How to Get Medicare Leads: Allowed Sources and CMS Rules

To get Medicare leads within CMS rules, use channels where the beneficiary contacts you or asks to be contacted (inbound calls, web forms with the required disclosures, business reply cards, events, referrals who reach out to you, directory profiles), plus the unsolicited outreach CMS allows: direct mail, print ads, and email with an opt-out. CMS rules at 42 CFR 422.2264 prohibit cold calls, unsolicited texts and voicemails, door-knocking without a scheduled appointment, and unsolicited social media direct messages to Medicare beneficiaries.

This guide covers each permission-based channel and the CMS rules that apply from the lead form to the first call: the lead-generation disclosure, consent to share data between TPMOs, the Scope of Appointment, the TPMO disclaimer, and call recording. It reflects the Contract Year 2027 marketing rules, which apply to CY2027 marketing beginning October 1, 2026.

Key takeaways

• Contact isn't unsolicited when the beneficiary starts it or gives consent. Returning a call, or calling someone who sent a business reply card asking to be contacted, is allowed.
• A referral's name doesn't give you permission to call. Calls based on referrals count as unsolicited, so the referred person has to contact you or give you permission.
• Independent agents and brokers paid to perform lead generation, marketing, sales, and enrollment functions as part of the chain of enrollment are TPMOs under 42 CFR 422.2260.
• Since October 1, 2024, personal data a TPMO collects for marketing or enrolling someone into an MA plan may go to another TPMO only with prior express written consent that names each recipient and lets the person accept or reject each one.
• For CY2027 the 48-hour Scope of Appointment wait is gone, but every personal marketing appointment still needs an SOA, including inbound calls and web forms.
• Record marketing and sales calls in full and keep the recordings at least 6 years, in audio for the first 3.

Which Medicare lead sources are allowed?

42 CFR 422.2264 sorts beneficiary contact into what you may do unsolicited and what needs permission first.

A directory profile works like a small website: the prospect finds you and makes the first move. Ask your compliance team whether your profile needs the TPMO disclaimer, given that the rule covers TPMO websites and marketing materials.

Am I a TPMO as an independent agent?

Almost certainly. Under 42 CFR 422.2260, a third-party marketing organization includes organizations and individuals, including independent agents and brokers, who are paid to perform lead generation, marketing, sales, and enrollment functions as part of the chain of enrollment. A TPMO can be a first tier, downstream, or related entity (FDR) or a non-FDR entity that provides services to an MA plan or its FDR.

TPMO status matters because the disclaimer, recording, and data-sharing rules below apply to TPMOs. Under 42 CFR 422.2274(b), agents representing MA organizations must also be licensed and appointed under state law if required and pass annual training and testing with a score of 85 percent or higher. Our guide on how to become a Medicare agent covers that path.

What counts as unsolicited contact?

Under 42 CFR 422.2264(a)(2)(iv), you may not make unsolicited telephone solicitations (cold calls), robocalls, text messages, or voicemail messages to Medicare beneficiaries. The rule specifically includes:

• Calls based on referrals
• Calls to people who attended a sales event, unless they gave express permission
• Calls to confirm receipt of mailed information
• Calls to former enrollees who have disenrolled or are disenrolling, except disenrollment surveys for quality improvement

Under 422.2264(a)(3), a call isn't unsolicited if the beneficiary gives consent or starts the contact. Our Medicare cold calling rules guide goes deeper on permission.

Can I call a referral someone gave me?

No, not because a client gave you the name. Let the referred person reach you instead. One way to ask (advice):

"If you know someone who could use help with Medicare, I'd be glad to talk with them. Here are two of my cards. They can call me, or request a call on my website, whenever it suits them."

Can I call my auto or home clients about Medicare?

Read this one carefully. 42 CFR 422.2264(b)(1)(iv) lists agents calling clients enrolled in other products they sell, such as auto or home insurance, as plan business. Plan-business contact also requires written notice, at least once a year, of the person's right to opt out of future plan-business calls (422.2264(b)(2)). But 422.2264(b)(1)(v) says unsolicited calls about other lines of business may not be made as a way to generate Medicare leads. Confirm with your carriers and compliance team before you treat a P&C book as a Medicare prospect list.

How do educational and marketing events generate leads?

Events are one of the few ways to meet new prospects face to face, and CY2027 changed how they connect. Here's what 42 CFR 422.2264(c) allows at each type (current eCFR text as of October 22, 2026).

What changed for CY2027?

The CMS partner tip sheet (Product No. 12237-P, September 2026) says plans may now:

• Hold a marketing event directly after an educational event in the same location, if attendees are told and can leave
• Collect SOA forms at educational events
• Schedule personal marketing appointments any time after an SOA is completed

Under 422.2264(c)(2)(i), when a marketing event directly follows an educational one, you must announce that the educational event is ending and a marketing event will begin shortly, and give attendees a sufficient chance to leave before it starts. After either kind of event, call only the people who asked you to. See our guide to educational events vs. marketing events for planning details.

