Medicare Compliance: Essential Do’s and Don’ts

As an agent, the months leading up to Medicare’s Annual Enrollment Period (AEP) are packed with contracting and certification. However, there’s one crucial factor that should always be top of mind—compliance.

Compliance isn’t just a seasonal task; it’s a year-round commitment that ensures you operate ethically, protect beneficiaries, and stay in good standing with industry regulations.

Key Reminder: Medicare Marketing Guidelines

Before diving into the do’s and don’ts of compliance, it’s essential to know where to access the official rules.

The full Medicare Communications and Marketing Guidelines (MCMG) are available on CMS.gov, while the latest Medicare Advantage and Part D Communication Requirements can be found on the Federal Register website. The Federal Register is user-friendly, making it easier than ever to stay informed on the most recent Medicare marketing regulations and updates!

Third-Party Marketing Organization (TPMO) Compliance Guidelines

The Centers for Medicare & Medicaid Services (CMS) classify agents and brokers as Third-Party Marketing Organizations (TPMOs) and require strict adherence to specific regulations when marketing Medicare Advantage or prescription drug plans. To remain compliant, you must follow these key guidelines:

• Document Your TPMO Partnerships

  • Maintain a detailed list of all vendors, contractors, and subcontractors involved in marketing, sales, lead generation, and enrollment.
  • Review and update existing written agreements with your TPMOs to ensure they comply with CMS regulations.

• Protect Beneficiary Data

  • Do not share personal beneficiary information with other TPMOs without prior express written consent.
  • Beneficiaries must be provided with a clear and detailed disclosure listing every entity receiving their data, allowing them to approve or decline each individual TPMO’s access.

• Disclose Third-Party Relationships

  • Report any subcontracted relationships used for marketing, lead generation, or enrollment to carriers and/or Essential Care.

• Monitor & Report Compliance Issues

  • Establish a compliance monitoring plan and submit monthly reports to carriers and/or Essential Care detailing any staff disciplinary actions or violations related to beneficiary interactions.

• Use the Required TPMO Disclaimer

  • Ensure the appropriate TPMO disclaimer is included in all required materials, as outlined under § 422.2267(e)(41) and § 423.2267(e)(41).

• Record All Sales & Marketing Calls

  • CMS mandates that all marketing, sales, and enrollment calls—including video calls—must be recorded in their entirety.
  • Under the CMS 2024 Final Rule, call recordings are required for marketing (including retention marketing), sales, and enrollment activities.

By following these guidelines, you ensure compliance with CMS regulations while maintaining transparency and ethical practices in your Medicare marketing efforts.

Required TPMO Disclaimer

Agents are required to include the standardized TPMO disclaimer in their email communications, website, print materials, other marketing materials, and within the first minute of sales calls. This disclaimer must be used exactly as written and cannot be altered.

If You Are Marketing Fewer Than All Plans in a Service Area:

“We do not offer every plan available in your area. Currently, we represent [insert number of organizations] organizations which offer [insert number of plans] products in your area. Please contact Medicare.gov, 1-800-MEDICARE, or your local State Health Insurance Program (SHIP) to get information on all of your options.”

If You Are Marketing All Plans in a Service Area:

“Currently, we represent [insert number of organizations] organizations which offer [insert number of plans] products in your area. You can always contact Medicare.gov, 1-800-MEDICARE, or your local State Health Insurance Program (SHIP) for help with plan choices.”

This disclaimer must also be included when communicating electronically with beneficiaries via email, online chat, or other digital platforms.

HIPAA Compliance for Medicare Agents

The Health Insurance Portability and Accountability Act (HIPAA) sets national standards for protecting patients’ medical information when handled by covered entities, their business associates, and business associate subcontractors. As an insurance agent, you fall into the business associate category and must follow strict privacy and security guidelines.

Handling Protected Health Information (PHI) Responsibly

As a business associate, you are only permitted to use Protected Health Information (PHI) for the specific purposes outlined by the covered entity that provides it. To ensure compliance, follow the HIPAA guidelines detailed in your contractual agreement with the covered entity.

To prevent data breaches or unauthorized disclosures:

• Do not send PHI via unsecured email or internet services.
• Do not leave PHI in voicemails.
• Always properly dispose of PHI documents by shredding them.

