barrier, and candidates typically combine several:

Complete an externship before or during certification. AAPC’s Project Xtern places candidates at approximately 200 approved sites for three to twelve months. Externship experience is accepted toward apprentice removal letters.
Purchase Practicode to convert study time into one year of credited experience, then pair it with the 80-contact-hour education pathway or one year of employment.
Enter through an adjacent role. Patient access, medical records clerk, insurance verification, and prior authorization positions generate healthcare revenue cycle exposure and frequently transition internally into coding.
Join a local AAPC chapter. Chapter membership provides direct access to working coders and hiring managers, and chapter meetings award CEUs applicable to renewal.
Ask a current healthcare employer for coding assignments. Candidates already employed in healthcare can often generate qualifying experience internally.

How to vet a training program before paying

Program quality varies substantially, and marketing language does not distinguish it.

Request the following before payment:

Which specific credential examination the program prepares for, named explicitly (CPC, CCA, CCS, or CBCS)
Whether the examination fee is included in tuition or billed separately
Whether the curriculum satisfies AAPC’s 80-contact-hour requirement for the CPC-A education pathway, with documentation available
Whether externship placement is provided, and at how many sites
What verifiable job placement data exists, distinguishing placement in coding roles from placement in any healthcare role
Whether current-year codebooks are included, since ICD-10-CM updates annually each October 1

A program that cannot name the credential it prepares for is not preparing candidates for certification.

Maintaining your certification

AAPC requires 36 continuing education units (CEUs) per two-year renewal cycle, of which a minimum of 24 must come from Curriculum A covering core coding topics, and up to 12 may come from Curriculum B covering broader healthcare subjects.

NHA operates a different structure. CBCS renewal occurs every two years and requires 10 continuing education credits plus a $185 renewal fee, with an additional $60 for each further NHA credential held. Holders of multiple NHA certifications need only 10 CE credits total to maintain all of them.

AHIMA maintains its own CEU cycle, with requirements varying by credential held.

Qualifying CEU activities generally include local chapter meeting attendance, webinars, conference sessions, published articles, and approved coursework.

Coders employed in production roles frequently accumulate the required credits through employer-provided training and chapter participation at minimal direct cost.

Every credentialed coder nonetheless carries the obligation. Candidates should budget for renewal fees and CEU acquisition as a recurring cost from the point of certification.

Is medical coding a durable career?

Two developments generate recurring concern among prospective coders: automation of code assignment, and eventual replacement of the ICD-10 code set.

Neither has eliminated coding roles as of Thursday, August 27, 2026, and the second has no announced implementation date in the United States.

AI, computer-assisted coding, and autonomous coding

Computer-assisted coding (CAC) systems apply natural language processing to clinical documentation and generate preliminary code suggestions.

Autonomous coding extends this by assigning codes without human review for defined, high-volume, low-complexity encounter types.

The observable industry direction shifts coder work from assignment toward validation, auditing, and exception handling.

Encounters with ambiguous documentation, complex comorbidities, or high reimbursement variance continue to require human adjudication and provider queries.

Coders work within specific platform ecosystems, and familiarity with them is a hiring factor:

EHR systems — Epic Systems, Cerner (Oracle Health), Athenahealth, eClinicalWorks
Encoder tools — 3M Coding and Reimbursement System, AAPC Codify, Find-A-Code
Clearinghouses — Availity, Change Healthcare

Candidates entering the field in 2026 should weight specialties that automation addresses least effectively, including risk adjustment coding (CRC), medical auditing (CPMA), denial management, and clinical documentation improvement.

ICD-11 and whether ICD-10-CM is becoming obsolete

The United States remains in the exploratory phase of ICD-11 adoption, and no implementation date has been announced. ICD-10-CM remains mandatory for billing.

The National Center for Health Statistics (NCHS) and CMS are conducting research, pilot studies, and public listening sessions.

