CMS Medicare Marketing Rules for Agents: A Plain-English Walkthrough
The CMS Medicare marketing rules for agents cover four things that trip people up: the TPMO disclaimer, recording every marketing and enrollment call, capturing a Scope of Appointment before a sales meeting, and keeping records. The rules change every plan year, so verify against current CMS guidance.
The CMS marketing rules do not police which plan you recommended. They police how you marketed it: the disclaimer you did or did not read, the call you did or did not record, the Scope of Appointment collected at the kitchen table instead of beforehand. The mechanics are where the secret-shopper complaints come from.
This is a plain-English map of the CMS Medicare marketing rules for agents. It is a marketing-operations summary, not legal advice. You are the licensed party; we run marketing. And the single most important thing to internalize: these rules change almost every plan year. Anything below is a starting point to verify against current CMS guidance, not a permanent answer.
Two structural notes before the rules themselves. First, everything here has a Part D twin: Medicare Advantage sits in 42 CFR part 422, subpart V, and the prescription-drug side repeats it almost word for word in part 423, subpart V — so a standalone PDP campaign gets no free pass. Second, CMS did not write these rules in the abstract. Explaining the contract-year 2023 rule that created the recording requirement, CMS said it had reviewed call recordings from agents, brokers and call centers, and reported the result in one sentence: “The agents failed to provide the beneficiary with the necessary information or provided inaccurate information to make an informed choice for more than 80 percent of the calls reviewed.” (CMS, Contract Year 2023 Medicare Advantage Marketing Policies FAQ, October 19, 2022). CMS describes that as a review of “numerous recordings” of calls, not a random sample of the industry — but it is the evidence the agency cited, and it explains why the rules are written the way they are.
Are you a “TPMO”? Probably yes
CMS regulates Medicare marketing largely through a category called the Third-Party Marketing Organization (TPMO). The definition is broad. If you generate leads, market, sell, or enroll beneficiaries into Medicare Advantage or Part D plans — and you are not the plan carrier itself — you are almost certainly a TPMO. That includes solo agents, agencies, FMOs, and the vendors who sell you leads.
The regulation says it plainly. 42 CFR §422.2260 defines a TPMO as “organizations and individuals, including independent agents and brokers, who are compensated to perform lead generation, marketing, sales, and enrollment related functions as a part of the chain of enrollment,” and defines the chain of enrollment as “the steps taken by a beneficiary from becoming aware of an MA plan or plans to making an enrollment decision.” The same paragraph adds that TPMOs “may be a first tier, downstream or related entity (FDRs), as defined under § 422.2, but may also be entities that are not FDRs but provide services to an MA plan or an MA plan’s FDR.” Compensation is the trigger, not company size, and CMS’s own FAQ confirms captive agents are covered too.
Why it matters: TPMO status is what triggers the disclaimer, the recording rule, and the documentation obligations below. You do not get to opt out by calling yourself “just an agent.”
The 4 Rules Agents Break Most
Here is the short list, in plain language, before we go deeper.
- TPMO disclaimer — say (and display) that you do not offer every plan.
- Call recording — record marketing and enrollment calls in full, and keep them.
- Scope of Appointment (SOA) — document what the beneficiary agreed to discuss, before you meet.
- Permission to Contact + records — only contact people who consented, and retain proof.
Each of the four has a signature failure mode, and it is almost always a timing or a coverage problem rather than a knowledge problem:
| Rule | What it covers | Common mistake |
|---|---|---|
| TPMO disclaimer | Telling beneficiaries you represent a limited set of plans | Reading it late in the call, or omitting it on the website |
| Call recording | Recording sales/marketing/enrollment calls in entirety | Only recording the application, not the pitch |
| Scope of Appointment | Documenting agreed product types before a meeting | Signing the SOA at the start of the same appointment |
| Permission to Contact | Contacting only beneficiaries who opted in | Cold-calling aged leads with no consent trail |
1. TPMO disclaimer
The disclaimer is standardized content prescribed at 42 CFR §422.2267(e)(41). If you do not sell for every MA organization in the service area, the regulation gives you the exact sentence: “We do not offer every plan available in your area. Currently we represent [insert number of organizations] organizations which offer [insert number of plans] products in your area. Please contact Medicare.gov or 1-800-MEDICARE to get information on all of your options.” The same paragraph specifies where it has to appear:
- Verbal: “conveyed during sales calls prior to the discussion of any benefits” — not merely somewhere in the first minute (§422.2267(e)(41)(ii)).
