CMS now requires Third-Party Marketing Organizations (TPMOs) to obtain a beneficiary’s express written consent before sharing any of their personal information.
This new rule directly impacts Medicare lead sharing practices — so how does it change the way agents and agencies exchange beneficiary data? Let’s break it down.
Key Details to Understand
What Is a TPMO in Medicare?
The Centers for Medicare & Medicaid Services (CMS) defines a Third-Party Marketing Organization (TPMO) as any organization that receives compensation to conduct lead generation, marketing, sales, or enrollment activities as part of the enrollment chain.
Are Insurance Agents Considered TPMOs?
Yes. Under CMS guidelines, all lead generation companies, agencies, and independent insurance agents or brokers are classified as TPMOs. This means field marketing organizations, agencies, and individual agents must fully comply with all CMS TPMO rules and requirements.
What Counts as Personal Beneficiary Information?
Personal beneficiary data refers to any information that can identify or be used to contact a beneficiary, including:
-
Name
-
Address
-
Phone number or other contact details
-
Any additional information provided by the beneficiary to help match them with a suitable Medicare Advantage (MA) or Part D plan
When in doubt about whether a piece of information qualifies as personal, it’s best to err on the side of caution and treat it as protected data.
Obtaining Prior Express Written Consent
Under CMS regulations, all Third-Party Marketing Organizations (TPMOs) must secure a beneficiary’s express written consent before sharing their personal information. This consent must include a clear, easy-to-read disclosure identifying each TPMO that will receive the beneficiary’s data.
Beneficiaries must also be given the individual choice to either approve or decline data sharing with each listed TPMO. Consent requires active, affirmative action — the default setting is “no sharing” unless the beneficiary explicitly agrees to share their information.
TPMOs may collect this consent in several written formats, not just a signed paper form. Acceptable methods include online forms, emails, or even text message authorizations.
CMS Informed Consent Requirements — FAQs
Here’s a breakdown of the most common questions about the CMS rule on beneficiary data sharing for Third-Party Marketing Organizations (TPMOs).
Why did CMS implement this rule?
CMS introduced this regulation to protect Medicare beneficiaries from deceptive marketing and data misuse. In their statement, CMS noted that:
“Some TPMOs have been selling and reselling personal beneficiary data, which can undermine existing rules that prohibit cold calling and lead to aggressive marketing tactics for Medicare Advantage and Part D plans. Individuals may be unaware that by calling or clicking a generic web link, they are unknowingly consenting to have their personal data collected and sold for future marketing use.”
Are there situations where written consent isn’t required?
Yes. CMS allows exceptions in cases of real-time assistance or live transfers.
For example, if a beneficiary calls a TPMO seeking information, that TPMO can connect them directly to another TPMO—such as a licensed agent—during the same call. In these instances, a verbal agreement from the beneficiary is sufficient.
Agents should document any verbal consent, typically through call recordings or written notes, and may also follow up via email to confirm consent.
However, if a live transfer cannot occur, the agent must obtain prior express written consent before sharing the beneficiary’s data for a future callback.
CMS also clarified that MA organizations and Part D sponsors are not considered TPMOs, meaning TPMOs may share data with them without separate written consent under this rule.
Still, all parties must comply with HIPAA privacy standards when handling personal beneficiary information.
Do I need separate permission for each TPMO I share data with?
Yes. Beneficiaries must have the ability to approve or decline data sharing for each specific TPMO.
The consent disclosure must clearly list each organization by name—generic language such as “another agent” does not meet compliance standards.
Can I share beneficiary data with another independent agent?
No. Independent agents cannot share personal beneficiary data with one another—even within the same FMO—without prior express written consent.
The consent must identify the specific agent receiving the data; a vague disclaimer isn’t enough.
Do I need consent if I’m manually dialing numbers?
Yes. Even if you’re complying with TCPA rules and dialing by hand, you still must obtain prior express written consent before contacting or sharing beneficiary information.
Is there a sample disclaimer I can use?
CMS refers TPMOs to the Federal Trade Commission (FTC) for examples of “clear and conspicuous” disclaimers.
You can review detailed guidance in the FTC’s .com Disclosures booklet and related sections of the Federal Register for compliant wording examples.
What if TPMOs share a common parent company or FMO?
Even if TPMOs operate under the same parent company, contract, or FMO, each must still obtain prior express written consent before exchanging beneficiary data.
Can I still buy leads from my FMO or other organizations?
Yes—if the FMO or lead vendor obtains written consent from the beneficiary before selling Medicare Advantage (MA) or Part D (PDP) leads.
When proper consent procedures are followed, agents can continue purchasing compliant leads.
Note that this rule only applies to MA and PDP leads; it does not affect Medicare Supplement or final expense lead types.
How long must I keep written consent on file?
Just like a Scope of Appointment, TPMOs must store written consent records for 10 years following the applicable selling year.
How long does consent remain valid?
Prior express written consent is valid for 12 months, similar to the Medicare Permission to Contact form, unless the client revokes it sooner. Once a beneficiary requests no further contact, the TPMO must stop outreach and obtain new consent before resuming contact.
Final Thoughts
Lead sharing is an essential part of Medicare sales—but it must be handled transparently and compliantly. Always ensure you’ve obtained prior express written consent before sharing or receiving beneficiary data.
At Essential Care, we take compliance seriously and are committed to supporting our agents in meeting all CMS regulations.
Register with us to stay updated on policy changes, receive compliance support, and gain access to approved, compliant sales technology.
Not affiliated with or endorsed by Medicare or any government agency.
GET CONTRACTED WITH ESSENTIAL CARE INSURANCE AGENCY
For more information, please contact our office at (347) 971-3399 or send an email to rdashevskyy@essentialcare.info. Essential Care Insurance Agency provides Free Programs and Sales Tools for our Agents:
Please click on each link to learn more