Mapping and crosswalk tools are under development, and AHIMA and NCHS are producing educational resources.

Barriers cited include the complexity of the dual ICD-10-CM and ICD-10-PCS structure, payer framework alignment, large-scale retraining requirements, and health IT system updates.

WHO maintains ICD-11 internationally, and several countries have adopted it. U.S. adoption depends on pilot outcomes, vendor readiness, and policy alignment rather than a published deadline.

Candidates should note that certification does not expire when a code set is revised. ICD-10-CM already updates annually — 487 new codes took effect Wednesday, October 1, 2025 — and credentialed coders absorb those revisions through CEU activity rather than recertification.

Frequently asked questions

What is the difference between medical billing and medical coding?

Coding converts clinical documentation into ICD-10-CM, CPT, and HCPCS Level II codes. Billing submits those codes as claims and pursues reimbursement through appeals and accounts receivable management. AAPC certifies them separately as CPC and CPB.

Which medical coding certification is best for beginners?

The CCA carries the lowest barrier at $199 for AHIMA members, with a high school diploma as its only hard requirement. The CPC carries broader employer recognition but awards the CPC-A apprentice designation to candidates lacking documented experience.

How much does medical coding and billing certification cost?

Examination fees range from $129 for the NHA CBCS to $647 for the AAPC CPC, including professional membership. Training programs add several hundred dollars for self-study up to several thousand for accredited degree programs.

How long does medical coding and billing certification take?

Examination preparation takes four weeks to twelve months depending on format and background. Removing the CPC-A apprentice designation takes one to two years unless Practicode is combined with a qualifying education or employment pathway.

Do you need a degree for medical billing and coding?

No certifying body requires a degree. AAPC states no education prerequisite for the CPC. AHIMA requires a high school diploma for the CCA. Degrees are required only for the RHIT and RHIA credentials.

Is medical coding and billing certification worth it?

Certification is the practical hiring standard for coding roles, though no state licenses coders. BLS reports median pay of $50,250 in 2024 with 7 percent projected growth through 2034. Return depends substantially on removing the apprentice designation.

Can you get a medical billing and coding job without certification?

Uncredentialed positions exist, primarily in medical records and billing support rather than production coding. Most coding job postings specify CPC, CCS, or an equivalent credential as a requirement or strong preference.

What does CPC-A mean?

CPC-A designates a Certified Professional Coder – Apprentice: a candidate who passed the AAPC CPC examination without documented coding experience. The suffix appears in AAPC’s public verification directory until removal requirements are satisfied.

Is there a free medical billing and coding certification?

No certifying body issues a credential without an examination fee. The lowest published fee is $129 for the NHA CBCS. Free training materials exist; free certification does not.

How often do you renew medical coding certification?

AAPC requires 36 CEUs every two years, with at least 24 from Curriculum A. NHA requires 10 CE credits plus a $185 fee every two years. AHIMA operates its own CEU cycle by credential.

Sources:

October 5, 2026

Medical Billing and Coding Salary: What the Data Actually Shows in 2027

The U.S. Bureau of Labor Statistics reports a median annual wage of $51,140 for medical records specialists as of May 2025.

The AAPC salary survey reports substantially higher figures for its credentialed members, including $71,130 for coders holding two credentials and $76,035 for those holding three or more. Both figures are accurate.

They measure different populations, and the gap between them is the single most useful thing to understand about medical billing and coding salary data.

Check Out Medical Billing and Coding Certification

Two clarifications before the figures, because both affect which numbers apply:

This page covers medical coding, not software coding. A software developer’s compensation has no bearing on a medical coder’s, and the two fields share no wage data, classification, or credentialing structure.
Medical billers and medical coders are compensated differently. Coding converts clinical documentation into ICD-10-CM, CPT, and HCPCS Level II codes. Billing pursues reimbursement on those codes. AAPC certifies them separately — CPC for coding, CPB for billing — and this page reports both.

