Medicare Compliance Requirements for Agents: What Agents Should Know in 2026

Overview

Medicare compliance requirements for agents involve several areas, including Scope of Appointment (SOA) procedures, beneficiary contact permissions, call recording, marketing materials, required disclosures, recordkeeping, privacy, and applicable federal and state requirements.

For TPMOs, the rules surrounding marketing, sales, and enrollment calls include call-recording and disclosure requirements. UnitedHealthcare's current agent guidance available for this review requires applicable TPMOs to record marketing, sales, and enrollment calls in their entirety, including the audio portion of web-based calls, and retain those recordings for a minimum of 10 years.

For CY2027 marketing beginning October 1, 2026, CMS has finalized a six-year minimum retention framework for Medicare marketing and sales call recordings. Audio must be retained for the first three years, while years four through six may be maintained as audio or as a complete and accurate transcript. Enrollment records have separate retention requirements.

Requirements can vary depending on the activity, carrier, communication method, and applicable law. This article is general educational information, not legal advice. Agents should confirm current requirements with their FMO, carrier, and compliance team before implementing a process.

CMS and Medicare compliance requirements can feel complicated because they touch nearly every part of an agent's workflow.

A conversation with a beneficiary.
An appointment.
A Scope of Appointment.
A marketing piece.
A phone call.
A text message.
A recorded virtual meeting.
A client record.

Each can involve different requirements.

The answer isn't to memorize every rule and hope nothing changes.

A better approach is to understand the major compliance checkpoints and build a process that makes them easier to manage.

A quick note before we get into it: this article is general educational information based on the compliance materials available for this review. It is not legal advice. Requirements can vary by carrier, state, communication method, and activity. Confirm current requirements with your FMO, carrier, and compliance team before relying on any specific process.

Understanding TPMO Requirements

Third-Party Marketing Organization, or TPMO, requirements are an important part of Medicare marketing and sales compliance.

UnitedHealthcare's agent guide states that entities and individuals contracted directly with UnitedHealthcare are considered first-tier, downstream, or related entities and therefore TPMOs. The guide also includes certain entities contracted or subcontracted by an FDR, including solicitors.

The important takeaway for agents is simple:

Don't assume that being an independent agent removes you from TPMO requirements.

If your activity falls within the applicable TPMO framework, the relevant disclaimer, disclosure, recording, and other requirements need to be incorporated into your process.

Scope of Appointment: A Key Part of the Sales Process

Scope of Appointment, commonly called an SOA, is one of the most important parts of Medicare sales compliance.

For applicable personal marketing appointments, the SOA documents the products the consumer has agreed to discuss.

UnitedHealthcare's agent guide states that an SOA remains valid for 12 months following the consumer's signature date or the date of the consumer's initial request for information. It also states that a new SOA is required if the consumer requests information regarding a different plan type than previously agreed upon.

The same guide states that SOAs must be retained for a minimum of 10 years from the consumer's signature date and made available upon request.

That makes SOA management more than a one-time administrative task.

Agents need a reliable process for:

• Obtaining the appropriate SOA
• Confirming what products are within scope
• Identifying when a new SOA is needed
• Recording the applicable date
• Retaining the documentation
• Producing the record when requested

A CRM can help organize these tasks, but the agent remains responsible for following the applicable SOA requirements.

Call Recording: What Agents Need to Know

Call recording is another major compliance consideration.

The UnitedHealthcare agent guide reviewed for this article states that applicable TPMOs must record in their entirety all marketing, sales, and enrollment calls, including the audio portion of calls conducted through web-based technology.

That means agents should not assume that moving a conversation from a traditional phone call to a virtual platform eliminates recording requirements.

For CY2027 marketing beginning October 1, 2026, CMS has finalized a six-year minimum retention framework for Medicare marketing and sales call recordings. The first three years must be maintained in audio format. For years four through six, the record may be maintained as audio or as a complete and accurate transcript.

Enrollment records have separate retention requirements and should not automatically be treated as part of the six-year marketing and sales call-retention framework.

The practical takeaway is that agents need to distinguish between marketing and sales call records and other records, including enrollment records.

A Note About the 2027 Retention Rule

Beginning October 1, 2026, for CY2027 marketing, CMS has finalized a change to the retention framework for Medicare marketing and sales call recordings.

The new framework requires applicable marketing and sales calls to be recorded and retained in their entirety for a minimum of six years. For the first three years of the retention period, the records must be maintained in audio format. For years four, five, and six, the records may be maintained in either audio format or as complete and accurate transcript recordings.

This change applies specifically to the retention of marketing and sales call recordings. Enrollment records have separate retention requirements, so agents should not assume that every Medicare record now follows the same six-year schedule.

Agents should also consider whether a carrier, FMO, state requirement, complaint, audit, contractual obligation, or other applicable requirement calls for a longer retention period.

TPMO Disclaimers and Disclosures

TPMO disclaimer requirements are another area where wording and placement matter.

