CMS 2027 Final Rule: What Medicare Agents Must Update

AI Overview

The CMS Contract Year 2027 final rule introduced changes to Medicare Advantage and Part D marketing and communications requirements. For Medicare agents, key areas to review include Scope of Appointment (SOA) procedures, educational and marketing event practices, the TPMO disclaimer, call-recording retention, and marketing-material review. The updated requirements generally apply to CY2027 marketing and communications beginning October 1, 2026, where specified. Agents should update applicable scripts and workflows, verify implementation details with their carriers, and remember that CRM software can support documentation and reminders but cannot replace compliance oversight. This article provides general information, not legal advice.

TL;DR

• Review the CY2027 Medicare marketing and communications changes that apply beginning October 1, 2026.
• The mandatory 48-hour waiting period between an SOA and a personal marketing appointment was removed, but applicable SOA requirements remain.
• SOAs may be collected at educational events under the updated rules, subject to applicable restrictions.
• Review educational and marketing event procedures, including notice and attendees’ opportunity to leave.
• Update applicable TPMO disclaimer scripts using the current wording approved by your carrier.
• Review the six-year retention framework for applicable sales and marketing call records, including the permitted use of transcripts for years four through six.
• Do not assume that changes to federal requirements automatically override stricter carrier or organizational procedures.
• Use your Medicare agent CRM to support reminders, records, and task management—not as a substitute for compliance review.

CMS 2027 Final Rule: What Medicare Agents Need to Know

Some Medicare marketing procedures changed on October 1, 2026. With the Annual Enrollment Period (AEP) beginning October 15, agents should review their current workflows rather than rely on last year’s scripts, reminders, or internal checklists.

The Contract Year 2027 final rule, issued by the Centers for Medicare & Medicaid Services (CMS) on April 2, 2026, includes changes affecting Medicare Advantage and Part D requirements. The marketing and communications provisions discussed in this article should be reviewed alongside current CMS guidance and carrier instructions.

This guide explains the principal changes covered here, the procedures that still matter, and how a Medicare CRM may help agents organize the work.

This article is for general educational purposes and is not legal advice. Requirements may depend on the specific activity, applicable regulation, carrier instructions, and organizational policies.

The Rule at a Glance

CMS’s official summary of the Contract Year 2027 final rule provides the broader regulatory context. Review the rule and your carrier’s implementation instructions before changing production workflows.

SOA Changes: What Medicare Agents Should Review

The 48-Hour Waiting Period Was Removed

The mandatory waiting period between completing a Scope of Appointment and holding a personal marketing appointment was removed under the CY2027 changes.

That does not mean agents can ignore the SOA.

Where an SOA is required, agents should continue to complete and document it before beginning the applicable personal marketing appointment. Review the updated requirements and any carrier-specific procedures before changing your appointment workflow.

The SOA Requirement Still Matters

An SOA documents the product types a beneficiary has agreed to discuss during a personal marketing appointment. It helps establish the scope of the discussion and supports the required documentation process.

Agents should not interpret the removal of a waiting period as permission to begin every marketing conversation without first checking whether an SOA is required.

The appointment’s circumstances, the products to be discussed, and applicable CMS and carrier rules still matter.

Personal Marketing Appointments Are Not Limited to Office Meetings

Personal marketing appointments can take place in different settings, including in person, by telephone, or virtually. The nature and purpose of the discussion—not simply the location—help determine which requirements apply.

For meetings involving multiple people, do not assume one SOA automatically covers everyone. Confirm how the current rules apply to the participants and products involved, and follow your carrier’s instructions.

Document the SOA Correctly

The required method of documenting an SOA can depend on how the appointment takes place and which rules apply.

Review your process for:

• Recording the product types to be discussed
• Capturing the required appointment and beneficiary information
• Using the permitted documentation method for the appointment format
• Storing the record in the appropriate location
• Confirming that the record is accessible when needed for review
• Following the applicable retention requirements

Do not assume every telephone or virtual appointment can use the same documentation method. Verify the current CMS requirements and carrier procedures for the situation.

Review SOA Validity and Changes in Scope

The supplied compliance materials identify the 12-month validity period as remaining in place. They also emphasize that discussing a new product or the same product for a new plan year may require a new SOA.

