ACA Agent Consent Documentation Requirements: CMS Rules

Under the ACA agent consent documentation requirements in 45 CFR 155.220(j), you have to document a consumer's consent before you help them enroll through a Federally-facilitated Exchange (FFE) or a State-based Exchange on the Federal platform (SBE-FP), or help them apply for APTC and CSRs. Before you submit the application, you also have to document that the consumer reviewed it and confirmed it is accurate, and you keep both records for at least 10 years.

Each record has required content. Starting with plan years that begin on or after January 1, 2028, agents on the Federal platform will also have to use an HHS-approved form. This guide covers what each record must contain, which formats count, the 2028 change, how long to keep records, and what happens when a file falls short.

Key takeaways

• Document consent before you give any help, including before you collect linkable personal information for a quote. The consumer or their authorized representative has to take an action that creates the record.
• A consent record needs five elements: the scope, purpose, and duration; the date; the consumer's name; the agent or agency name; and a way to rescind.
• Application review documentation is a separate record. You need it before every submission, including updates, plan changes, and NPN changes.
• Unrecorded verbal consent, a checkbox, and a typed signature with nothing else behind it generally fall short. Signed documents, recorded calls, and written replies work when they contain every element.
• Keep both records at least 10 years, even after the consumer leaves or you change agencies. Send them to CMS only when CMS asks.
• For plan years beginning on or after January 1, 2028, agents on the Federal platform (FFEs and SBE-FPs) must use the HHS-approved form. Translation is the only change allowed.

What does CMS require before you help with a Marketplace application?

You need two separate records, made at two separate times.

1. Consent, before you assist. Under 45 CFR 155.220(j)(2)(iii), agents, brokers, and web-brokers must document receipt of consent from the consumer or their authorized representative before assisting with or facilitating enrollment through an FFE or SBE-FP, or helping the consumer apply for APTC and CSRs.
2. Application review, before you submit. Under 155.220(j)(2)(ii), you must document that the consumer reviewed the eligibility application information and confirmed it is accurate before submission. The consumer has to take an action that produces that record.

Does this apply in your state's exchange?

CMS says the federal consent and review rules apply on FFMs and SBM-FPs, including FF-SHOP and SBM-FP-SHOP. They do not apply on State-based Marketplaces that run their own platform. If you write business in one of those states, ask the state's authorities what rules apply there.

What must a Marketplace consent record include?

The consumer or authorized representative has to take an action that produces a record you can keep and later produce to show consent was given. The CMS consent and application review FAQ says the documentation must contain at least the following:

The FAQ also says consent never permits you to log in to a consumer's HealthCare.gov account or create one for them, and your consent scripts and forms must not suggest that it does.

What must the eligibility application review record include?

Under 45 CFR 155.220, review documentation must include:

• The date the information was reviewed
• The name of the consumer or authorized representative
• An explanation of the attestations at the end of the eligibility application
• The name of the assisting agent, broker, or web-broker

You have to explain all of the attestations at the end of the application. Your documentation must show that you explained them, but it doesn't have to include the attestation wording itself.

When is a new review required?

You need review documentation before every submission. That includes updates or changes to an existing application, plan changes, and NPN changes. It applies even when you already hold valid consent that hasn't expired or been rescinded.

Which consent formats count, and which don't?

CMS lists examples of acceptable documentation. Each one has to meet all of the content requirements:

• A document the consumer signs, electronically or otherwise
• Verbal confirmation captured in an audio recording
• A written response from the consumer to a communication you sent

These formats fall short:

• Verbal consent that wasn't recorded. It doesn't count unless it's captured in an audio recording or other documentation that meets every content requirement.
• Your own note of a verbal agreement. A written note transcribing verbal consent fails if it doesn't meet the content requirements.
• A checkbox. CMS's July 2026 marketing tip sheet says simply having the consumer check a box is likely not enough, and that includes leads from online forms.
• A typed signature on its own. If a form carries only a typed signature with nothing else showing the consumer agreed, you need more support. An email or a recorded call showing that the consumer typed their name, or authorized you to type it, would work.

The tip sheet says you can get and document consent in person, by phone, by text message, or by email.

When do you need documented consent?

You need documented consent before you do any of the following:

• Collect or use consumer PII for a quote
• Run a person search on a Classic DE or EDE site
• Complete an application
• Enroll a consumer in a QHP
• Update an application
• Check the status of coverage or of an application

Can you run a quote without consent?