At a glance

Metric	Figure	Source
Median annual wage	$51,140	BLS OOH, May 2025
Mean annual wage	$56,790	BLS OEWS
Lowest 10 percent	Under $37,000	BLS OOH, May 2025
Highest 10 percent	Over $81,150	BLS OOH, May 2025
Median hourly equivalent	$24.59	Calculated at 2,080 hours
Two AAPC credentials	$71,130	AAPC salary survey
Three or more credentials	$76,035	AAPC salary survey
Highest-paying state	Delaware, $77,708	AAPC 2023 salary report
Lowest-paying state	Mississippi, $50,393	AAPC 2023 salary report
Employment, 2025	200,700 positions	BLS OOH
Projected growth, 2025–2035	8 percent	BLS OOH

Figures verified Friday, August 28, 2026.

What is the average medical billing and coding salary?

The median medical billing and coding salary is $51,140 per year, or approximately $24.59 per hour, according to Bureau of Labor Statistics data for May 2025.

The mean sits higher at $56,790, indicating that upper-end earners pull the average above the midpoint.

BLS classifies this work under SOC 29-2072, “Medical Records Specialists.” No federal occupational category called “medical coder” exists.

The classification encompasses production coders, medical records technicians, health information clerks, and release-of-information specialists — a broader population than credentialed coders alone.

The full salary range, not just the median

Medical billing and coding salaries span from under $37,000 at the 10th percentile to over $81,150 at the 90th percentile — a spread of more than $44,000.

Percentile	Annual wage	Hourly equivalent
10th	Under $37,000	Under $17.79
50th (median)	$51,140	$24.59
Mean	$56,790	$27.30
90th	Over $81,150	Over $39.01

BLS Occupational Outlook Handbook, May 2025. Hourly figures calculated at 2,080 annual hours.

A single median figure conceals the entire risk profile. A candidate evaluating whether to retrain needs the 10th percentile as much as the 90th percentile, because early-career positions cluster toward the lower end.

Pages reporting only the midpoint present an incomplete basis for that decision.

Hourly wage conversions

The median hourly wage for medical billing and coding is approximately $24.59, calculated from the $51,140 annual median at 2,080 hours per year.

Annual figure	Hourly equivalent	What it represents
$37,000	$17.79	10th percentile
$45,000	$21.63	AAPC uncredentialed average
$51,140	$24.59	BLS median
$56,790	$27.30	BLS mean
$71,130	$34.20	AAPC two-credential average
$76,035	$36.55	AAPC three-plus credential average
$81,150	$39.01	90th percentile

Hourly conversions assume full-time employment at 2,080 hours. Part-time, per diem, and contract coding positions do not follow this conversion because contract rates typically exclude employer-paid benefits, which represent an additional 20 to 30 percent of total compensation in salaried positions.

Why every salary source reports a different number

Salary sources disagree because they measure different populations, not because any of them is inaccurate.

Source	Population measured	Typical figure	Question it answers
BLS (OOH and OEWS)	All workers under SOC 29-2072, credentialed and uncredentialed	$51,140 median	What does the occupation pay?
AAPC salary survey	AAPC members, all credentialed, dues-paying	$71,130 (two credentials)	What do credentialed AAPC members earn?
Job-posting aggregators	Advertised ranges and self-reported data	Varies widely	What are employers advertising?

BLS measures the entire occupation

The Bureau of Labor Statistics surveys establishments rather than individuals, capturing every worker employed under the SOC 29-2072 classification.

That population includes uncredentialed medical records staff, which pulls the median below what a certified production coder typically earns.

BLS data carries two characteristics worth noting. It is collected on a lag — the current Occupational Outlook Handbook edition reports May 2025 figures.

And it reports no breakdown by credential, because certification status is not captured in the establishment survey.

AAPC surveys its own credentialed membership

The AAPC salary survey samples AAPC members. Every respondent holds at least one AAPC credential and pays annual dues, currently $222 for professional membership.