- Web: “prominently displayed on TPMO websites” (§422.2267(e)(41)(iv)).
- Print/electronic: included in any marketing materials, and conveyed electronically over email, online chat, or other electronic means (§422.2267(e)(41)(iii), (v)).
There is a second version of the disclaimer that agents forget exists. If the TPMO does sell for all MA organizations in the service area, §422.2267(e)(41) prescribes different standardized text: “Currently we represent [insert number of organizations] organizations which offer [insert number of plans] products in your area. You can always contact Medicare.gov or 1-800-MEDICARE for help with plan choices.” Note that both versions still require you to state real counts of organizations and products for that service area, and that §422.2267(e)(41)(i) applies the requirement to any TPMO “that sells plans on behalf of more than one MA organization.” The Part D twin sits at §423.2267(e)(41), with the same two statements and “Part D sponsors” in place of “MA organizations.”
Where the disclaimer is and is not required is the part CMS has had to answer directly, and its answers are more specific than the regulation text alone:
| Situation | Does the TPMO disclaimer belong on it? | Source |
|---|---|---|
| A plan-produced document (for example a Summary of Benefits) used exactly as the plan provided it | No | CMS Agent Broker Marketing FAQ, Oct 19, 2022 |
| That same plan document after you alter it | Yes — “the disclaimer would need to appear” | CMS Agent Broker Marketing FAQ |
| A one-page insert added to an enrollment kit instead of the material itself | No — CMS says if you modified the plan document, “the disclaimer must appear on the actual material” | CMS Agent Broker Marketing FAQ |
| A social media post that meets the definition of marketing at §422.2260 | Yes — “the TPMO must include the disclaimer in the social media post” | CMS Agent Broker Marketing FAQ |
| Your own website | Yes — “prominently displayed on TPMO websites” | 42 CFR §422.2267(e)(41)(iv) |
| A sales call, before you describe any benefit | Yes — verbally, “prior to the discussion of any benefits” | 42 CFR §422.2267(e)(41)(ii) |
The wording has been revised between plan years, so confirm the current text against the regulation itself and CMS’s Managed Care Marketing guidance rather than reusing last season’s script. When we build Medicare landing pages, the disclaimer placement is a checklist item, not an afterthought. See how we handle Medicare agent marketing end to end, including compliant page structure.
2. Call recording
42 CFR §422.2274(g)(2)(ii) is explicit: “All marketing and sales calls, including the audio portion of calls conducted via web-based technology, must be recorded and retained in their entirety for a minimum period of 6 years. For the first 3 years of the retention period, records must be maintained in audio format. For years 4, 5, and 6, records may be maintained in either audio format or as complete and accurate transcript recordings.” The identical sentence appears for Part D sponsors at §423.2274(g)(2)(ii). The frequent error is recording only the application; the marketing portion has to be captured too — the part where you describe plans, qualify the person, and steer the decision.

The three clocks a carrier audit will ask about, in months. Source: eCFR, 42 CFR part 422 subpart V, §§ 422.2264 and 422.2274.
About “six years versus ten.” Six years is what §422.2274(g)(2)(ii) says. Ten years is not agent folklore, though — it comes from a different instrument. Asked whether recorded TPMO calls fall under the ten-year storage requirement in Chapter 11 of the Medicare Managed Care Manual, CMS answered: “It depends on the nature of the call. The CMS requirement to maintain certain records for ten years applies to all calls between beneficiaries and plans, including TPMOs, that pertain to the sales and enrollment processes.” CMS added that a call that starts as something else and turns into a sales call — “if the beneficiary begins asking about products” — has to be retained as well. Treat six years as the regulatory floor and ten as the number your carrier’s record-retention policy is likely built on.