Yes, but only from general information that, taken together, can't be linked to a specific person. That includes estimated income, age, ZIP code, state, household size, and citizenship, plus coverage start date and tobacco use. Any other linkable PII, such as an SSN, address, or phone number, requires documented consent first.

Before the call or at the start of it?

Either one works. You can get and document consent before a meeting or phone call, or at the start of it. Either way, it has to be documented before you give any help.

Purchased and online leads

CMS's tip sheet says purchased leads still require documented consent and application review. It tells agents to check how their lead vendors comply with the ACA, HIPAA, and TCPA, and it notes that CMS does not approve Marketplace marketing. Don't treat a vendor's form checkbox as your consent record.

What changes in 2028 with the HHS-approved consent form?

The 2027 Payment Notice final rule requires agents, brokers, and web-brokers to use an HHS-approved and HHS-created form to document both consent and application review. The requirement applies to enrollments for plan years beginning on or after January 1, 2028.

The final rule in the Federal Register adds these details:

• You may translate the form, but you may make no other changes.
• A recorded call counts if you read the form's full language and the consumer gives verbal consent.
• CMS rejected comments asking that previously signed consent forms stay valid after the requirement takes effect. Plan to collect new documentation on the HHS form for plan year 2028 enrollments.
• The requirement applies only on the Federal platform, not to State Exchanges.

Pages saying CMS requires no standard format are out of date for plan years beginning on or after January 1, 2028. Get the form directly from CMS, and check that you have the current version before each enrollment season.

The current CMS model form

The CMS Model Consent Form (OMB Control Number 0938-1438, expiration date 07/31/2028) has four parts: a model consent form, a model eligibility application review form, a model consent verbal script, and a model eligibility application review verbal script. Check that your copy matches the current version on CMS's site.

The model form says it does not replace any state Agent of Record, Broker of Record, or issuer form used for commissions. A carrier form serves a different purpose. Any document you rely on as consent still has to contain all five required elements.

Does agency-wide consent cover every agent in your agency?

A consumer can give consent to an agency as a whole, but the consent must name that specific agency. Consent to an unnamed "agency," "designee," or "back-up agent" doesn't count. CMS recommends listing the writing agents' names and NPNs along with the agency's name and NPN.

Changing the NPN on an application

A new agent changing the NPN on an application has to get and document consent first. The exception is when unexpired, unrescinded agency-wide consent authorizes changes to the application and the new NPN belongs to that agency or one of its agents. Either way, you need new review documentation before the updated application is submitted.

How long does consent last, and how long do you keep records?

CMS sets no fixed length for consent. You and the consumer decide how long it lasts, and the documentation has to state that duration. The consumer can rescind at any time. CMS doesn't require you to document a rescission, but once a consumer rescinds, you and your agency must stop all assistance.

CMS's agent and broker FAQ on record retention says you must keep consent and review documentation for at least 10 years and produce it to CMS on request. CMS can ask at any point in that window. Submit the records only when CMS asks for them, not in advance.

The 10-year duty continues after any of the following:

• The consumer rescinds consent, or the consent expires
• The consumer leaves the Marketplace or switches agents
• You leave the agency where the enrollment happened

If you change agencies, settle before you leave how you'll keep access to your records for the full 10 years.

Edge cases: renewals, the Call Center, and more

• Auto-renewals. If a plan renews automatically and you make no changes to the application, the requirements aren't triggered. They apply again when an update is needed, when you help in a way your existing consent doesn't cover, or when the consumer's existing consent expires or is rescinded.
• Marketplace Call Center authorization. A consumer can call 1-800-318-2596 and name you and your NPN, either for one call or for up to 365 days. That authorization likely won't meet the documentation requirements on its own. Meeting the documentation requirements doesn't authorize you with the Call Center, either.
• Authorized representatives. Consent and review can come from the consumer or their authorized representative. Record which one acted, and use their name in the record. The consumer has to designate the authorized representative in a signed written document or another legally binding format. Keep that designation with the consent and review records, because CMS requires it whenever it asks for records where an authorized representative gave consent or did the review.
• Consumers who won't consent. Without documented consent, you can only quote from general information. Don't collect linkable PII or start an application. If a consumer is unwilling or unable to consent, you can't act as their agent for the enrollment. As a best practice, CMS says to point them to HealthCare.gov, the Marketplace Call Center, or an approved EDE or Classic DE site to enroll on their own.
• Situations this guide doesn't settle, such as mixed tax households. Put the question to the Agent/Broker Email Help Desk, your carriers, or your state.

