Medicare Marketing Guidelines for Agents: CY2027 Rules

Under Medicare marketing guidelines, agents must be licensed and appointed where state law requires it, pass annual training and testing with a score of 85 percent or higher, record a Scope of Appointment before every personal marketing appointment, avoid unsolicited calls, texts, voicemails, social media DMs, and door-to-door contact, and say the TPMO disclaimer before discussing benefits. Every marketing and sales call must be recorded in full and kept at least 6 years, and six CY2027 rule changes apply to all CY2027 marketing and communications materials beginning October 1, 2026.

This guide walks through the rules in 42 CFR 422.2262 through 422.2274 as they stand for CY2027. You get what changed, what you can and can't do, a first-call script, and a record-keeping checklist.

Key takeaways

• The 48-hour Scope of Appointment (SOA) wait is gone. You can hold the appointment any time after the SOA is completed, but the SOA still comes first and must be in writing for in-person appointments.
• Unsolicited calls, texts, voicemails, robocalls, social media DMs, unscheduled door-to-door visits, and approaching people in parking lots or lobbies are prohibited, including calls based on referrals.
• The TPMO disclaimer no longer mentions SHIPs. You say it before any benefits are discussed, not within the first minute.
• Marketing and sales call recordings must be kept at least 6 years, down from 10. They must be audio for the first 3 years, and audio or complete transcripts are allowed for years 4 through 6.
• A marketing event may directly follow an educational event in the same location if attendees are told and given a chance to leave.
• Your carriers submit your marketing materials to CMS. You don't file with CMS yourself.

What changed in the Medicare marketing rules on October 1, 2026?

CMS issued final rule CMS-4212-F on April 2, 2026. The rule's six marketing and communications changes apply to all CY2027 marketing and communications materials beginning October 1, 2026.

Before and after the CY2027 changes

Older pages that still describe the 48-hour wait or the first-minute disclaimer are out of date. For the SOA in depth, see our guide to Medicare Scope of Appointment rules.

What do you need before you can market Medicare Advantage?

Under 42 CFR 422.2274(b), agents and brokers representing MA organizations must:

1. Be licensed and appointed under state law, where state law requires it.
2. Be trained and tested every year, scoring 85 percent or higher on all testing.
3. Secure and document a Scope of Appointment before each personal marketing appointment.

Do your ads and flyers need CMS approval?

MA organizations must submit agent and broker marketing materials to CMS through HPMS before use, under 42 CFR 422.2274(c)(7). In practice, you route flyers, ads, and scripts through the plan and wait for its go-ahead. You don't submit anything to CMS yourself. If you work through an upline, ask how it passes your materials to each carrier.

When can you start marketing next year's plans?

MA organizations may begin marketing next-year plans on October 1 each year under 42 CFR 422.2263(a). The regulations set rules for all communications materials in 422.2262 and add marketing-specific rules in 422.2263. Our Medicare AEP preparation checklist covers what to finish before October 1.

Is the 48-hour Scope of Appointment rule still in effect?

No. The April 2026 final rule eliminated the 48-hour waiting period and both of its exceptions. Under 42 CFR 422.2264(c)(3)(i), you must agree upon and record the SOA with the beneficiary before the personal marketing appointment. It must be in writing for in-person appointments.

What still applies, under 422.2264(c)(3)(iii):

• You may not market health care products beyond the scope documented in the SOA, business reply card, or request for information.
• That document is valid for 12 months from the beneficiary's signature date or initial request.
• Additional lines of business need a separate SOA.
• Non-health products such as annuities may not be marketed.

Who can you contact, and how?

What counts as prohibited unsolicited contact?

Under 42 CFR 422.2264(a)(2), you may not:

• Go door to door without a previously scheduled appointment
• Approach people in common areas such as parking lots and lobbies
• Send social media direct messages
• Make cold calls or robocalls, or send texts or voicemails, including calls based on referrals and calls to confirm receipt of mailed information
• Call former enrollees who have disenrolled or are in the process of disenrolling (except disenrollment surveys for quality improvement)

What counts as consented or beneficiary-initiated contact?

Under 422.2264(a)(3), a call is not unsolicited if the beneficiary consents or starts the contact. Returning a beneficiary's phone call counts, and so does calling someone who completed a business reply card requesting contact.