Call Recording Requirements

Agents and brokers must record all sales, marketing (including retention marketing), and enrollment calls—both inbound and outbound—in their entirety. This includes:

• Initial calls that educate or inform clients about Medicare Advantage and Prescription Drug Plans.
• Follow-up conversations when a beneficiary is making an enrollment decision.
• Post-enrollment discussions, including retention marketing calls aimed at encouraging beneficiaries to stay with their current plan.

In-person meetings with beneficiaries do not require recording.

Understanding Permission to Contact (PTC) for Medicare Sales

Every interaction with a potential client must begin with Permission to Contact (PTC). While agents are allowed to send unsolicited emails to prospective enrollees, these emails must:

• Include an opt-out option to remain compliant.
• Avoid steering the recipient toward a specific plan or encouraging them to retain one. A compliant email should focus on promoting your services, not particular plans.

However, agents cannot:

• Approach potential enrollees in common areas (e.g., waiting rooms, parking lots, or lobbies).
• Make unsolicited phone calls or go door-to-door.

 

How to Collect Permission to Contact (PTC)

To initiate conversations with potential enrollees, you can collect PTC through lead generation strategies such as:

• Business Reply Cards (BRCs) or flyers with an optional form for prospects to provide permission.
• Ensuring BRCs and flyers comply with regulatory requirements, including TCPA disclaimers.

Important: PTCs and BRCs now expire after 12 months or when their intended purpose has been fulfilled. Also, lead generation entities are now classified as Third-Party Marketing Organizations (TPMOs) and must comply with CMS regulations.

Compliance Guidelines for Using Third-Party Lead Providers

If you rely on a third-party lead generation company, ensure they follow these compliance requirements on your behalf:

• Disclose all subcontracted relationships (e.g., third-party lead providers) to carriers and/or Essential Care if used for marketing, lead generation, or enrollment.
• Monitor compliance and submit monthly reports to carriers and/or Essential Care on any staff disciplinary actions related to beneficiary interactions.
• Inform beneficiaries when collecting leads that their information will be shared with a licensed insurance agent for future contact or that they are being transferred to an agent for potential enrollment. This disclosure must be made:
  • Verbally (for phone interactions).
  • In writing (for mail or paper communications).
  • Electronically (for emails, online chats, or other digital messaging platforms).

 

PTC vs. Scope of Appointment (SOA)

While PTC allows an agent to initiate contact, it is not the same as a Scope of Appointment (SOA). Typically, the process follows this order:

1. First, obtain PTC.
2. Then, schedule an appointment.
3. Before the appointment, collect a signed SOA from the beneficiary to discuss specific Medicare plans.

Additional Compliance Reminder

While not directly related to PTC, agents cannot require beneficiaries to provide personal information—such as their Medicare Beneficiary Identifier (MBI), Social Security number, or any other data used for eligibility queries—before sharing plan options.

The only exception: Agents may ask for the beneficiary’s ZIP code to determine the plans available in their service area.

Understanding Scope of Appointment (SOA) in Medicare Sales

A Scope of Appointment (SOA) is exactly what it sounds like—a form that outlines the specific Medicare products you will discuss during a meeting with a potential enrollee. This ensures that clients are only presented with the plans they originally requested and prevents unauthorized sales pitches.

SOA Requirements & Retention

• An SOA is required for every Medicare sales appointment, whether in person or virtual.
• Agents must retain SOA forms for at least 10 years, even if the meeting does not result in a sale.
• An SOA remains valid for 12 months or until it is used. If it expires before a meeting takes place, a new SOA must be obtained.
• The same SOA can be used for follow-up discussions if the beneficiary needs more time to consider their options before making a decision.

The 48-Hour Rule

Agents must wait 48 hours between obtaining an SOA and conducting the appointment. However, exceptions apply in these cases:

1. The beneficiary is four days or fewer from the end of a valid enrollment period (e.g., Annual Enrollment Period (AEP), Open Enrollment Period (OEP), Special Enrollment Period (SEP), or Initial Coverage Election Period (ICEP)).
2. The meeting is unscheduled and initiated by the beneficiary (e.g., a walk-in appointment).

What If a Client Requests Information Outside the SOA?