When do you need a Scope of Appointment for a new lead?

Before every personal marketing appointment. Under 42 CFR 422.2264(c)(3)(i), you must agree on the Scope of Appointment with the beneficiary and record it before the appointment, and it must be in writing for in-person appointments. 42 CFR 422.2274(b)(3) also requires you to secure and document an SOA before a personal marketing appointment.

The CY2027 final rule (CMS-4208-F3 and CMS-4212-F, published April 6, 2026, effective June 1, 2026) removed the 48-hour wait between SOA completion and the appointment, along with its two exceptions. Its marketing policies apply to all CY2027 marketing beginning October 1, 2026. The SOA itself is still required for every personal marketing appointment, including walk-ins, unscheduled calls, web chats, and web forms.

Two limits still apply under 422.2264(c)(3)(iii):

• An SOA, BRC, or request for information is valid for 12 months after the beneficiary's signature date or initial request.
• Marketing another health-related line of business you didn't identify beforehand takes a separate SOA. You may not market non-health products such as annuities during the appointment.

More in our Scope of Appointment rules guide.

What is the TPMO disclaimer, and where must it appear?

If you don't sell for every MA organization in the service area, 42 CFR 422.2267(e)(41) gives this wording:

"We do not offer every plan available in your area. Currently we represent [number] organizations which offer [number] products in your area. Please contact Medicare.gov or 1-800-MEDICARE to get information on all of your options."

Any TPMO selling for more than one MA organization must use it:

• Spoken on sales calls before any discussion of benefits
• Conveyed electronically in email and online chat
• Prominently displayed on TPMO websites
• Included in all TPMO marketing materials, including print and TV ads

For CY2027, CMS removed SHIPs from the disclaimer and changed the spoken timing from within the first minute of a call to before benefits are discussed. Update old scripts, web footers, and mailers. Our TPMO disclaimer guide covers plan counts.

What does a Medicare lead form need to say?

A web form, BRC, or landing page has to cover up to three separate things.

1. The lead-generation disclosure

Under 42 CFR 422.2274(g)(3), a TPMO doing lead generation must tell the beneficiary that their information will be given to a licensed agent for future contact. That means verbally by phone, in writing by mail, and electronically by email or chat. If you transfer the person to a licensed agent who can enroll them, you must say so.

2. Consent to share data with another TPMO

Under 42 CFR 422.2274(g)(4), starting October 1, 2024, personal beneficiary data a TPMO collects for marketing or enrolling into an MA plan may go to another TPMO only with prior express written consent. That consent must come through a clear and conspicuous disclosure that lists each entity receiving the data and lets the beneficiary accept or reject sharing with each one.

In the April 2024 final rule, CMS said the rule applies to data collected for marketing or enrolling into MA or Part D plans. It also said consent methods should default to not sharing, so the beneficiary has to take an affirmative action.

3. TCPA consent, if you'll autodial or use prerecorded messages

Covered in the FCC section below.

Sample form language

Adapt this with your compliance team (advice):

"By submitting this form, you ask [Agency name] to contact you about Medicare coverage at the phone number you provided. Your information will be provided to a licensed agent for future contact."

"Do you want us to share your information with the companies below so they can contact you about Medicare plans? Check each one you agree to. Leave a box blank to say no." [ ] [Named TPMO 1] [ ] [Named TPMO 2]

Leave every sharing box unchecked by default, and put the TPMO disclaimer on the page.

This sample does not include TCPA consent. If you will use autodialed or prerecorded calls or texts, add a separate signed authorization that meets 47 CFR 64.1200(f)(9), including a clear statement that consent isn't a condition of purchase.

What about Medigap leads?

The consent rule's text covers MA plan data, and CMS described it as covering MA and Part D. The rule doesn't address Medigap, so confirm the rules for Medigap leads with your state insurance department and compliance team rather than assuming they're exempt.

Can you still buy Medicare leads from a vendor or FMO?

Yes, but MA and Part D lead data a vendor collected and passes to you must come with prior express written consent naming you. Live transfers with the beneficiary's verbal agreement are handled differently (below). If a vendor collected the data and passes it to you, you are another TPMO, and the beneficiary needed to consent to sharing with you individually. A live call transferred to an agent who can help right away, with the beneficiary's verbal agreement, isn't "sharing personal beneficiary data," according to CMS in the April 2024 rule. The vendor must still disclose the transfer.

Vendor vetting checklist (advice):

1. Get the exact consent and disclosure language the beneficiary saw, with a screenshot of the form.
2. Check that the named-entity list includes you or your agency by name, with a separate choice for each.
3. Confirm the sharing boxes defaulted to unchecked.
4. Ask for a timestamp, source URL or campaign, and IP or signature record for each lead.
5. Ask whether any subcontractor or affiliate generated the leads, and get their names.
6. For live transfers, ask for the recording showing the transfer disclosure and the beneficiary's agreement.
7. Confirm the request date for each lead, and ask your carriers and compliance team how long they treat a request as permission to contact.