Unsolicited contact by conventional mail, other print media, or email is permitted under 422.2264(a)(1), as long as every email has an opt-out option.

Contact limits that catch agents off guard

• Sales event attendees. You can't call them unless the beneficiary gave express permission to be contacted.
• Other lines of business. Unsolicited calls about other lines of business may not be used to generate Medicare leads.
• Long-term care residents. You may visit only on the resident's request. Any other visit is prohibited as unsolicited door-to-door marketing under 422.2264(c)(1)(iv).

Educational vs. marketing events: what's allowed?

Educational events must be advertised as educational. Marketing events have their own limits under 42 CFR 422.2264(c)(2)(iii).

Can you hold a sales event right after an educational seminar?

Yes, starting with CY2027 marketing. The marketing event can follow directly in the same location if you tell attendees and give them a chance to leave first. As a habit, announce the switch out loud, pause, and note in your event file that you did. Meals of any value are barred in marketing under 422.2263(b), so plan events without food.

What are the exact words of the TPMO disclaimer, and when do you say it?

For a TPMO that does not sell for all MA organizations in the service area, the current disclaimer reads:

"We do not offer every plan available in your area. Currently we represent [number] organizations which offer [number] products in your area. Please contact Medicare.gov or 1-800-MEDICARE to get information on all of your options."

Under 42 CFR 422.2267(e)(41), you must:

• Say it out loud on sales calls before any benefits are discussed
• Display it prominently on your TPMO website
• Include it in your TPMO marketing materials, including print and TV ads

CMS removed the SHIP reference and moved the timing from within the first minute of a call to before benefits are discussed. Replace old scripts, website footers, and flyer templates that still carry the earlier wording.

How long do you have to keep Medicare call recordings?

Under 42 CFR 422.2274(g)(2)(ii), every marketing and sales call must be recorded in full, including the audio of web-based calls, and kept at least 6 years.

CMS says the retention period dropped from 10 years to 6 under the CY2027 rule. Carrier contracts can require more, so check each one before you delete anything.

Which Medicare marketing practices are prohibited?

Under 42 CFR 422.2263(b), marketing may not include:

• Cash rebates
• Gifts above nominal value, or gifts offered only to enrollees
• Meals of any value
• Cross-selling non-health products during MA sales activities
• Unsupported comparisons to other plans

Under 42 CFR 422.2262(a)(1), communications may not:

• Claim endorsement by CMS, Medicare, or HHS
• Use "free" to describe a $0 premium
• Use the Medicare name, CMS logo, or Medicare card in a misleading way

Using the Medicare card image requires CMS authorization.

Can you contact clients during the MA Open Enrollment Period?

During the MA Open Enrollment Period, 422.2263(b)(7) says plans may not send unsolicited materials referencing the OEP, target people who made an AEP choice, promote agent activities aimed at the OEP, or call or otherwise contact former enrollees who selected a new plan during the AEP. You may meet one-on-one or send materials when the beneficiary asks. Our client retention playbook covers working your book in that window.

How do CMS rules fit with TCPA consent?

They are separate tests, and an outreach plan has to pass both. CMS decides whether a contact is unsolicited. The FCC's TCPA rules decide what consent you need for telemarketing with an autodialer or an artificial or prerecorded voice.

The Eleventh Circuit vacated the FCC's 2023 one-to-one consent revision, with its mandate issued April 30, 2025. The FCC reinstated the prior definition of prior express written consent at 47 CFR 64.1200(f)(9) effective August 29, 2025, and the revised rule never took effect.

Under the reinstated definition, prior express written consent is a signed written agreement that authorizes the seller to deliver telemarketing using an autodialer or an artificial or prerecorded voice to a specified number. It must clearly and conspicuously disclose that signing authorizes those autodialed or prerecorded telemarketing calls and that signing is not a condition of purchase. Electronic signatures are allowed where valid under federal or state law. A Medicare lead who asked to be called may satisfy CMS and still not have given that consent. Have your compliance team review your lead forms. For texting, see our follow-up text templates.

What are the data-sharing and referral payment rules?