If, during the meeting, the client expresses interest in Medicare products not covered in the original SOA, you must:

• Complete a new SOA for the additional Medicare products before continuing the conversation.
• If they ask about non-health-related products, you must schedule a separate appointment for another time.

Following these SOA guidelines ensures compliance with CMS regulations while maintaining transparency and professionalism in your Medicare sales process.

Medicare Marketing Rules & Compliance Guidelines

The Centers for Medicare & Medicaid Services (CMS) regulates how and when agents can market Medicare Advantage (MA) and Part D plans to beneficiaries. Adhering to these guidelines ensures compliance and protects consumers from misleading or inaccurate information.

Marketing Timeline & Restrictions

• Agents must wait until October 1 to begin marketing next year’s plans to potential beneficiaries.
• Enrollment cannot begin until October 15.

Marketing vs. Non-Marketing Materials

CMS differentiates between marketing and non-marketing materials based on content and intent:

• Non-marketing materials provide general information and are not plan-specific. These do not require CMS review.
• Marketing materials are intended to influence a beneficiary’s enrollment decision and include plan-specific details such as benefits, premiums, and comparisons.
  • Marketing materials must be submitted for CMS approval before use.
  • If advertising plan-specific benefits in print ads, the carrier names must be included in at least 12-point font.

Important: Any Medicare marketing materials that mention benefits—including commonly available ones like dental, vision, or hearing—are considered marketing materials and must be filed with and reviewed by CMS via HPMS before use.

Presentation Guidelines & Transparency Rules

When presenting Medicare plans, agents must not mislead beneficiaries—intentionally or unintentionally. Key rules include:

• Avoid using absolutes or superlatives (e.g., “the best,” “the most comprehensive,” or “the cheapest”). Your role is to provide unbiased information rather than favoring one plan over another.
• If a beneficiary expresses interest in just one plan, you must inform them that other plans are also available to them.
• Clearly explain how enrolling in a new plan will affect the client’s current coverage—this is a critical part of ensuring informed decision-making.

Prohibited Use of the Word “Free”

CMS places a strong emphasis on accurate cost representation:

• Agents cannot use the term “free” to describe $0 premium plans or in relation to premium reductions, deductibles, or cost-sharing benefits (e.g., Part B premium buy-downs, low-income subsidies, or dual eligibility).
• While some plans may have low or no premiums, they often come with higher copays or out-of-pocket costs in other areas. Marketing must reflect the full financial picture rather than emphasizing only one aspect of cost savings.
• Generalized savings claims are prohibited because savings vary based on individual circumstances.

Star Ratings & Low Performing Plans

• When mentioning Medicare Star Ratings, agents must disclose that plans are evaluated annually by Medicare. Recommended disclaimer:
  • “Every year, Medicare evaluates plans based on a five-star rating system.”
• Agents cannot reference outdated Star Ratings—marketing materials for an upcoming year must not include ratings from the previous contract year.
• If a plan has received a Low Performing Icon (LPI) from CMS, this information must be disclosed.
  • Agents cannot highlight a plan’s Star Rating without also mentioning performance issues.
  • Star Ratings cannot be published before CMS officially releases them on the Medicare Plan Finder.

By following these marketing compliance rules, agents ensure they provide transparent, ethical, and CMS-compliant information to beneficiaries while avoiding regulatory penalties.

Medicare Events & Appointments: Guidelines for Compliance

Throughout the year, the presentations you host will typically fall into one of three categories: Educational Events, Sales Events, and Individual Appointments. Each has specific CMS regulations that must be followed to ensure compliance.

---

Educational Events

Educational events are designed to provide general Medicare information without promoting specific plans. These events must be clearly advertised as educational and follow strict guidelines.

✅ DO:

✔ Provide only educational materials—no plan-specific details.
✔ Distribute general healthcare materials to inform beneficiaries.
✔ Answer attendee questions but only within the scope of what they ask.
✔ Hand out your business card so attendees can contact you later.
✔ Provide generic business reply cards (without requesting an SOA or enrollment).
✔ Hold events in public venues (not in private homes or one-on-one settings).
✔ Include required disclaimers in all advertisements and invitations:

• “For accommodations of persons with special needs at meetings, call [insert phone and TTY number].”
• “This event is only for educational purposes, and no plan-specific benefits or details will be shared.”