Is the FCC one-to-one consent rule still in effect?

No. The one-to-one consent rule never took effect. The Eleventh Circuit vacated it, the court's mandate issued April 30, 2025, and an FCC order effective August 29, 2025 reinstated the earlier prior express written consent definition at 47 CFR 64.1200(f)(9). That definition requires a signed written agreement, with electronic signatures allowed, that clearly authorizes the seller to deliver autodialed or prerecorded telemarketing to a specified number. It also requires a clear and conspicuous disclosure that signing isn't a condition of purchase.

CMS's data-sharing consent rule is separate and wasn't affected. A Medicare lead may need both kinds of consent. Our TCPA rules guide covers calling hours, Do Not Call, and opt-outs.

What are the CMS limits on referral payments?

42 CFR 422.2274(f) applies when an MA organization makes payments to third parties. It caps referral payments to individuals at $100 for a referral into an MA or MA-PD plan and $25 for a referral into a PDP. Before you offer anything to a client for a referral, confirm with your carriers, your state insurance department, and your compliance team whether you may make the payment at all. Our client retention playbook covers referral asks.

What should you document for every Medicare lead?

Record keeping is where good lead programs hold up under a carrier audit. For each lead, keep (advice):

• Source. Inbound call, BRC, web form, event, referral, directory, or vendor, with the date.
• Permission. Form wording, timestamp, and the named-entity choices for shared data.
• TCPA consent, if you autodial or use prerecorded messages.
• SOA. Products covered, date, and written form for in-person meetings.
• Disclaimer delivery. The recording or email showing it came before benefits.
• Call recordings.
• Needs review. Notes showing you covered the required pre-enrollment topics.

Under 42 CFR 422.2274(g)(2)(ii), all TPMO marketing and sales calls, including the audio portion of web-based calls, must be recorded in full. Keep the recordings at least 6 years. The first 3 years must be audio. Years 4 through 6 may be audio or complete and accurate transcripts. CMS's tip sheet notes this is down from 10 years.

Under 422.2274(c)(12), MA organizations must ensure that CMS's required questions and topics are fully discussed before an enrollment, so expect your carriers to require it of you. These include whether current providers and pharmacy are in network, prescription drug coverage and costs, costs of services, premiums, benefits, and specific health care needs.

A first-call script for an inbound Medicare lead

Adapt this to your carriers' requirements (advice):

"Thanks for calling [agency name]. This is [your name], a licensed agent."

"Before we talk about any plans: We do not offer every plan available in your area. Currently we represent [number] organizations which offer [number] products in your area. Please contact Medicare.gov or 1-800-MEDICARE to get information on all of your options."

"So I stay within what you want to cover today, which would you like to discuss: Medicare Advantage, prescription drug plans, or both?" [Record the SOA per your carrier's process.]

"Let's start with your doctors, pharmacy, and prescriptions, so we can check networks and drug costs before we look at any plan."

Common mistakes

• Calling a referral, or calling event attendees who didn't ask you to.
• Running vendor leads without checking that the consent names you.
• Pre-checking data-sharing boxes on a web form.
• Treating "no 48-hour wait" as "no SOA."
• Using the old disclaimer with SHIP wording or first-minute timing.
• Making a sign-in sheet mandatory at a marketing event.
• Deleting recordings before 6 years.
• Mailing a flyer, then calling to confirm it arrived.

How do you find Medicare leads between enrollment periods?

Every permission-based channel above works year-round (advice). Hold educational events, keep mail and email going to people aging in, ask clients for referrals at every review, and keep your website and directory profile current. Record the date on each BRC and request. The 12-month validity under 42 CFR 422.2264(c)(3)(iii) governs which products you may market at an appointment, not how long a BRC lets you keep calling, so ask your carriers and compliance team how long they treat a request as permission to contact. Our Medicare enrollment periods cheat sheet shows which windows apply to each prospect.

Where LeadGPT fits

A few LeadGPT features support permission-based lead flow. None of them establishes consent or makes your outreach compliant.

• The Profile Page lists you on the MeetBrokers.com directory, its request form includes a consent checkbox that names you, and each request becomes a new lead. See how MeetBrokers works.
• The AI Receptionist, on the Lead Hunter and Lead Master plans (see pricing), answers calls you miss and takes a message so you can call back.
• Calls made or answered in LeadGPT are recorded with transcripts. Recording is always on with no announcement, so confirm disclosure and retention with your compliance team.
• When a lead texts STOP, LeadGPT blocks every text to that number.

See the features overview.

What to do next

1. Audit every lead source against the allowed-channels table.
2. Rewrite your web forms with the lead-generation disclosure and unchecked, named-entity sharing boxes.
3. Update scripts and materials with the CY2027 disclaimer.
4. Send the vetting checklist to every lead vendor before your next order.

This guide is general information, not legal or compliance advice. Confirm each rule with CMS, your state insurance department, your carriers or upline, and your compliance team. More guides are in our insurance sales category, and our editorial policy explains how we research them.