This is a self-selected, professionally engaged, fully credentialed population — which produces higher figures than BLS by construction.

AAPC figures are therefore appropriate for answering “what will I earn once credentialed and established,” and inappropriate for answering “what does this occupation pay on average.”

Job-posting aggregators measure advertised ranges

ZipRecruiter, Glassdoor, Payscale, Indeed, and Salary.com derive figures from posted salary ranges and voluntary self-reporting.

Methodology is generally unpublished, sample composition is unknown, and advertised ranges are not realized wages. Figures from these sources should be treated as directional rather than authoritative.

One consequence worth stating plainly: many salary pages currently ranking for this topic cite superseded BLS figures.

Pages published before the current Handbook edition report a $50,250 median from the prior data year. Readers encountering both numbers are seeing an update lag, not a contradiction.

Medical billing and coding salary by certification

Certification raises medical coding salary substantially, and holding multiple credentials raises it further.

AAPC survey data shows credentialed coders earning materially more than uncredentialed staff, with the largest increments arriving from credential accumulation rather than credential selection.

Credential status	Average salary	Corroboration
Uncredentialed	Approximately $45,000	Single source
CCA (AHIMA)	$48,321	Single source
CCS (AHIMA)	$57,500	Single source
CPC (AAPC)	$59,605	Single source
Certified (unspecified credential)	$62,689	Single source, alternate figure
Two credentials	$71,130	Two independent sources
Three or more credentials	$76,035	Two independent sources

All figures attributed to AAPC salary survey data via secondary sources. The two-credential and three-credential figures appear consistently across multiple independent citations; single-credential figures vary by source and should be verified against AAPC directly before being relied upon for financial decisions.

Reported certification premiums also vary by source: one cites a 16.6 percent premium for certified over uncertified coders, another cites 20.7 percent.

The direction is consistent across sources; the magnitude is not precisely established in publicly available secondary reporting.

Credential stacking outperforms credential selection

Adding a second credential produces a larger salary increase than choosing between first credentials.

The increment from a single credential to two credentials is approximately $11,525 based on the CPC figure, or roughly 19 percent — larger than the entire reported gap between the CCA and the CPC.

This inverts the standard framing. Most guidance on this topic addresses which certification to pursue first.

The data indicates the higher-leverage question is how many credentials to accumulate over a career, and that the first credential is better understood as an entry requirement than as the determinant of long-term earnings.

Common stacking combinations align credentials to distinct revenue functions:

CPC plus CRC — outpatient coding plus risk adjustment for Medicare Advantage populations
CPC plus CPMA — coding plus medical auditing
CCS plus CDIP — inpatient coding plus clinical documentation improvement
CPC plus CPB — coding plus billing, covering both sides of the revenue cycle
CCS plus CIC — hospital coding plus specialized inpatient coding

Credential stacking carries recurring costs. AAPC requires 36 CEUs per two-year cycle regardless of how many credentials are held, but each additional credential carries its own examination fee, and some certifying bodies charge per-credential maintenance fees. NHA, for example, charges $185 for renewal plus $60 for each additional credential held.

Which medical coding certification pays the most?

Among entry-accessible credentials, the CPC reports the highest average at $59,605. Among specialty credentials, CRC and CIC attach to the highest-paying niches.

CRC (Certified Risk Adjustment Coder) — roles ranging from $55,000 to $80,000, tied to hierarchical condition category (HCC) coding for Medicare Advantage plans
CIC (Certified Inpatient Coder) — inpatient hospital coding, with salaries ranging $60,000 to $85,000
CCS (Certified Coding Specialist) — the AHIMA hospital credential, reported at $57,500 average and the prerequisite for most auditor progression

No credential guarantees a salary band. Credential, setting, geography, and experience interact, and a CPC holder in a Delaware hospital will typically out-earn a CCS holder in a Mississippi physician practice.