DON’T:

✖ Conduct one-on-one educational presentations.
✖ Distribute plan-specific materials or enrollment packets.
✖ Discuss carrier-specific plans or benefits.
✖ Collect contact information or use a sign-in sheet.
✖ Answer questions beyond what attendees ask.
✖ Schedule future marketing appointments at the event.
✖ Collect SOAs or enrollment forms.
✖ Offer cash or monetary incentives.
✖ Hold a sales/marketing event within 12 hours of an educational event at the same location.
✖ Attempt to lead attendees toward a specific plan.

---

Sales Events

Sales events are intended to promote specific plans and influence potential enrollees’ decisions. They must follow strict compliance rules.

✅ DO:

✔ Use the required TPMO disclaimer on all marketing materials.
✔ Let beneficiaries approach you first (for informal events).
✔ Use optional sign-in sheets (clearly marked as voluntary).
✔ Follow carrier-specific filing and reporting procedures before the event.
✔ Disclose all plan types you will cover before starting.
✔ Use only carrier-approved materials and talking points.
✔ Collect TCPA-compliant lead cards and business reply cards.
✔ Schedule follow-up meetings and collect SOAs for future appointments.
✔ Distribute Star Ratings, Summary of Benefits, Pre-Enrollment Checklist, and Multi-Language Insert with any enrollment form.
✔ Collect enrollment applications.
✔ Follow up with attendees if they provided documented permission to contact.
✔ Provide giveaways with your contact information (must comply with CMS nominal gift rules).
✔ Offer refreshments and light snacks (must comply with CMS gift guidelines).

DON’T:

✖ Offer health screenings or request referrals.
✖ Give away cash or monetary incentives.
✖ Offer or subsidize full meals.
✖ Make absolute statements (e.g., “the best plan available”).
✖ Compare one carrier’s plan to another by name unless backed by approved studies or data and written permission from all involved carriers.
✖ Use high-pressure sales tactics.
✖ Cross-sell or promote non-health-related products.
✖ Require attendees to sign in (sign-in sheets must be optional).
✖ Require attendees to fill out an SOA or enrollment form.
✖ Hold a sales event within 12 hours of an educational event at the same location.
✖ Use contact information from sign-in sheets for raffles or drawings for any other purpose.

Flexibility in Sales Presentations: Agents are allowed to adjust their delivery style before accepting applications. Only talking points need to be pre-approved by carriers for CMS compliance, allowing for a more interactive discussion.

---

Individual Appointments

Individual appointments follow the same compliance regulations as sales events and require an SOA before discussing plan options.

• Whether meeting in person or having a one-on-one discussion over the phone, an SOA must be completed and signed before discussing Medicare plans.

---

Final Reminder: Stay Compliant & Transparent

Following these guidelines ensures compliance with CMS regulations while maintaining ethical, professional, and transparent interactions with Medicare beneficiaries.

Medicare Compliance for Websites

Any consumer-facing website that promotes Medicare Advantage (MA) or Part D plans for a specific carrier—or a group of carriers—must be submitted to CMS for approval. This process is typically handled through the carriers, so be sure to review each carrier’s website compliance policy before launching or updating your site.

In recent years, CMS has increased its scrutiny of Medicare-related websites, making proper review and compliance more critical than ever.

Streamlining Enrollment with Online Tools

To enhance your client’s enrollment experience while staying compliant, consider using Sunfire Blaze Sync and Connecture’s RetireFlo—Essential Care’s client-facing enrollment platforms. These tools allow you to:

✔ Compare plans and enroll clients seamlessly.
✔ Integrate with Sunfire and Connecture to keep all client information in one secure location.
✔ Generate leads in a CMS-compliant manner while simplifying the enrollment process.

Leveraging these platforms ensures you stay compliant while offering a user-friendly experience for your clients.

Staying Compliant on Social Media

Just like your website, social media posts must adhere to compliance regulations when promoting Medicare products or services. While maintaining an active social media presence is a great way to engage with your community and build credibility, it’s essential to ensure that all content follows CMS guidelines.

Important Reminder: Likes, shares, or comments on social media do NOT count as Permission to Contact (PTC) for sales purposes. You must still obtain explicit documented consent before reaching out to potential clients.

By using social media the right way, you can grow your online presence while remaining fully compliant with Medicare marketing regulations.