Health information technician screening questions: RHIT, release of information, record integrity and HIPAA timelines
On this page
- Which HIM technician job is it?
- Which credentials and rules apply?
- Knockout questions
- Release of information questions
- Record integrity and chart completion questions
- How does HIM experience get overstated?
- A 12-minute phone-screen flow
- Scoring
- What to put in the submittal
- Lawful phrasing
- Questions people ask
Health information technician screening questions should confirm the candidate's credential (most often AHIMA's RHIT, sometimes a coding credential), which part of health information management they actually did (release of information, chart analysis and completion, record integrity, scanning and indexing, or coding), and whether they know the rules that govern each request: the HIPAA 30-day access deadline, subpoenas, 42 CFR Part 2 records and the information blocking rule. As of November 2026, the FY 2027 ICD-10-CM code set has been in use since October 1, 2026, so coding-heavy roles should also ask what changed.
The medical billing and coding screening questions go deep on code sets, specialties, denials and audits. This page is for the wider HIM technician job, where the work is the record itself: who gets a copy, whether it is complete, and whether it belongs to the right patient. Front-end registration errors are the source of many record problems, so the patient access representative screening questions are a useful companion.
Which HIM technician job is it?
| Seat | What the technician mostly does | Ask the candidate |
|---|---|---|
| Release of information | Patient, attorney, insurer and agency requests; authorizations; logging disclosures | "How many requests a day, and what types?" |
| Chart analysis and completion | Finding missing signatures and documents, assigning deficiencies to providers, tracking delinquent charts | "What did you check on a discharged record, and how did you chase providers?" |
| Record integrity and master patient index | Duplicate records, overlays, merges, misfiled documents | "How many duplicate pairs did you work a week, and who approved a merge?" |
| Scanning and indexing | Outside records and paper forms filed to the right patient and encounter | "What did you check before indexing a document?" |
| Coding (inpatient, outpatient or professional) | Assigning ICD-10-CM, ICD-10-PCS or CPT codes; queries to providers | "Which code sets and which encounter types?" |
| Remote production work | Any of the above from home, with quotas and audits | "What was your daily target and your last quality score?" |
Which credentials and rules apply?
As of November 2026. We checked these on AHIMA's, the BLS's, CMS's, HHS's and ONC's own pages and in the HIPAA and Part 2 regulations. State law can add shorter deadlines and stricter rules; check the client's state.
- RHIT. AHIMA's RHIT page says candidates must complete the associate-level academic requirements of a health information management program accredited by CAHIIM (or a program approved by a foreign association with an AHIMA reciprocity agreement), and that health informatics degrees are not currently accepted for the RHIT. The exam has 150 questions (130 scored) across six domains, from data governance and release of information to revenue cycle and compliance. RHITs recertify every two years with continuing education. AHIMA offers credential verification for employers.
- Other AHIMA credentials. AHIMA's certification overview also lists the RHIA (a four-year route), the entry-level CCA, and specialty credentials in privacy and security (CHPS), clinical documentation integrity (CDIP) and data analytics (CHDA).
- What the BLS says. The BLS Occupational Outlook Handbook page for medical records specialists says they typically need a postsecondary certificate, though some qualify with a high school diploma and others need an associate or bachelor's degree, and that certification may be required or preferred.
- The access deadline. Under 45 CFR 164.524, a covered entity must act on a person's request for their own records within 30 days, with one extension of up to 30 more days, provide the copy in the form and format requested if readily producible, and charge only a reasonable, cost-based fee. Psychotherapy notes are excluded from the right of access.
- Amendments. Under 45 CFR 164.526, a request to amend the record must be acted on within 60 days, with one extension of up to 30 days.
- Subpoenas. 45 CFR 164.512(e) allows disclosure in response to a subpoena that is not accompanied by a court order only with satisfactory assurance that the patient was notified or that a qualified protective order was sought.
- Substance use disorder records. HHS's Part 2 fact sheet says the 2024 rule, with compliance required by February 16, 2026, allows a single consent for treatment, payment and health care operations, but records still cannot be used in proceedings against the patient without consent or a court order, and SUD counseling notes need their own consent.
- Information blocking. ONC's information blocking page says the Cures Act rule applies to health care providers, certified health IT developers and health information networks, with exceptions in 45 CFR Part 171, and HHS has set disincentives for providers found to have blocked information.
- Code sets. CMS's ICD-10 page says the FY 2027 ICD-10-CM files apply to discharges and encounters from October 1, 2026 to September 30, 2027.
Knockout questions
| Question | Strong answer | Red flag |
|---|---|---|
| 1. Which credentials do you hold, and are they current? | The credential (for example RHIT), the year and the recertification cycle, with a name you can verify. | "RHIT eligible" offered as RHIT. |
| 2. Which HIM functions have you done in the last two years? | Specific: release of information, chart analysis, MPI, scanning, coding, with volumes. | "All of HIM" with no detail on any of it. |
| 3. Which EHR and release-of-information systems have you used? | Names them and what they did in each. | None for an EHR-based department. |
| 4. This role is [onsite / remote], [hours], with a production standard of [number]. Does that work? | Yes, or a specific limit; for remote roles, a private workspace. | Expects remote work for an onsite role. |
Release of information questions
-
"A patient emails asking for their whole record, sent electronically. What do you do?"
- Strong answer: verifies identity by the facility's procedure, confirms what they want and how, provides it electronically if readily producible, meets the 30-day deadline or a shorter state deadline, logs it, and charges only what the access rule and the facility's policy allow.