Which calls, exactly? CMS’s FAQ answers the questions agents actually ask, and the answers are not intuitive:
| Question agents ask | CMS’s answer |
|---|---|
| Does it apply only to call centers? | “No. This requirement applies to all organizations and individuals that fall under the definition of TPMO” |
| Does it apply to captive agents? | “Yes. Captive agents fall under the definition of a TPMO” |
| Inbound as well as outbound? | “Yes” |
| Zoom and other virtual-presence platforms? | “Yes. Zoom calls and other calls using virtual presence technology … must be recorded” |
| In-person interactions? | “No. CMS does not require recording of in-person interactions” |
| What if the beneficiary refuses to be recorded? | “No. There are no exceptions to this requirement. If a beneficiary declines to be recorded, the call must end” |
| Are small agencies exempt? | “CMS is treating all agents and brokers the same. Smaller agents and brokers are not exempt from any requirement based on size” |
All seven answers come from the same CMS Agent Broker Marketing FAQ, October 19, 2022, which also dates the requirement: it “went into effect on October 1, 2022, and it applies to enrollments made for a January 1, 2023 effective date and beyond.”
If your telesales setup cannot record and archive full calls, that is a compliance gap and a sales-coaching gap at the same time. You cannot improve a script you never hear.
3. Scope of Appointment
Before an individual sales or marketing meeting, you document which product categories the beneficiary agreed to discuss (for example, MA-PD vs. PDP vs. supplements). 42 CFR §422.2264(c)(3)(i) states that “prior to the personal marketing appointment, the MA plan (or agent or broker, as applicable) must agree upon and record the Scope of Appointment with the beneficiary(ies),” and that it “must be in writing for in-person personal marketing appointments.” Agents and brokers carry the same duty directly under §422.2274(b)(3), which requires them to “secure and document a Scope of Appointment prior to a personal marketing appointment.” Two details agents get wrong: the current regulation text contains no 48-hour advance requirement — CMS’s contract-year 2027 final rule (91 FR 17384, published April 6, 2026, effective June 1, 2026) deleted it, so the rule is simply before the appointment — and an SOA (or business reply card, or request for information) is valid for 12 months from the beneficiary’s signature date under §422.2264(c)(3)(iii)(A). The classic violation is still collecting the SOA at the start of the appointment to check a box, which is not “prior to” anything.
One more line in that paragraph is worth reading closely, because it decides what you may say once the meeting starts. §422.2264(c)(3)(iii) bars marketing “any health care related product during a marketing appointment beyond the scope agreed upon by the beneficiary,” bars marketing additional health-related lines of business “without a separate Scope of Appointment,” and bars marketing “non-health related products, such as annuities” at all. An annuity conversation inside a Medicare appointment is not a scope problem you can fix with a broader form. For the operational deep dive on both the SOA and TPMO rules, see our focused guide to Scope of Appointment and TPMO compliance for Medicare agents.
4. Permission to Contact and records
You may only reach out to beneficiaries who gave Permission to Contact (PTC), and the permission is specific — consent to be called about Medicare Advantage is not blanket consent to call about everything, forever. The channel list is not a matter of interpretation: 42 CFR §422.2264(a) permits unsolicited contact “by conventional mail and other print media (for example, advertisements and direct mail) or email (provided every email contains an opt-out option),” and prohibits unsolicited door-to-door solicitation, approaching people in common areas, social-media direct messages, and “telephone solicitation (that is, cold calling), robocalls, text messages, or voicemail messages” — including calls based on referrals. Calls are not unsolicited if the beneficiary consented or initiated contact, such as returning a completed business reply card. Keep the proof.
