Medicare Cold Calling Rules: What CMS Allows for Agents

Medicare cold calling rules come from CMS's beneficiary contact regulation, 42 CFR 422.2264, which prohibits unsolicited phone calls, text messages, robocalls, and voicemails to Medicare beneficiaries, including calls based on referrals. You can call or text a beneficiary only after they contact you or give permission, apart from limited plan business contact with existing clients, and the only unsolicited outreach allowed is mail, other print media, and email with an opt-out.

The same rule bans unsolicited door-knocking, approaches in parking lots and lobbies, and social media direct messages. This guide covers what counts as permission, how long it lasts, how federal telemarketing rules layer on top, and how to fill your calendar without cold outreach.

Key takeaways

• CMS bans unsolicited calls, texts, robocalls, voicemails, door-to-door visits, common-area approaches, and social media DMs to beneficiaries. Mail, print, and email with an opt-out in every message are allowed.
• A referral is not permission. Neither is attending your sales event, unless the person gave express permission to be contacted.
• Returned calls, business reply cards, and other requests the beneficiary starts are not unsolicited. In the CY 2027 proposed rule, CMS said requests that name the product type are, in effect, scopes of appointment (SOAs). Confirm with your carriers how they treat these requests.
• In the CY 2027 proposed rule, CMS says SOAs, business reply cards, and requests for information are valid for 12 months, only for the products agreed. A request to stop contact ends it right away, and Do Not Call Registry limits can be shorter.
• The CY 2027 rule removed the 48-hour SOA wait but left the unsolicited contact ban in place.
• CMS permission doesn't settle your Do Not Call, Telemarketing Sales Rule, TCPA, and state law obligations. Check those separately.

Can Medicare agents cold call, text, or door-knock prospects?

No. Under 42 CFR 422.2264(a)(2)(iv), MA organizations, and through them their agents and brokers, may not use unsolicited telephone solicitation (cold calling), robocalls, text messages, or voicemail messages, including calls based on referrals.

If you had a pre-scheduled home appointment and the beneficiary isn't home, you may leave information. The long-term care rule covers nursing homes, assisted living, and board and care homes.

The rule also gives examples of banned unsolicited contact:

• Calls to former enrollees who have disenrolled or are disenrolling, except disenrollment surveys for quality improvement
• Calls to beneficiaries who attended a sales event, unless they gave express permission to be contacted
• Calls to prospective enrollees to confirm receipt of mailed information

Who do the unsolicited contact rules cover?

The MA rule binds MA organizations and, through them, their agents and brokers. It defines beneficiary contact as any outreach to a beneficiary or a beneficiary's caregivers, so calling a beneficiary's caregiver cold is covered too.

Part D sponsors follow parallel rules at 42 CFR 423.2264. These allow unsolicited mail and email with an opt-out in every email, and ban unsolicited door-to-door contact, common-area approaches, and social media DMs.

What about Medicare Supplement and ACA leads?

The rules in this guide sit in 42 CFR Parts 422 and 423, which govern MA organizations and Part D sponsors. They don't address Medicare Supplement-only or ACA marketplace outreach. The FCC's TCPA rules still apply, the Telemarketing Sales Rule may apply depending on how your state regulates insurance telemarketing, and the FTC notes many states have their own telemarketing laws. Ask your state department of insurance, your carriers, and your compliance team what applies. For ACA lead sources, see how to get ACA leads.

As advice: if a supplement conversation could turn to MA or Part D, work it under the CMS rules from the first call.

What counts as permission to contact a Medicare beneficiary?

Under 422.2264(a)(3), calls aren't unsolicited if the beneficiary gives consent or starts the contact. Returning a phone call, or calling someone who completed a business reply card asking to be contacted, is not unsolicited.

Counts as permission:

• The beneficiary calls you, and you call back
• A business reply card that asks for contact
• An online form, a voicemail, or another request for information. CMS said in the CY 2027 proposed rule that a request that names the product type is, in effect, an SOA
• Express permission from a sales event attendee to be contacted

Doesn't count:

• A referral from a client, family member, or friend
• Attending your sales event without giving express permission
• Having mailed the person something
• A former enrollee relationship
• An auto or home policy used as a way to generate Medicare leads (see the existing clients section below)

Does an online form allow both calls and texts?