Candidates deciding between credentials should read the full comparison in Medical Coding and Billing Certification, which covers examination formats, prerequisites, and costs for each.

Entry-level medical billing and coding salary

Entry-level medical billing and coding salaries typically fall between $37,000 and $45,000, corresponding to the BLS 10th-to-25th percentile band and the AAPC uncredentialed average of approximately $45,000.

Three factors compress starting pay below the occupational median:

The apprentice designation. Candidates who pass the AAPC CPC examination without documented experience receive CPC-A, an apprentice credential that employers distinguish from full CPC status.
Production ramp time. Coding roles are typically compensated against productivity standards measured in charts or lines per hour, with accuracy thresholds commonly set at 95 percent or higher. New coders reach standard over months, not weeks.
Setting availability. Entry-level positions concentrate in physician offices and administrative support services, which report the lowest industry medians at $47,120 and $49,490, respectively.

How long does it take to reach the median salary?

Reaching the $51,140 median typically requires removing the apprentice designation and accumulating one to three years of production experience.

Examination preparation itself takes weeks to months; the wage progression is governed by experience documentation rather than study time.

AAPC’s apprentice removal pathways require two years of coding experience, or one year combined with 80 contact hours of training, or Practicode completion paired with a second qualifying element. Full details on those pathways appear in Medical Coding and Billing Certification.

This timeline does not apply uniformly. Candidates entering with prior healthcare revenue cycle experience — patient access, insurance verification, or medical records roles — frequently satisfy experience requirements faster and start above the entry band.

Medical billing and coding salary by state

Geographic location produces a larger salary spread than credentialing does. AAPC state-level data shows a $27,315 gap between the highest-paying and lowest-paying states, exceeding the reported gap between uncredentialed and CPC-credentialed coders.

Highest-paying states

Rank	State	Annual salary	Hourly rate
1	Delaware	$77,708	$37.36
2	California	$77,077	$37.06
3	Massachusetts	$76,483	$36.77
4	New York	$74,426	$35.78
5	Washington	$73,341	$35.26

Lowest-paying states

Rank	State	Annual salary	Hourly rate
1	Mississippi	$50,393	$24.23
2	North Dakota	$55,047	$26.46
3	Kansas	$56,179	$27.01
4	Wyoming	$57,500	$27.64
5	West Virginia	$58,069	$27.92

AAPC 2023 Medical Coding and Billing Salary Report. State figures reflect AAPC’s credentialed membership and are dated earlier than the BLS national figures cited elsewhere on this page.

State salary figures should be assessed against cost of living rather than in isolation. California and Massachusetts appear among the highest-paying states and also among the highest-cost states.

Delaware’s position at the top reflects concentration of health system and insurance employers relative to a small workforce, which can produce volatile year-to-year figures in survey data.

How remote work changes the geographic calculation

Remote coding positions are typically benchmarked to the employer’s location or to a national band, not the coder’s residence.

This creates a wage arbitrage opportunity for coders living in lower-cost states who secure positions with employers in higher-paying markets.

Reported remote figures vary considerably by source and role. One aggregator reports an average remote medical billing salary of $46,638, below the national median — a figure that likely reflects a concentration of entry-level and billing-focused remote roles rather than experienced coding positions.

Remote coding is not generally available at entry level. Production coding is supervised through retrospective audit rather than direct observation, and employers typically require demonstrated accuracy before authorizing remote work. Candidates should plan for an on-site or hybrid first position in most markets.

Salary by work setting and industry

Hospital employment pays approximately $12,000 more at the median than physician office employment. BLS industry data for May 2025 shows a clear stratification by employer type.

Industry	Median annual wage
Management of companies and enterprises	$60,980
Hospitals; state, local, and private	$59,120
Administrative and support services	$49,490
Offices of physicians	$47,120
Professional, scientific, and technical services	$46,800

BLS Occupational Outlook Handbook, May 2025.