§422.2264(a)(2)(iv) then names four specific calls agents make anyway: calls based on referrals; calls to former enrollees who have disenrolled or are in the process of disenrolling, “except to conduct disenrollment surveys for quality improvement purposes”; calls to beneficiaries who attended a sales event “unless the beneficiary gave express permission to be contacted”; and calls to prospective enrollees “to confirm receipt of mailed information.” That last one catches people who think a mail-follow-up call is a service call. Separately, §422.2264(b) does permit calls to current enrollees about plan business — including clients you wrote for auto or home coverage — provided you give every contacted beneficiary written notice at least once a year of their ability to opt out of those calls, and provided you are not using another line of business “as a means of generating leads for Medicare plans.”
This sits next to federal telemarketing law: the TCPA still governs how you dial and text consumers regardless of CMS. We cover that overlap in our guide to TCPA compliance when buying insurance leads. Note too that the FCC’s one-to-one consent rule never took effect — the Eleventh Circuit granted the petition for review and vacated it on January 24, 2025 in Insurance Marketing Coalition Ltd. v. FCC, No. 24-10277 — another example of why “verify the current rule” is not boilerplate.
Marketing or communications? The test that decides what needs CMS approval
Agents often assume “marketing material” means anything with their name on it. CMS uses a narrower, two-part test, and the answer changes whether a piece has to go through plan review at all.
§422.2260 states that “Marketing is a subset of communications.” A piece is marketing only when it meets both an intent standard and a content standard. Intent: it is meant to draw a beneficiary’s attention to a plan, influence a plan selection, or influence a decision to stay enrolled. Content: it addresses the plan’s benefits, benefits structure, premiums or cost sharing; measuring or ranking standards such as Star Ratings or plan comparisons; or rewards and incentives as defined under §422.134(a). Miss either half and the piece is a communication, not marketing.
CMS also warns that it will not take your word for the first half. In evaluating intent, “CMS will consider objective information including, but not limited to, the audience of the activity or material, other information communicated by the activity or material, timing, and other context of the activity or material and is not limited to the MA organization’s stated intent.” A blog post published on October 12 that lists plan benefits is not saved by a label at the bottom saying it is educational.
When something is marketing, it goes through review, and the clock depends on what kind of material it is. §422.2261(b) sets three paths, and §422.2274(c)(7) requires plans to “Submit agent or broker marketing materials to CMS through HPMS prior to use, following the requirements for marketing materials in this subpart”:
| Review path | How long before you can use it | Condition |
|---|---|---|
| CMS reviews and approves | Until CMS renders a disposition | The default path |
| Deemed approved, standard | 45 days after submission | CMS has not rendered a disposition |
| Deemed approved, CMS model or standardized content | 10 days after submission | Material uses CMS model or standardized marketing content under §422.2267(e) |
| File and Use | 5 days after submission | Material type is CMS-designated, and the organization certifies it meets §§422.2260–422.2267 |
The Health Plan Management System (HPMS) Marketing Module is, in the regulation’s words, “the primary system of record for the collection, review, and storage of materials that must be submitted for review.” Practically, that means your carrier or FMO is the door: you do not file in HPMS yourself unless you are a TPMO submitting shared materials with each MA organization’s prior review. Build the review clock into the calendar — a piece designed in mid-September for an October 1 launch is already late on the 45-day path. That timing constraint is one reason our Medicare marketing services start the season’s asset build in spring rather than autumn.
Who is allowed to market a Medicare plan at all
Before any of the four rules apply, there is a threshold question CMS answers in two places. §422.2274(b) requires agents and brokers who represent MA organizations to “Be licensed and appointed under State law (if required under applicable State law)”, to be “trained and tested annually” and “achieve an 85 percent or higher on all forms of testing”, and to secure and document an SOA before a personal marketing appointment. The regulation defines representation broadly — it “includes selling products … as well as outreach to existing or potential beneficiaries and answering or potentially answering questions from existing or potential beneficiaries.” Answering questions counts.