How is Marketplace consent different from TCPA consent and a Medicare SOA?

They're separate obligations. The 155.220(j) consent covers assisting with a Marketplace enrollment. Whether you may call or text a lead is a different question. CMS's tip sheet also tells you to review how lead vendors handle TCPA compliance, along with ACA and HIPAA. For follow-up texting ideas, see our insurance follow-up text templates. A Medicare scope of appointment is also a different requirement, covered in our guide to Medicare scope of appointment rules. Keep each record separately.

The CMS model form says calls should be recorded where state law permits. Check your state's call recording rules with your compliance team before you rely on recorded consent.

What happens if your documentation doesn't comply?

According to CMS, agents whose documentation doesn't comply may face:

• Suspension or termination of their General Agreement and Privacy and Security Agreements
• Denial of future Marketplace agreements
• Civil money penalties

Under 45 CFR 155.220(g), if HHS finds by a preponderance of the evidence that an agent violated an applicable standard and the noncompliance is sufficiently severe, HHS notifies the agent and may terminate the FFE agreement for cause if the matter isn't resolved to HHS's satisfaction within 30 days of the notice. For suspected fraud, or abusive conduct that may cause imminent or ongoing consumer harm, HHS may suspend agreements for up to 90 calendar days. During that time the agent can submit evidence to rebut the allegation. HHS notifies the state department of insurance of suspensions and terminations.

A recorded-call workflow and script

This workflow is advice. Build your wording on the CMS model verbal scripts, and from plan year 2028, read the HHS form's full language.

1. Before collecting any linkable PII, start recording and take consent.
2. Complete the application.
3. Read the application back, explain each attestation, and record the consumer's confirmation.
4. Submit. Then file both records under the consumer's name with the dates.

Consent (start of the call): "Before I help with your Marketplace application, I need your permission, and this call is recorded to document it. I'm [agent name], NPN [number], with [agency name], NPN [number]. [Agents at our agency who may help you are (names and NPNs).] You're giving us permission to [scope, for example: search for your application, complete and submit it, help you apply for premium tax credits and cost-sharing reductions, and help with plan selection and updates]. This permission lasts until [agreed duration]. You can cancel it any time by [phone, text, or email]. It doesn't give me access to your HealthCare.gov account. Today is [date]. Please say your full name and tell me whether you agree."

Review (before submitting): "My name is [agent name], NPN [number]. Today is [date]. I've read back the information on your application. Is all of it accurate? Next I'll explain the statements at the end of the application that you're agreeing to." [Explain each attestation.] "Do you have any questions about these statements? Do you confirm the information is accurate? Please say your full name."

Record-keeping checklist and common mistakes

For each consumer, keep:

• The consent record with all five elements, plus its date and duration
• A review record for each submission, with the date and a note that the attestations were explained
• Agent and agency names and NPNs
• Supporting evidence for any typed signature
• A storage location you can search by consumer name and date for 10 years

Mistakes to avoid:

1. Quoting with an address or phone number before you have consent.
2. Reusing old consent as review documentation for a plan change.
3. Relying on a lead vendor's checkbox.
4. Getting consent for a "designee" without naming the agency.
5. Planning to carry pre-2028 signed forms into plan year 2028.

Keeping consent records in LeadGPT

Calls you make or answer in LeadGPT are recorded, and each gets a transcript and an AI summary that you can find in the Call Log and play or download. You can attach signed consent and review forms to the lead record and track consent dates and duration in custom data fields. The AI Assistant can search call transcripts when you need to locate a recorded consent. LeadGPT doesn't play a recording announcement, so give any notice your state requires yourself, and download recordings to archive them for the full 10 years. See the features overview or the interactive demo.

Where to get help and what to do next

For questions about the consent and review requirements, contact CMS's Agent/Broker Email Help Desk at FFMProducer-AssisterHelpDesk@cms.hhs.gov or the Marketplace Agent/Broker Partner Line at 1-855-788-6275.

1. Check every consent template against the five elements, and every review template against the four.
2. Retire checkbox-only and unrecorded verbal consent.
3. Get the current form from CMS and plan your switch to the HHS form for plan year 2028.
4. Fold these steps into your ACA open enrollment preparation.

This guide is general information, not legal or compliance advice. Confirm each requirement with CMS, your carriers or upline, and your compliance team. You'll find more guides in our compliance category, and our editorial policy explains how we research them.