This stratification maps directly onto the credential decision. AHIMA credentials (CCS, CIC) orient toward hospital settings; AAPC’s CPC orients toward physician practice.

The $12,000 industry median differential attaches a dollar figure to that choice, which credential comparisons rarely provide.

Setting-level ranges reported by industry sources align with the BLS pattern:

Setting	Typical range	Associated credential
Inpatient hospital	$60,000–$85,000	CCS, CIC
Outpatient hospital	$50,000–$70,000	CCS, COC
Ambulatory surgery center	$48,000–$68,000	COC, CCS
Physician practice (ProFee)	$45,000–$65,000	CPC

Professional fee (ProFee) coding — coding services rendered directly by physicians rather than facility charges — represents the largest employment category and the entry point for most CPC holders.

Highest-paying medical coding specialties

Coding auditor positions report the highest non-management range at $70,000 to $95,000, followed by risk adjustment coding at $55,000 to $80,000.

Specialty	Typical range	Credential	Function
Coding auditor	$70,000–$95,000	CCS or CPMA plus experience	Reviews coder accuracy and compliance
Risk adjustment / HCC	$55,000–$80,000	CRC	Captures chronic conditions for Medicare Advantage
Inpatient hospital	$60,000–$85,000	CCS, CIC	Assigns ICD-10-PCS and MS-DRG
Coding denial specialist	Varies by market	CPC plus CPB	Analyzes and appeals denied claims
Outpatient hospital	$50,000–$70,000	COC, CCS	Facility outpatient coding
Professional fee coding	$45,000–$65,000	CPC	Physician services

Risk adjustment coding commands a premium because of its direct revenue impact. HCC coding determines risk adjustment factor scores, which determine per-member-per-month payments to Medicare Advantage plans.

Coding accuracy translates into measurable plan revenue, and compensation reflects that leverage.

Coding denial specialists occupy the intersection of coding and billing, analyzing rejected claims against NCCI edits, medical necessity requirements, and payer policy to recover revenue.

Where medical coding careers top out

Three progression paths raise earnings above production coding: auditing, clinical documentation improvement, and health information management.

Each requires credentials beyond entry level and several years of production experience.

Coding auditor — $70,000 to $95,000, reviewing coder output for accuracy and compliance; typically requires CCS or CPMA plus documented production history
CDI specialist (Clinical Documentation Improvement) — queries providers to improve documentation completeness before coding occurs; credentials include CDIP and CCDS
HIM manager (Health Information Management) — departmental leadership; frequently requires RHIT or RHIA, which are degree-dependent AHIMA credentials

Travel and contract coding

Travel inpatient coding pays $40 to $55 per hour plus a housing stipend, annualizing to approximately $85,000 to $115,000. Travel CDI pays $60 to $90 per hour plus a stipend, annualizing to approximately $125,000 to $185,000.

These arrangements sit substantially above every figure reported elsewhere on this page and are available to experienced credentialed coders. Four conditions apply:

Contract duration is finite, typically 13 to 26 weeks, with no guarantee of renewal.
Benefits are frequently excluded or reduced relative to salaried employment, and the hourly rate must be discounted accordingly when comparing total compensation.
Stipend eligibility requires maintaining a tax home and duplicating living expenses; coders who do not meet Internal Revenue Service criteria have stipends treated as taxable income.
Engagement may be structured as 1099 rather than W-2, shifting payroll tax liability to the coder.

Travel coding is not an entry-level option. Agencies typically require two to five years of production experience and current credentials appropriate to the setting.

Medical biller salary versus medical coder salary

Medical billers earn less than medical coders at the national level. Aggregate data reports a medical biller salary of approximately $46,000 to $50,000 against the $51,140 median for the broader medical records specialist classification, though the two roles overlap substantially in smaller practices where one person performs both functions.