On the carrier’s side, §422.2272 requires plans to employ only state-licensed marketing representatives whom they have told the state they appointed, to report terminations to the state, and to “Establish and implement an oversight plan that monitors agent and broker activities, identifies non-compliance with CMS requirements, and reports non-compliance to CMS.” §422.2274(c)(3) requires plans to report to CMS “all enrollments made by unlicensed agents or brokers and for-cause terminations of agents or brokers.” §422.2274(c)(11) goes further: plans must comply with state requests for information about a licensed agent’s performance as part of a state investigation, and CMS “will establish and maintain a memorandum of understanding (MOU) to share compliance and oversight information with States that agree to the MOU.”
That is the enforcement architecture worth understanding. Your marketing is not audited by CMS directly in most cases. It is audited by the carrier that has a regulatory duty to monitor you, and the finding can travel to your state department of insurance.
The words CMS will not let you use
Plenty of otherwise-good Medicare copy fails on vocabulary. §422.2262(a)(1) opens with a flat prohibition — MA organizations “may not mislead, confuse, or provide materially inaccurate information to current or potential enrollees” — and then lists specifics that apply to everything marketed on the plan’s behalf.
These are the recurring copy failures, with the permitted alternative beside each:
| Not allowed | Regulation | What you can say instead |
|---|---|---|
| Claiming you are “recommended or endorsed by CMS, Medicare, the Secretary, or HHS” | §422.2262(a)(1)(ix) | That the organization “is approved to participate in Medicare programs or is contracted to administer Medicare benefits or both”, and the term “Medicare-approved” (§422.2262(a)(2)(i)–(ii)) |
| “Free” for a $0 premium, a premium or cost-sharing reduction, the low-income subsidy, or dual cost sharing | §422.2262(a)(1)(xi) | “Free” for mandatory, supplemental and preventative benefits provided at zero cost share for all enrollees (§422.2262(a)(2)(iii)) |
| Implying the plan “operates as a supplement to Medicare” | §422.2262(a)(1)(xii) | Name the plan type at the end of the plan name, as §422.2262(a)(1)(viii) requires |
| Stating or implying plans are only available to seniors | §422.2262(a)(1)(v) | Describe eligibility accurately for all Medicare beneficiaries |
| Targeting prospects by income or by health status | §422.2262(a)(1)(iii)–(iv) | The exception is a dual-eligible or other special needs plan |
| Using the Medicare name, the CMS logo, or the Medicare card image in a misleading way | §422.2262(a)(1)(xvii) | Medicare card imagery is “permitted only with authorization from CMS” |
Medicare.gov puts the same idea in beneficiary-facing language, telling people that agents may not “use inappropriate statements like their plan is ‘the best’ or ‘highest ranked’” and may not ask them “to give names and phone numbers or addresses so they can sell to your friends or family” (Medicare.gov, Marketing rules for health plans). That second item is worth pausing on: a referral request phrased as “who else do you know?” collides with both that guidance and the prohibition on referral-based cold calls at §422.2264(a)(2)(iv)(A). The compliant referral mechanic is to hand the client something to pass along and let the referred person contact you.
One more naming rule applies to every ad you place. §422.2263(b)(9) forbids marketing plans, benefits or costs unless the MA organization or its HPMS marketing name appears in the material — in 12-point font in print, and it “may not be in the form of a disclaimer or fine print”; read at the same pace as the phone number in radio and voice ads; and displayed throughout the whole spot, at a size equivalent to the phone number, in television, online and social ads.
Gifts, meals, cross-selling and other event mistakes
§422.2263(b) bans four things that agents still do at events. You may not “Provide cash or other monetary rebates as an inducement for enrollment or otherwise.” Gifts are allowed only where they are of nominal value “as governed by guidance published by the HHS OIG”, are offered to similarly situated beneficiaries “without regard to whether or not the beneficiary enrolls,” and are not cash or monetary rebates. Meals are simply out. The regulation’s third prohibition reads, in full: “Provide meals to potential enrollees regardless of value.” The phrase “regardless of value” is doing real work there. And you may not “Market non-health care related products to prospective enrollees during any MA sales activity or presentation,” which the regulation labels cross-selling. Medicare.gov states the gift ceiling in dollars for beneficiaries: plan representatives may not offer them “cash (or gifts worth more than $15) to join their plan”.