Because the details of an appointment can change, agents should confirm whether the existing SOA covers the proposed discussion before proceeding. Follow current CMS guidance and carrier instructions rather than relying on a CRM reminder alone.

Where Can an SOA Be Collected?

The CY2027 changes permit SOA collection at educational events, subject to applicable restrictions. Agents should also review the circumstances in which collection remains prohibited, including specified provider-related activities.

Do not treat every sign-in sheet, online form, voicemail, or request for information as automatically satisfying all SOA requirements. Review the content and circumstances of the interaction and confirm the applicable rules with your carrier or compliance team.

Educational and Marketing Events: Review Your Procedures

The CY2027 changes allow certain marketing events to follow educational events at the same location, provided the applicable notice and opportunity-to-leave requirements are met.

This does not eliminate the distinction between education and marketing.

Educational presentations should remain within the applicable educational-event requirements. Plan-specific marketing discussions should occur under the rules that apply to marketing events and individual appointments.

Before changing an event workflow, review:

• How the event is described and advertised
• Whether the content is educational or marketing-oriented
• What attendees are told before the event transitions
• Whether attendees have a meaningful opportunity to leave
• Whether SOAs and other required records are handled correctly
• Which carrier-specific event procedures apply

A CRM may help record registrations, schedule follow-up tasks, and store related documentation if configured to do so. It cannot determine on its own whether an event complies with CMS requirements.

The TPMO Disclaimer: Update Applicable Scripts

The CY2027 changes affect the wording and timing of the TPMO disclaimer.

The updated approach removes references to State Health Insurance Assistance Programs (SHIPs) from the relevant disclaimer wording and changes when the applicable disclaimer must be conveyed. Under the updated requirements described in CMS materials, it must be conveyed verbally before benefits are discussed rather than relying on the previous “within the first minute” approach.

Use the current approved wording supplied by your carrier. Do not improvise a substitute or assume that a script approved in a previous year remains current.

Review:

• Agent call scripts
• Call-center procedures
• Training materials
• Approved recorded messages, where applicable
• Quality-assurance checklists
• Scripts used by staff or vendors who communicate on the organization’s behalf

Confirm when the disclaimer applies to the specific interaction and how your carrier expects it to be delivered and documented.

Call-Recording Retention: Review the Six-Year Framework

The CY2027 materials describe a change from a 10-year to a six-year retention framework for applicable Medicare sales and marketing call records. The framework permits transcripts in place of recordings for years four through six, subject to the applicable requirements.

There are two important points to verify before changing a retention policy.

First, confirm how the federal requirement applies to your role and relationship with the carrier. CMS requirements directed at plans may be implemented through carrier procedures that also affect agents, agencies, or other parties.

Second, do not assume the same retention period applies to every type of record. Enrollment documentation, SOAs, other business records, and records subject to separate legal or contractual requirements may follow different schedules.

Before deleting recordings or changing storage settings:

1. Review the current CMS rule and applicable guidance.
2. Obtain the carrier or FMO’s retention instructions.
3. Identify which record types are covered by each retention period.
4. Confirm whether transcripts meet the applicable requirements.
5. Update written policies and staff instructions.
6. Test any automated deletion or archival settings before applying them to actual records.

A CRM can help track dates and organize records when those capabilities are available. It should not be allowed to delete records based only on a default setting that has not been reviewed.

Marketing Language: What Changed—and What Did Not

The CY2027 rule changed certain requirements concerning supporting documentation for marketing materials that use superlative terms, including claims such as “best” or “most.”

That change should not be interpreted as permission to make misleading, inaccurate, or unsupported statements.

Medicare marketing materials should continue to be accurate, clear, and consistent with applicable CMS requirements and carrier review procedures. Claims about plan quality, comparisons, costs, or coverage should be checked carefully before publication.

For this client’s marketing standards, avoid using superlatives as promotional claims. Use clear, factual language that explains what the material covers without implying that a plan is superior to all alternatives.

Before distributing new materials or automated messages, confirm:

• The wording is accurate and current
• Any factual claims have appropriate support
• Required disclaimers are included when applicable
• Carrier review and approval requirements are satisfied
• The material follows the organization’s approved marketing standards

What Did Not Change?

A regulatory update rarely removes every requirement connected to an activity. Agents should continue to distinguish among CMS marketing rules, carrier procedures, privacy obligations, state requirements, and communication-consent rules.