Role	Primary function	Certifying credential	Certifying body
Medical coder	Assigns ICD-10-CM, CPT, HCPCS Level II codes	CPC, CCS, CCA	AAPC, AHIMA
Medical biller	Submits claims, manages denials, recovers revenue	CPB	AAPC
Billing and coding specialist	Performs both in smaller practices	CBCS	NHA

AMBA (American Medical Billing Association) operates as the professional association focused specifically on the billing side, which treats AAPC as the sole relevant organization.

The billing function involves distinct artifacts and workflows that carry their own compensation dynamics: CMS-1500 forms for professional claims, UB-04 (CMS-1450) for institutional claims, clearinghouse submission through platforms including Availity and Change Healthcare, EOB and ERA reconciliation, denial appeals, and accounts receivable aging management at 30, 60, and 90-plus days.

Billing roles in large health systems and revenue cycle management vendors can exceed coding salaries, particularly in denial management and revenue integrity functions where recovered revenue is directly attributable.

Salary progression by experience

Medical coding salary progresses primarily through credential accumulation, specialty movement, and production performance rather than tenure alone.

Career stage	Typical positioning	Common credentials
Entry (0–1 year)	$37,000–$45,000; apprentice designation likely	CPC-A, CCA, CBCS
Early career (2–4 years)	Approaching the $51,140 median	CPC, CCS
Mid-career (5–9 years)	$55,000–$70,000; specialty or second credential	CPC plus CRC, CCS
Senior (10+ years)	$70,000–$95,000; auditing, CDI, or management	CPMA, CDIP, RHIT/RHIA

Three mechanisms drive increases within a given role:

Productivity standards. Coders are measured on charts or lines per hour against setting-specific benchmarks, with production bonuses common in high-volume environments.
Accuracy rate. Audit scores typically must exceed 95 percent, and sustained accuracy above benchmark supports both retention and advancement.
Specialty complexity. Movement from routine outpatient coding into surgical, interventional radiology, or inpatient coding raises compensation through a complexity premium.

Tenure alone produces limited increases. A coder remaining in the same setting, credential, and specialty for ten years will typically see cost-of-living adjustments rather than the progression indicated above.

Does a degree increase medical coding salary?

Credentials affect medical coding salary more directly than degrees do, because AAPC and AHIMA credentials are awarded on examination performance rather than academic attainment.

AAPC states no formal education prerequisite for the CPC examination; AHIMA requires a high school diploma for the CCA.

A degree becomes financially relevant in three specific circumstances:

RHIT eligibility requires a completed associate degree from a CAHIIM-accredited program.
RHIA eligibility requires a completed bachelor’s degree from a CAHIIM-accredited program.
HIM management positions frequently specify a degree requirement in job postings, independent of coding credentials held.

A degree does not substitute for a coding credential. Employers hiring production coders screen for CPC, CCS, or equivalent regardless of academic background.

The full certificate-versus-degree analysis appears in Medical Coding and Billing Certification.

Is medical billing and coding a good career?

Employment is projected to grow 8 percent from 2025 to 2035, compared with 3 percent across all occupations, adding 15,600 positions and reaching 216,300 total.

BLS projects approximately 14,000 openings annually over the decade, most arising from workers transferring occupations or retiring.

Metric	Figure
Employment, 2025	200,700
Projected employment, 2035	216,300
Numeric change	+15,600
Percent change	8 percent
All-occupation average growth	3 percent
Annual openings	Approximately 14,000

BLS Occupational Outlook Handbook.

The case against, stated honestly

Three constraints qualify the favorable outlook, and prospective coders encounter all three in practitioner communities.

The lower band is genuinely low. The BLS 10th percentile sits under $37,000, which is below median household income in most U.S. markets. Candidates who remain in entry-level physician-practice roles without accumulating credentials may not exceed that band substantially.
Entry is competitive and gated by experience. The CPC-A apprentice designation and employer preferences for one to two years of experience create a documented barrier between certification and employment.
Remote work is largely unavailable initially. The flexibility that attracts many candidates to this field is typically earned rather than granted at hire.