Three event types, three different rule sets, and mixing them up is a common finding. All three sit in §422.2264(c):
| Event type | You may | You may not |
|---|---|---|
| Educational event (§422.2264(c)(1)) | Distribute communications materials, answer beneficiary-initiated questions about MA plans, distribute business cards, and “Make available and receive beneficiary contact information, including Business Reply Cards and Scope of Appointment forms” | “conduct sales or marketing presentations or distribute or accept plan applications” |
| Marketing or sales event (§422.2264(c)(2)) | Provide marketing materials, distribute and accept applications, collect SOAs for future personal appointments, conduct marketing presentations | Require sign-in sheets or contact information “as a prerequisite for attending an event”; run health screenings or surveys used to target a subset of members; reuse raffle entries for anything but the raffle |
| Personal marketing appointment (§422.2264(c)(3)) | Provide materials, take applications, present, and review the beneficiary’s needs including health history, medications and financial concerns | Go beyond the agreed scope, add a health-related line without a separate SOA, or market non-health products such as annuities |
Two timing details inside that table changed on June 1, 2026 and are worth restating: SOA forms may now be made available at educational events, and a marketing event may directly follow an educational one provided attendees are told the educational event is ending and given “a sufficient opportunity to leave” before the marketing event begins. There is no longer a mandatory waiting period between the two.
Testimonials, endorsements and paid social posts
If you run video ads or post client praise, §422.2262(b) applies to you, and it reaches further than the word “testimonial” suggests. The rule covers television, radio, print, social and other ads, and it treats social reuse as an endorsement in its own terms: “In cases of social media, the use of a previous post, whether or not associated with or originated by the MA organization, is considered a product endorsement or testimonial.” Resharing a happy client’s post is an endorsement.
Four conditions attach. The speaker “must identify the MA organization’s product or company by name.” A Medicare beneficiary giving the endorsement “must have been an enrollee at the time the endorsement or testimonial was created.” The piece “must clearly state that the individual was paid for the endorsement or testimonial, if applicable.” And if an actor portrays a real or fictitious situation, the piece “must state that it is an actor portrayal.” Those disclosures are separate from, and additional to, the FTC endorsement rules that apply to every advertiser.
Where you may market inside a healthcare setting
Agents who work with clinics and pharmacies need §422.2266, which draws the line by room rather than by building. Marketing activities and materials “are not permitted in areas where care is being administered,” and the regulation names exam rooms, hospital patient rooms, treatment areas where patients interact with a provider and clinical team (including dialysis treatment facilities), and pharmacy counter areas. Marketing is permitted in common areas, and §422.2266(b) lists them: common entryways, vestibules, waiting rooms, hospital or nursing home cafeterias, and community, recreational or conference rooms.
The section also constrains what a provider may do on a plan’s behalf. During plan-initiated activities a provider may not accept or collect Scope of Appointment forms, may not accept enrollment applications, may not call or urge patients to enroll in a specific plan, may not mail marketing materials for the plan, and may not “Conduct health screenings as a marketing activity.” Provider-initiated activity is different and much broader — a doctor answering a patient’s question about a plan’s merits, including in an exam room, falls outside the definition of marketing entirely under §422.2266(c). If your growth plan depends on clinic referrals, that distinction is the whole design constraint.
Lead generation, data sharing and the consent CMS added in 2024
Two paragraphs of §422.2274(g) govern the lead economy directly, and they are newer than most agent checklists.
First, disclosure at the point of capture. A TPMO conducting lead-generating activities must “Disclose to the beneficiary that his or her information will be provided to a licensed agent for future contact” — verbally on the phone, in writing on paper, and electronically in email, chat or other messaging — and must “Disclose to the beneficiary that he or she is being transferred to a licensed agent who can enroll him or her into a new plan.” A form that captures a Medicare lead without that line on the page is missing a regulatory element, not a nicety.