CMS treats a request the beneficiary starts as permission, but which channels the form authorized is a separate question. As advice, use only the channel the form asked for. If it asked for a phone call, don't text until the person agrees to texts on that call.

How long does permission to contact last?

In the CY 2027 proposed rule, CMS states that SOAs, business reply cards, and other requests for information are valid for 12 months from the beneficiary's signature date or the date of the first request. During that window, contact is limited to the agreed scope of products. A new product requires a new SOA.

The 12 months is a ceiling, not a guarantee. In the CY 2027 final rule, CMS says a plan or agent must respect a beneficiary's request to no longer be contacted, even within the 12-month window.

If the number is on the National Do Not Call Registry, the FTC's inquiry-based established business relationship lasts only 3 months, so you may need written consent to call after that.

Permission to contact vs. scope of appointment

The two overlap but do different jobs.

The SOA requirement for inbound and outbound contact comes from the CY 2027 final rule. Under CY 2027, you may schedule a personal marketing appointment any time after the SOA is completed, because the 48-hour waiting period and its two exceptions were eliminated. Our scope of appointment guide covers collection and documentation.

Can you call existing clients and former enrollees?

Under 422.2264(b), plan business contact includes agents and brokers calling clients enrolled in other products they sell, such as auto or home insurance. MA organizations may not make unsolicited calls about other lines of business as a way to generate leads for Medicare plans.

An MA organization that reaches out about plan business must notify everyone it contacts, at least once a year and in writing, that they can opt out of future plan business calls. Ask your carriers how that notice reaches your book.

Unsolicited calls to former enrollees who have disenrolled or are disenrolling are banned, except disenrollment surveys for quality improvement. During the MA Open Enrollment Period, 422.2263 bars MA organizations from calling or contacting former enrollees who picked a new plan during the AEP, and from knowingly targeting or sending unsolicited marketing materials to MA enrollees. Our enrollment periods cheat sheet has the dates.

What did the CY 2027 rule change, and what stayed the same?

CMS lists six marketing changes:

1. Removed the Notice of Availability requirement
2. Revised certain outreach restrictions for events and personal marketing appointments
3. Revised advertising language restrictions
4. Updated the TPMO disclaimer
5. Rescinded the Mid-Year Supplemental Benefits Notice
6. Revised call-recording retention

None of them removes the unsolicited contact ban. The event changes let you collect SOAs at educational events and hold a marketing event right after an educational event in the same location, with notice and an opportunity to leave. See educational vs. marketing events.

The TPMO disclaimer no longer mentions SHIPs, points to 1-800-MEDICARE, and must be said aloud before benefits are discussed rather than within the first minute. Our TPMO disclaimer guide has the wording.

How do federal telemarketing rules apply on top of CMS rules?

CMS permission answers one question: is this contact solicited? Federal and state telemarketing law asks others.

• Calling hours and identification. FCC rules prohibit telemarketing calls to a home before 8 a.m. and after 9 p.m., require callers to give their name and their employer's contact information, and require immediate compliance with any do-not-call request made during a call.
• National Do Not Call Registry. The FTC says calling a registered number is illegal unless you have an established business relationship or the consumer agreed in writing to receive your calls. The written agreement must include the number and the consumer's signature, and an electronic signature is allowed online. The FCC codified in December 2023 that National Do Not Call Registry protections also apply to text messages.
• Established business relationship. It lasts 18 months after a purchase or transaction and 3 months after an inquiry or application. It permits live calls by a sales agent, not prerecorded calls or robocalls, and it ends if the consumer asks to be on your do-not-call list.
• Insurance and state law. The FTC says whether the Telemarketing Sales Rule applies to insurance telemarketing depends on how far state law regulates it, and the FCC enforces the TCPA for both intrastate and interstate calls.

A business reply card can be valid permission under CMS and still lack the phone number and signature the FTC describes for a written agreement. Check each lead against both tests.

Is the FCC one-to-one consent rule in effect?

No. The FCC's one-to-one rule for TCPA prior express written consent was set to start January 27, 2025, but the Eleventh Circuit vacated it on January 24, 2025, and the FCC removed it on July 14, 2025. The FCC notes that CMS's one-to-one consent requirement for TPMO data sharing at 42 CFR 422.2274(g)(4) is a separate rule.

Can you work purchased Medicare leads?