This career is not well suited to candidates requiring immediate remote work, immediate income above the national median, or a short path from training to employment.

It suits candidates able to absorb one to three years of below-median earnings while accumulating credentials and documented production experience.

Will AI reduce medical coding salaries?

No published evidence establishes that artificial intelligence has reduced medical coding wages as of Friday, August 28, 2026.

Automation pressure exists through computer-assisted coding, but its documented effect is a shift in task composition rather than a measured wage decline.

The Federal Reserve published research on Monday, March 23, 2026, finding that “aggregate employment of coders has decelerated sharply since the introduction of ChatGPT.”

That paper studies software programmers in computer-programming-intensive occupations. It does not study medical coders. Citing it as evidence about medical coding misapplies its findings entirely.

The mechanism actually affecting medical coding is distinct:

Computer-assisted coding (CAC) applies natural language processing to clinical documentation and generates preliminary code suggestions for human review.
Autonomous coding assigns codes without human review for defined, high-volume, low-complexity encounter types, typically in radiology, pathology, and routine outpatient visits.
Human adjudication remains required for ambiguous documentation, complex comorbidities, provider queries, and encounters with high reimbursement variance.

The observable direction shifts coder work from assignment toward validation, auditing, and exception handling.

That shift raises the relative value of auditing and risk adjustment credentials — CPMA, CRC, and CDI-oriented credentials — against pure production coding.

Coders operate within specific platform environments, and familiarity with them functions as a hiring factor independent of credential:

EHR systems — Epic Systems, Cerner (Oracle Health), Athenahealth, eClinicalWorks
Encoder and reference tools — 3M Coding and Reimbursement System, AAPC Codify, Find-A-Code
Clearinghouses — Availity, Change Healthcare

Frequently asked questions

How much do medical coders make?

Medical coders earn a median of $51,140 annually, or approximately $24.59 per hour, per BLS May 2025 data. Credentialed AAPC members holding two credentials average $71,130.

What is the medical billing and coding salary per hour?

The median hourly wage is approximately $24.59, calculated from the $51,140 annual median at 2,080 hours. The 10th percentile falls under $17.79 hourly; the 90th percentile exceeds $39.01.

How much do medical coders make starting out?

Entry-level medical coders typically earn $37,000 to $45,000, corresponding to the BLS 10th-to-25th percentile band. The CPC-A apprentice designation and production ramp time both suppress initial earnings.

Which medical coding certification pays the most?

Among entry-accessible credentials, the CPC reports the highest average at $59,605. Among specialties, CRC (risk adjustment) and CIC (inpatient) attach to the highest-paying niches, ranging $55,000 to $85,000.

Do medical coders make good money?

Medical coding pays near the U.S. median wage at the occupational midpoint, below it at entry level, and substantially above it with multiple credentials or specialty focus. The 10th-to-90th percentile spread exceeds $44,000.

Which state pays medical coders the most?

Delaware reports the highest average at $77,708, followed by California at $77,077 and Massachusetts at $76,483, per AAPC’s 2023 salary report. Mississippi reports the lowest at $50,393.

How much do medical billers make?

Medical billers earn approximately $46,000 to $50,000 nationally, generally below the coding median. Billing roles in revenue cycle management and denial recovery can exceed coding salaries in large health systems.

Can you make six figures in medical coding?

Six-figure earnings occur in travel CDI (annualizing to $125,000 to $185,000), senior auditing roles, and HIM management. Production coding alone rarely reaches that band.

Is medical billing and coding in demand?

BLS projects 8 percent employment growth from 2025 to 2035, against 3 percent across all occupations, with approximately 14,000 annual openings and 200,700 current positions.

Will AI replace medical coders?

No evidence establishes AI-driven wage decline in medical coding as of August 2026. Computer-assisted coding shifts work toward validation and auditing, raising the value of CPMA, CRC, and CDI credentials relative to production coding.

Sources:

October 5, 2026