For example, an SOA and permission to contact are not the same thing. An SOA concerns the scope of a personal marketing appointment. It does not automatically authorize every call, text, email, or automated message.

Continue to review applicable requirements concerning:

• SOA completion and documentation
• Requests to stop contact and opt-out handling
• TCPA/FCC requirements for calls and text messages
• Privacy and protection of personal information
• Carrier contracts and marketing procedures
• State insurance laws
• Recordkeeping and retention
• Training, supervision, and internal compliance controls

For the distinction between marketing compliance and contact permission, see Medicare compliance requirements for agents.

Medicare Agent CRM Checklist: What to Review Now

A Medicare agent CRM can help organize records, reminders, dates, and tasks. The appropriate setup depends on the system’s actual capabilities and your organization’s requirements.

Use this checklist to review your current workflow.

1. Appointment timing: Review any workflow that still imposes a 48-hour waiting period solely because of the previous CMS requirement. Confirm whether other rules or carrier procedures still affect the appointment.
2. SOA records: Verify that the required information is captured and that the documentation method is appropriate for the appointment format.
3. SOA validity: Review how your agency tracks validity and identifies when a new SOA may be required.
4. Intake forms: Check online forms, business reply cards, voicemails, and other intake methods. Do not assume a form satisfies an SOA requirement without reviewing its contents and context.
5. Call scripts: Replace outdated TPMO disclaimer language and timing instructions with the current carrier-approved version.
6. Event procedures: Review educational and marketing event descriptions, transitions, notices, and recordkeeping.
7. Retention schedules: Confirm the requirements for each record type with your carrier and compliance team before changing archival or deletion rules.
8. Marketing materials: Review claims, disclaimers, and approval status before updating templates or automated campaigns.
9. Opt-out handling: Confirm that requests to stop contact are recorded and respected across applicable communication channels.
10. Automation testing: Test workflow triggers and stop conditions using dummy records before making changes live. Check that one event does not trigger duplicate or conflicting communications.
11. Staff training: Ensure agents and support staff understand the updated procedures and know where to find the current approved guidance.
12. Ongoing review: Schedule periodic checks of scripts, templates, reminders, and retention settings so future updates do not leave outdated procedures in circulation.

Common Mistakes to Avoid

Mistake 1: Treating the Removed Waiting Period as Removal of the SOA

The waiting period changed. Applicable SOA requirements did not simply disappear.

Mistake 2: Continuing to Use an Outdated Disclaimer

Review scripts and training materials to ensure they reflect current requirements and carrier-approved wording.

Mistake 3: Deleting Records Without Checking All Applicable Rules

Do not apply a new retention period to every record type without confirming the requirements that apply to each.

Mistake 4: Assuming a CRM Setting Proves Compliance

Software can support a process, but configuration alone does not demonstrate that the process meets every applicable requirement.

Mistake 5: Treating Contact Permission and SOA Documentation as the Same

They address different compliance questions. Verify each separately.

Mistake 6: Updating Workflows Without Testing Them

A change to one stage or trigger may cause duplicate messages, missed tasks, or incorrect record updates. Test changes before applying them to active contacts.

In Conclusion

The CMS 2027 final rule changed several Medicare marketing and communications procedures, including SOA timing, certain event practices, the TPMO disclaimer, and the retention framework for applicable sales and marketing call records.

For agents, the practical next step is to review current scripts, appointment procedures, event workflows, recordkeeping policies, and CRM settings. Make changes only after confirming the requirements that apply to your organization and carrier relationships.

The goal is not simply to update software. It is to ensure the written policy, agent training, daily workflow, and actual records remain consistent with current requirements.

Get Your Workflows Ready for AEP

OmniReach CRM describes Medicare-focused pipelines, automated follow-up, calendars and reminders, a unified inbox, and HIPAA-related infrastructure with a BAA available. If you are evaluating a crm for medicare agents, use a demonstration to verify the specific capabilities available for SOA dates, appointment reminders, notes, and record organization.

A CRM can support your process, but compliance responsibilities under CMS, TCPA/FCC, carrier, privacy, and state requirements remain with the relevant parties.

See costs on the pricing page, review HIPAA and security information, or bring your current SOA process to a demo. For related reading, see Medicare lead tracking and managing Medicare leads during AEP.

Frequently Asked Questions