A purchased lead is workable only if the beneficiary actually asked to be contacted. Before you dial, ask the vendor for:

• The exact form or page the person completed, with the date and time
• The product types named, which set your scope and start the 12-month clock
• Whether the person agreed to calls, texts, or both, at which number, and how they signed
• How the vendor meets CMS's TPMO data sharing consent rule at 422.2274(g)(4). Ask your compliance team what that consent must show.

Keep the vendor's proof with the lead. If a vendor can't produce it, don't call.

A callback workflow and first-call script

These steps are advice. Follow your carriers' procedures as well.

1. Confirm a request is on file, its date is within 12 months, and which products it names.
2. Check your opt-out list, the National Do Not Call Registry status, and your state's rules.
3. Call between 8 a.m. and 9 p.m. in the lead's local time.
4. Identify yourself and your agency, and give contact information.
5. Confirm the request and the products. A new product needs a new SOA.
6. Complete the SOA before the personal marketing appointment.
7. Give the TPMO disclaimer before you discuss benefits.
8. If the person asks you to stop, stop, and log it the same day.

"Hi, this is [name], a licensed agent with [agency]. You [called / sent a reply card / filled out a form] on [date] asking about [product type]. Is now still a good time? Before we go further, I'll confirm which plans you'd like to discuss and record that as your scope of appointment. [Complete SOA.] [Read the current TPMO disclaimer.] If you'd ever rather not hear from me, just tell me and I'll remove you from my list."

For the rest of the sales call, see how to sell Medicare over the phone.

What should you document, and for how long?

• The original request: card, form, voicemail, or call record, with date and products
• The SOA and its date
• Sales and marketing call recordings, kept 6 years under CY 2027. Transcripts may replace recordings for years 4 through 6.
• Written telemarketing consent, where you rely on it
• Your internal do-not-contact list, with the date of each request
• Vendor proof for purchased leads

The FTC says the Telemarketing Sales Rule requires specified business records to be kept for two years. Ask your carriers and compliance team whether they require more.

Permission-based ways to fill your calendar

Each tactic below must still meet the CMS, telemarketing, and carrier rules covered above.

• Direct mail and print ads with a reply card or call-in number
• Email with an opt-out in every message
• Advertising that drives inbound calls, which you answer and return
• Educational and marketing events, collecting SOAs or express permission to contact
• Website forms that name the products the person wants to discuss
• Referral asks where the client gives your number to the friend and the friend calls you

Common mistakes

1. Calling a referral because the client "said it was fine"
2. Texting a lead whose form only asked for a call
3. Leaving voicemails on numbers that never contacted you
4. Sending unsolicited direct messages to prospects on social media
5. Leaving door hangers or flyers at homes without a scheduled appointment
6. Calling seminar attendees who didn't give express permission
7. Calling to ask whether someone received your mailer
8. Working a request older than 12 months, or discussing a product it didn't name

What are the penalties for cold calling Medicare beneficiaries?

The CMS rule binds MA organizations, and agents through them, so ask each carrier how it handles agent marketing complaints. CMS encourages beneficiaries who believe they were misled or steered into a plan through non-compliant sales tactics to call 1-800-MEDICARE.

The FTC's Telemarketing Sales Rule guidance (page updated October 2026) lists a civil penalty of $53,088 per violation for failing to make required disclosures. Whether the TSR applies to insurance telemarketing depends on how far your state regulates it, and the FCC enforces the TCPA separately.

Where LeadGPT fits

• Calls you make or answer in LeadGPT are recorded with a transcript in the Call Log, and you can download recordings to archive them for 6 years.
• Custom fields and file attachments keep each lead's request date, product scope, and SOA together.
• When a lead texts STOP, LeadGPT blocks texts to that number and sets the lead to Dead. Sofia, the AI Assistant, AI calling campaigns, and text campaigns won't text or call leads who opted out, are marked Dead, or are flagged do-not-contact.

Recording is always on with no announcement, so confirm disclosure rules with your compliance team. See the features overview or the interactive demo.

What to do next

1. Audit your lead list for referrals, event attendees, and expired requests, and stop calling them.
2. Add request date and product scope fields to every lead.
3. Ask lead vendors for consent proof before your next order.
4. Review the CY 2027 changes in our Medicare marketing guidelines guide.

This guide is general information, not legal or compliance advice. Confirm each rule with CMS, your carriers or upline, and your compliance team. You'll find more guides in our compliance category, and our editorial policy explains how we research them.