- Red flags: requires the patient to come in person or to use a full authorization form for their own record.
-
"An attorney sends a subpoena for a patient's records with no court order. What happens?"
- Strong answer: checks for the satisfactory assurances (notice to the patient or a qualified protective order), involves the privacy officer or legal as policy says, and does not release until the conditions are met.
- Red flags: "A subpoena means we have to send it."
-
"The record includes notes from the hospital's addiction treatment program. Does that change anything?"
- Strong answer: recognizes Part 2 records, checks the consent covers them, and knows a subpoena alone is not enough to use them against the patient.
- Red flags: treats them like any other note.
-
"A patient asks for their therapist's psychotherapy notes."
- Strong answer: knows psychotherapy notes kept separately are excluded from the right of access, and sends the request to the privacy officer and clinician under policy rather than refusing on their own.
- Red flags: releases them, or tells the patient they have no rights to any mental health records.
Record integrity and chart completion questions
| Question | Strong answer | Red flag |
|---|---|---|
| You find lab results from one patient filed in another patient's record. What do you do? | Treats it as an overlay or misfile: stops further use, follows the correction procedure, notifies the right people, documents. | Moves the document quietly. |
| How do you decide two records are duplicates before a merge is requested? | Compares several identifiers (name, date of birth, address, other identifiers), never one, and sends uncertain pairs for review. | Merges on name and birth date alone. |
| What do you check when analyzing a discharged inpatient record? | Required documents (history and physical, discharge summary, operative reports), signatures, authentication, and the deficiencies assigned to each provider. | Cannot name what makes a record complete. |
| How did you get providers to complete delinquent charts? | Reports, reminders and escalation under the medical staff rules. | "That's not my job." |
| A patient asks to change something in their record. What happens? | Logs the request, routes it to the author, and knows the 60-day deadline to act. | Edits the record themselves. |
For coding-heavy seats, add the code-set questions from the coder page, plus one current question: "What changed for you with the October 1, 2026 code update?" A working coder can name something.
How does HIM experience get overstated?
- "Release of information" that was faxing records a coworker had already approved. Ask who decided what to release.
- "Coding experience" that was abstracting or charge entry. Ask which code sets and which encounter types.
- "MPI work" that was reporting suspected duplicates rather than resolving them.
- A credential in progress described as held. Verify with AHIMA.
- Volume quoted as a team number rather than their own.
A 12-minute phone-screen flow
- Minutes 0 to 2: which HIM functions the role covers, onsite or remote, hours and production standard.
- Minutes 2 to 4: knockouts; write down credentials to verify after the call.
- Minutes 4 to 8: two release-of-information questions (the patient email and the subpoena).
- Minutes 8 to 10: one record integrity question and one chart completion question.
- Minutes 10 to 12: pay expectations (see salary expectation questions) and next steps.
Scoring
Pass or fail
- Holds the credential the client requires, verified by you.
- Has done the HIM functions the role covers, recently.
- Accepts onsite or remote terms, hours and production standard.
Scored 0 to 2 each (10 possible)
- Access requests and deadlines.
- Subpoenas, Part 2 and special categories of records.
- Record integrity: duplicates, overlays and misfiles.
- Chart analysis and provider follow-up.
- Productivity and accuracy with numbers they can name.
What to put in the submittal
Technician: [name]
Credentials: [RHIT / RHIA / CCA / CCS / other], verified with AHIMA [date]
HIM functions, last 2 years: [ROI / chart analysis / MPI / scanning / coding], with volumes
Systems: [EHR], [ROI system], [encoder]
Release of information: [summary of the subpoena answer]
Part 2 and psychotherapy notes: [knows / unsure]
Production and quality: [daily volume], [last audit score]
Work setup: [onsite / remote, private workspace]
Candidate's own gap: [e.g. "no inpatient coding; ROI for clinics only"]Lawful phrasing
Ask about the job's tasks, not the candidate's health: "The role involves sitting at a workstation for most of an eight-hour shift and occasionally lifting boxes of paper records. Can you perform that, with or without accommodation?" is lawful before an offer under the EEOC's guidance on disability-related questions. Do not ask candidates to share real patient examples; ask them to describe what they did without identifying anyone. For your own notes, see does HIPAA apply to job interviews, and for credential checks, how to verify candidate certifications. This page is not legal advice.
Questions people ask
What certification should a health information technician have?
The usual one is AHIMA's Registered Health Information Technician (RHIT). To sit the RHIT exam a candidate must complete an associate-level health information management program accredited by CAHIIM, or a recognized foreign equivalent, and AHIMA says health informatics degrees are not currently accepted. Coding-heavy roles may ask for a coding credential instead or as well.
How long does a hospital have to answer a patient's request for records?
Under the HIPAA access rule, 45 CFR 164.524, a covered entity must act on a request no later than 30 days after receiving it, with one extension of no more than 30 days if it tells the person why in writing within the first 30 days. Some state laws set shorter deadlines.
Can a health information technician release records in response to an attorney's subpoena?
Not on the subpoena alone. Under 45 CFR 164.512(e), a subpoena without a court order needs satisfactory assurance that the patient was notified or that a qualified protective order was sought. Substance use disorder records covered by 42 CFR Part 2 have stricter rules, generally needing patient consent or a court order.
Do health information technicians need a state license?
The BLS describes certification, not a state license, as what employers prefer or require for medical records specialists, and says they typically need a postsecondary certificate, though some qualify with a high school diploma and others need an associate or bachelor's degree. Check the employer's own requirements and any credential the job posting names.