Second, and larger: “Beginning October 1, 2024, personal beneficiary data collected by a TPMO for marketing or enrolling them into an MA plan may only be shared with another TPMO when prior express written consent is given by the beneficiary.” CMS specifies how that consent must be obtained — “through a clear and conspicuous disclosure that lists each entity receiving the data and allows the beneficiary to consent or reject to the sharing of their data with each individual TPMO.” Read that against the vacated FCC one-to-one rule discussed above: for Medicare Advantage and Part D leads, a per-entity written consent requirement already exists in CMS regulation, independent of anything the FCC does. Shared and resold Medicare leads are the practice this paragraph reaches directly.
Two related duties round out the paragraph: the TPMO must disclose to the MA organization “any subcontracted relationships used for marketing, lead generation, and enrollment”, and must report to plans monthly “any staff disciplinary actions or violations of any requirements that apply to the MA plan associated with beneficiary interaction to the plan.” If you sub-contract your ad buying or your call transfers, the carrier is entitled to know.
Using the word “Medicare” in your name, logo or URL
This one is not in part 422 at all, and agents miss it for that reason. Section 1140 of the Social Security Act, codified at 42 U.S.C. §1320b-10, prohibits using the words “Medicare,” “Centers for Medicare & Medicaid Services,” “Department of Health and Human Services,” the letters “CMS” or “HHS,” or “any other combination or variation of such words or letters,” and the agencies’ symbols and emblems, in an advertisement, solicitation, circular, pamphlet “or other communication (including any Internet or other electronic communication)” — the statutory test being that it is done “in a manner which such person knows or should know would convey, or in a manner which reasonably could be interpreted or construed as conveying, the false impression that such item is approved, endorsed, or authorized by” SSA, CMS or HHS, or that the person “has some connection with, or authorization from” them.
Read the whole clause before you panic or before you relax. The prohibition is not on the word; it is on using the word in a way that conveys a false impression of government approval or connection. That is a knowledge-based standard with an objective backstop, and it is why “licensed insurance agent specializing in Medicare plans” reads differently from a business name, logo or domain that suggests you are Medicare.
The penalties are the reason to take it seriously. The statute sets a civil money penalty “not to exceed” $5,000 per violation, or $25,000 “in the case of a violation consisting of a broadcast or telecast,” and it counts each piece of mail — and each dissemination, viewing or accessing of an electronic communication — as a separate violation. Those statutory figures are adjusted for inflation: the HHS penalty table at 45 CFR §102.3 lists the 2025 maximum adjusted penalty for 42 U.S.C. 1320b-10(b)(1) as $13,132, and $65,653 for the broadcast or telecast provision at (b)(2).
What changes every plan year (and why it matters)
CMS updates the MCMG most years, and carriers layer their own stricter requirements on top through the oversight they are required to perform on TPMOs. The most recent round landed on June 1, 2026, when the contract-year 2027 final rule took effect. It deleted the 48-hour SOA waiting period at §422.2264(c)(3)(i), dropped the prohibition on making Scope of Appointment forms available at educational events at §422.2264(c)(1)(ii)(D), and removed the 12-hour delay that used to separate an educational event from a marketing event held in the same location at §422.2264(c)(2)(i). Any checklist written before June 2026 gets all three wrong.
The practical takeaway:
- Re-read the current MCMG before each Annual Enrollment Period (AEP).
- Confirm your carrier/FMO’s interpretation — they often go beyond the CMS floor.
- Re-approve marketing materials annually; last year’s compliant flyer may not be this year’s.
If you want the marketing-strategy side of AEP rather than the rulebook, our Medicare AEP marketing playbook walks through campaign timing inside these constraints, and the cross-line open enrollment marketing calendar covers the same October-to-December run for agents who also write ACA or group business.
A pre-AEP self-audit you can run in an afternoon
Each item below maps to a specific paragraph above, so a failed check tells you which regulation to re-read rather than leaving you with a vague worry.
- Website — TPMO disclaimer prominently displayed, with real organization and product counts for your service area (§422.2267(e)(41)(iv)); no CMS logo or Medicare card image; business name and domain reviewed against 42 U.S.C. §1320b-10.