UnitedHealthcare's agent guide provides standardized TPMO disclaimer language for applicable TPMOs and states that the disclaimer must be used by TPMOs selling MA plans on behalf of more than one MA organization, subject to the circumstances described in the guide.

For CY2027 marketing beginning October 1, 2026, CMS has changed the timing requirement for the verbal TPMO disclaimer. Instead of requiring the disclaimer to be conveyed within the first minute of a sales call, the finalized rule requires it to be verbally conveyed prior to the discussion of any benefits during the sales call.

The disclaimer requirements also continue to address applicable electronic communications, websites, and marketing materials.

It also states that lead-generating materials must disclose that the consumer's information will be provided to a licensed agent for future contact, using the appropriate method for the interaction.

This is why agents should avoid copying a disclaimer from another website and assuming it applies to their own business.

The appropriate language can depend on the organizations and products represented.

Use the approved language required by the applicable carrier and compliance process.

Marketing Materials Need Review Before Use

A marketing piece can look harmless and still create a compliance issue.

UnitedHealthcare's agent guide states that materials must be compliant and must not contain information that is inaccurate, misleading, confusing, or capable of misrepresenting UnitedHealthcare.

The guide also states that applicable UnitedHealthcare marketing materials must go through UnitedHealthcare review and approval before filing in CMS's Health Plan Management System, and that multi-carrier marketing materials that may generate a lead for or result in enrollment in a UnitedHealthcare MA or PDP plan must be submitted to UnitedHealthcare for prospective review and approval before the applicable filing process.

This is particularly important for:

• Websites
• Landing pages
• Digital advertisements
• Social media
• Flyers
• Lead-generation materials
• Email campaigns
• Multi-carrier marketing
• Materials containing carrier branding

The safest workflow is simple:

Create → Review → Approve → Use

Not:

Create → Publish → Ask whether it was compliant.

Educational Events Are Different From Marketing and Sales Activities

Medicare-related educational and marketing/sales activities should not automatically be treated as interchangeable.

For CY2027, CMS has removed the prior 12-hour separation requirement between an educational event and a marketing event at the same location. A marketing event may follow an educational event without the former 12-hour waiting period, subject to the applicable CMS conditions for transitioning between the events.

If a marketing event directly follows an educational event, beneficiaries must be notified that the educational event is ending and that a marketing event will begin, and they must have a sufficient opportunity to leave before the marketing event starts.

The lesson for agents is straightforward:

Don't treat an educational event as an opportunity to quietly transition into an unplanned sales presentation.

Clearly distinguish the event types, provide the required notification, allow beneficiaries an appropriate opportunity to leave, and follow the applicable CMS and carrier requirements for the event.

Beneficiary Contact: Permission Matters

One of the biggest practical compliance issues for agents is contacting consumers.

UnitedHealthcare's guidance states that agents may contact consumers when prior valid permission to contact has been obtained and that the contact must be made using the method identified in the permission.

For telephonic contact, the guide specifically states that prior permission must cover the applicable telephonic method, such as a call or text. It also states that both the contact itself and its content must comply with applicable federal and state laws, including Do-Not-Call requirements, calling hours, TCPA requirements, and TPMO recording and disclaimer requirements.

This is especially important when using lead-generation forms.

A phone number by itself should not be treated as unlimited permission for every type of automated communication.

The lead-generation process should document:

• How the consumer requested contact
• What method of contact was permitted
• Who is authorized to make the contact
• What disclosures were presented
• How opt-outs are handled
• What carrier requirements apply

Automated Calls and Text Messages Require Additional Review

Automation can make follow-up easier.

It does not eliminate telemarketing requirements.

The UnitedHealthcare guide specifically addresses manual and automated dialing, voice messaging, text messaging, and other electronic contact. It identifies situations where direct contact is prohibited when the consumer did not provide permission through a compliant method.

It also requires telephonic contact to comply with applicable federal and state laws, including TCPA and Do-Not-Call requirements.

That means an automated workflow should not simply be designed as:

New lead → automatic text → automatic call → automatic follow-up sequence.

Instead, the workflow should first determine whether the contact is permitted.

A safer operational model is:

New lead → document source and permission → determine appropriate contact method → create agent task or approved communication → document activity

Automation should reinforce compliance.

It should not bypass it.

HIPAA and Medicare Compliance Are Separate Considerations

Medicare marketing requirements and HIPAA address different areas.

When protected health information is involved, privacy and security requirements need to be considered in addition to Medicare marketing requirements.

UnitedHealthcare's guidance specifically requires TPMOs to protect consumer/member PHI, ePHI, and PII and states that recording and storage must meet applicable UnitedHealthcare security requirements.

This means an agent should not assume that a CRM is appropriate for sensitive information merely because it has a healthcare-related feature.

Evaluate:

• Access controls
• Data security
• Storage
• User permissions
• Communication security
• Recording storage
• Vendor relationships
• Applicable privacy obligations

And remember:

HIPAA compliance does not replace Medicare compliance, TCPA compliance, FCC requirements, carrier requirements, or state law.