Data sharing. Since October 1, 2024, a TPMO may share personal beneficiary data it collects with another TPMO only with the beneficiary's prior express written consent. That consent must come through a clear and conspicuous disclosure that lists each receiving entity and lets the beneficiary accept or reject sharing with each one.

Referral payments. Payments to individuals for referrals may not exceed $100 for a referral into an MA or MA-PD plan, or $25 for a PDP referral, under 42 CFR 422.2274(f). This cap sits in the rules for payments plans make to third parties. Cash rebates are barred in marketing, so confirm with your carrier before offering any referral reward. A referral also doesn't let you call the person referred. Give your client your card so the friend can contact you.

Edge cases agents ask about

Inbound calls and returned calls

A beneficiary who calls you, or whose call you return, has started the contact. You still need the SOA before the appointment, the disclaimer before benefits, and a full recording.

Walk-ins

The walk-in exception disappeared along with the 48-hour wait. A walk-in still needs an SOA before the appointment, and because it's in person, the SOA must be in writing.

Cross-selling ACA, ancillary, and non-health products

If a client asks about another health line during a Medicare appointment, take a separate SOA naming it before you discuss it. Non-health products may not be marketed. Annuities are the regulation's example, so ask your compliance team how your carriers classify life insurance and other products. Don't use calls to marketplace or ancillary clients to generate Medicare leads.

A first-call script for a requested callback

This is advice to adapt with your carrier's approved script, which comes first.

"Hi, this is [name], a licensed insurance agent with [agency]. I'm returning your [call / request from (date)] about Medicare plans. Is now a good time?"

[Give any recording notice your carrier or compliance team requires.]

"Before we look at any plans, I need to confirm which types of plans you'd like to discuss today: [product types on your carrier's SOA]. Which would you like to cover?" [Record the answer.]

[Read the TPMO disclaimer word for word.]

"To find what fits, I'll ask about your doctors and pharmacy, your prescriptions, the care you expect to need, and what you want to pay in premiums and other costs."

Before any enrollment, 422.2274(c)(12) requires plans to ensure these needs topics are fully discussed, so your carrier will expect you to cover them: whether current providers and pharmacy are in network, prescription coverage and costs, health care service costs, premiums, benefits, and specific health care needs.

Record-keeping checklist

• How the contact started: inbound call, returned call, business reply card, or written request, with the date
• SOA: product types, date, and format, written for in-person appointments, plus a note of when the 12 months run out
• Separate SOAs for any added lines of business
• The full call recording, filed with the SOA
• A note that the disclaimer was given before benefits
• Notes showing each needs topic was discussed
• Express permission to contact, for anyone met at a sales event
• Data-sharing consent naming each receiving entity, if you share data
• TCPA prior express written consent, if you use automated or prerecorded outreach
• Carrier approval for every flyer, ad, and web page

Common mistakes to avoid

1. Keeping 48-hour SOA gaps or the first-minute disclaimer in scripts and trainings.
2. Calling referrals or event attendees who never asked to be contacted.
3. Discussing a product line the SOA doesn't name.
4. Running ads or flyers the plan hasn't submitted.
5. Calling a $0 premium plan "free."
6. Deleting recordings without checking carrier retention terms.

Organizing call and SOA records in LeadGPT

Calls you make or answer in LeadGPT are recorded, and each one gets a transcript, an AI summary, and key points. You can play or download recordings from the Call Log, attach a signed SOA form to the lead record, and track product types and SOA dates in custom data fields. Retention periods and recording requirements still come from CMS and your carriers. Download recordings from the Call Log and archive them on the schedule CMS and your carriers require. See the features overview or take the interactive demo.

What to do next

1. Replace every script, flyer, and web page that uses the old disclaimer wording or timing.
2. Remove 48-hour gaps from your booking process, and keep the SOA step.
3. Ask each carrier for its current SOA form, its recording retention terms, and its material submission process.
4. Have your compliance team review your lead forms against both CMS contact rules and TCPA consent.
5. Check your state insurance department's rules too, because carriers and states can go further than CMS.

This guide is general information, not legal or compliance advice. Confirm each rule against the regulation text, with your carriers or upline, and with your compliance team. You'll find more guides in our compliance category, and our editorial policy explains how we research them.