- Lead forms — the disclosure that the beneficiary’s “information will be provided to a licensed agent for future contact” is on the page, not in a linked policy (§422.2274(g)(3)(i)).
- Lead vendors — for every source, written proof of consent, and per-entity written consent on file if the data passed through another TPMO after October 1, 2024 (§422.2274(g)(4)).
- Phone system — records the whole call, inbound and outbound, including virtual meetings, and the archive is retrievable for at least six years (§422.2274(g)(2)(ii)).
- Scripts — the disclaimer lands before any benefit is described; the SOA is agreed and recorded before the appointment, in writing if in person.
- Ad copy — no “free” applied to a $0 premium, no “best” or “highest ranked,” carrier HPMS name present at the required size and pace (§422.2262(a)(1); §422.2263(b)(9)).
- Events — educational and marketing events are separately advertised and separately run; no sign-in sheet is required to attend a sales event; no meals.
- Review calendar — anything new that meets the marketing definition is submitted early enough to clear the 45-day, 10-day or 5-day path before it goes live.
If two or more of those come back uncertain, fix the funnel before you buy another lead. That is the sequencing behind our Medicare marketing pricing — the build comes before the spend, and the landing pages we build carry the disclaimer and the consent language as part of the template rather than as an afterthought.
3 Ways Compliance Becomes a Marketing Asset
Here is the operator’s view. Agents who treat CMS rules as friction tend to cut corners and end up in secret-shopper reports. Agents who build the rules into their process — recorded calls, clean SOAs, disclaimers in the right place — generate something valuable: a paper trail that protects commissions and a call library that makes coaching real.
We run our own final-expense and senior-market lead operation, and a chunk of our close rate exists because full-call recording lets us tune scripts. Compliance and conversion are not enemies — the rules are really a filter on channel choice, which is why we look at the Medicare client acquisition channels ranked by CMS risk before committing budget to any of them.
Three ways the rules shape good marketing:
- Landing pages carry the disclaimer above the fold and capture PTC explicitly, not buried in fine print.
- Lead sources are documented so consent is provable when a carrier audits.
- Scripts open with the disclaimer and the SOA logic baked in.
Because §422.2264(a) closes cold calling, texting and social DMs to unsolicited Medicare outreach, the channels that remain are mail, opt-out email, and everything inbound — which is why a Medicare agent website that ranks and converts does more work in this line than in almost any other, and why the age-in audience covered by our turning-65 marketing system is the one segment you can market to year-round without touching a prohibited lane.
If you are not sure whether your current funnel would survive a carrier audit, that is exactly what a free marketing audit is for — we look at your pages, consent flow, and recording setup with fresh eyes. You can also compare how we approach broader insurance marketing compliance across lines, or read the full breakdown of our Medicare lead and marketing services if you want help implementing this. For the seasonal rules that trip agents up most, see Medicare OEP marketing rules for agents.
The one-line summary
Record your calls in full, read and display the TPMO disclaimer, capture the Scope of Appointment before you meet, only contact people who opted in, keep your records — and re-verify all of it against current CMS guidance every plan year, because the rules move and your license is the one on the line.
This article is marketing guidance, not legal or compliance advice. CMS rules and the MCMG are updated frequently; confirm specifics with official CMS sources, your carrier, and your upline before acting.
- Scope of Appointment & TPMO Compliance: The Agent's Operational Guide
A focused guide to Scope of Appointment and TPMO compliance for Medicare agents: SOA timing, CMS-10260, the disclaimer, call recording, and third-party rules.
- Insurance Marketing Compliance for Agents: What Actually Trips People Up
Insurance marketing compliance for agents: TCPA consent, CAN-SPAM, FTC endorsement rules, state advertising rules and the CMS Medicare disclaimers.
- TCPA Consent for Insurance Leads: What to Demand Before You Buy
TCPA compliance for insurance agents buying leads: consent rules, the vacated FCC one-to-one rule, record-keeping, and what to demand from vendors.