Quick Reference

What Compliance Looks Like Day to Day

Compliance becomes much easier when it is treated as a process rather than something you try to remember at the end of the week.

A practical workflow might include:

• Recording applicable marketing, sales, and enrollment calls
• Retaining marketing and sales recordings according to the applicable CMS, carrier, and other requirements
• Tracking SOA dates and product scope
• Documenting permission to contact
• Recording communication activity
• Maintaining approved marketing materials
• Reviewing new marketing content before publication
• Tracking opt-outs
• Restricting access to sensitive information
• Keeping documentation organized and retrievable

The objective is not to create more paperwork.

It is to make it easier to demonstrate what happened when someone asks.

Why the Right System Can Help

A notebook can remind you that an SOA exists.

A spreadsheet can contain a date.

A phone can contain a call history.

But none of those tools necessarily give you a complete picture of the interaction.

An insurance agent CRM can help bring those records into one workflow.

For example, a properly configured system can help organize:

• Lead information
• Permission-to-contact records
• Communication history
• Appointment information
• SOA dates
• Follow-up tasks
• Call records
• Compliance documentation
• User activity

The important word is help.

A CRM does not make an agent compliant simply because the software has compliance-related features.

The workflow, configuration, data, communications, and agent activity still need to follow applicable requirements.

What a Compliance-Oriented CRM Workflow Can Look Like

Imagine a new consumer inquiry arrives.

Instead of immediately sending a marketing message, the CRM can first record the source of the inquiry and the information associated with the permission to contact.

The agent can then review the record.

If contact is permitted, the agent can use the appropriate communication method.

If an appointment is scheduled, the CRM can create the appropriate follow-up tasks.

If an SOA is required, the workflow can remind the agent to obtain and retain it.

If a marketing material needs approval, the system can keep the approved version separate from drafts.

If a call must be recorded, the agent can verify that the recording process is active before beginning the applicable conversation.

That is what useful automation looks like.

It doesn't remove compliance from the process.

It makes compliance checkpoints easier to see.

Common Compliance Mistakes to Avoid

Assuming Every Phone Number Is Permission to Call or Text

A phone number does not automatically answer the question of whether a particular contact method is permitted.

Review how permission was obtained and whether it covers the intended communication method.

Assuming a CRM Makes the Workflow Compliant

Software is a tool.

Compliance depends on how the tool is configured and used.

Treating All Communications as Marketing

General educational information and marketing communications can have different requirements.

Review the content and purpose before determining how a communication should be handled.

Forgetting That Virtual Meetings Can Involve Recording Requirements

Moving a conversation to Zoom or another web-based platform does not necessarily remove applicable recording requirements. The UnitedHealthcare guidance reviewed here expressly includes the audio portion of web-based calls.

Using Unapproved Marketing Materials

Do not assume that a marketing piece is acceptable because another agent is using something similar.

Follow the applicable carrier review and approval process.

Mixing Educational and Sales Activities

Keep the purpose and format of the event clear and follow the applicable requirements for that activity.

For CY2027, the prior 12-hour separation requirement between an educational event and a marketing event at the same location has been removed, but the required transition protections still apply.

Assuming a Future Rule Change Is Already in Effect

Regulations can change.

Before changing retention periods, scripts, disclosures, or workflows, verify the current requirement with the applicable compliance authority.

Conclusion

Medicare compliance is easier to manage when it becomes part of the workflow rather than an afterthought.

SOAs need to be handled properly.

Applicable calls need to be recorded and retained according to the requirements that apply to the agent and carrier.

For CY2027 marketing beginning October 1, 2026, Medicare marketing and sales call recordings are subject to a six-year minimum retention framework under CMS rules, with audio required for the first three years and audio or a complete and accurate transcript permitted for years four through six.

Marketing materials need to be reviewed.

Beneficiary contact needs appropriate permission.

Sensitive information needs appropriate protection.

Educational and marketing events need to follow the applicable event requirements, including the CY2027 transition requirements where a marketing event follows an educational event.

And every automated workflow needs to be evaluated before it starts communicating with consumers.

The goal isn't to make agents spend their entire day thinking about compliance.

The goal is to build processes that make the compliant action the easy action.

A good CRM can help organize those processes.

But the system should support the rules—not replace them.

Ready to Organize Your Medicare Compliance Workflow?

If you're evaluating an insurance agent CRM, look beyond the pipeline and automation features.

Consider whether the system can help your agency organize:

• SOA information
• Communication history
• Permission-to-contact documentation
• Appointment activity
• Call records
• Marketing materials
• Compliance-related tasks
• User activity
• Record retrieval

OmniReach CRM can be evaluated as one option for agencies looking to organize their Medicare workflows.

Before implementing automated communications or relying on any CRM for compliance-related processes, review the specific configuration, carrier requirements, consent process, privacy requirements, and applicable federal and state rules for your organization.

Want to see how a more organized Medicare workflow could work for your agency? Schedule a demonstration and review the workflow before putting it into production.

Frequently Asked Questions