Scope of Appointment & TPMO Compliance: The Agent's Operational Guide
Scope of Appointment and TPMO compliance are two process rules in 42 CFR part 422, subpart V. Agree and record the SOA before any personal marketing appointment, in writing if it is in person, state the TPMO disclaimer before you discuss any benefits, and record and retain marketing and sales calls in their entirety for at least six years.
Two mechanics are where a Medicare funnel review starts: the Scope of Appointment collected at the wrong time, and the TPMO disclaimer read at the wrong time (or not at all). Neither is about whether you sold a good plan. Both are about process. This guide zooms in on those two rules and the third-party obligations wrapped around them.
It is a marketing-operations summary, not legal advice. You are the licensed party; we run marketing. And the rules below move almost every plan year, so treat this as a map to verify against current CMS guidance, not a permanent answer. For the wider rulebook, start with our plain-English walkthrough of the CMS Medicare marketing rules for agents — this article is the operational deep dive on those two rules.
Scope of Appointment: the timing is the whole game
The Scope of Appointment (SOA) documents which product categories a beneficiary agreed to discuss before you meet. The categories matter: agreeing to talk about Medicare Advantage is not agreement to talk about a standalone drug plan or a supplement.
The rule itself is short. 42 CFR §422.2264(c)(3)(i): “Prior to the personal marketing appointment, the MA plan (or agent or broker, as applicable) must agree upon and record the Scope of Appointment with the beneficiary(ies). The Scope of Appointment must be in writing for in-person personal marketing appointments.” The obligation lands on you personally as well — §422.2274(b)(3) requires agents and brokers to “secure and document a Scope of Appointment prior to a personal marketing appointment.”
About the “48-hour rule.” It is still widely repeated, and it is not in the regulation text today. CMS reinstated the 48-hour window in its April 2023 final rule, then deleted it in the contract-year 2027 final rule (91 FR 17384), effective June 1, 2026. The current §422.2264(c)(3) requires the SOA prior to the appointment and says nothing about a 48-hour cooling-off window. Treat 48 hours as a defensible internal standard — many carriers and FMOs still enforce it — not as the federal floor. What the regulation does put a number on is validity: an SOA, business reply card, or request for additional information is “valid for 12 months following the date of beneficiary’s signature date” (§422.2264(c)(3)(iii)(A)).
The four SOA elements to get right every time
- Product categories — capture exactly what the beneficiary agreed to discuss (MA-PD, PDP, Med Supp), and nothing you were not authorized to raise. Adding a category later needs a separate SOA (§422.2264(c)(3)(iii)(B)).
- Timing — recorded before the appointment, with the date/time provable. Same-meeting signatures are the classic violation.
- Beneficiary agreement — in writing for in-person appointments; agreed and recorded either way.
- Retention — archived and retrievable. Marketing and sales calls carry a hard 6-year minimum (below); an SOA’s own 12-month validity window is a separate clock.
What counts as a personal marketing appointment
The SOA duty attaches to a defined event, and the contract-year 2027 rule rewrote that definition. §422.2264(c)(3) now reads: “Personal marketing appointments are those appointments that are tailored to an individual or small group (for example, a married couple) for purposes of discussing marketing topics. Personal marketing appointments are not defined by the location.”
Three consequences fall out of that one paragraph.
- Channel is irrelevant. Telephonic and virtual appointments are personal marketing appointments. Location changes one thing, the format of the record: in writing for in-person meetings, and for everything else CMS’s May 26, 2026 SOA FAQ memorandum (copy hosted by Hall Render) quotes the final rule — “an audio or audio-visual recording or an electronic record would suffice as an SOA record for a personal marketing appointment that does not occur in person.”
- “Small group” is narrow. Hall Render’s June 1, 2026 analysis of the rule reports that CMS describes a small group as “a limited number of people, generally related or living in the same household,” and that meetings with unrelated prospective beneficiaries in a home or public space — the firm’s examples are a book club at a house or a session at a library — would require a separate SOA for each individual.
- Who booked it does not matter. The same analysis notes that in the contract-year 2027 proposed rule CMS emphasized the SOA is required regardless of whether the appointment was initiated by the plan, the agent or broker, or the beneficiary. The old text carried two carve-outs from the 48-hour clock, including one for beneficiary-initiated walk-ins; the current paragraph carries no exceptions at all.
That last point is the one to write into your intake script. An inbound caller who wants to talk about plans today is still a personal marketing appointment, and the SOA still has to exist before the marketing conversation starts.
What changed on June 1, 2026, and what your checklist has to catch up on
Two waiting periods, one prohibition, and one definition moved at once, which is why compliance documents written before mid-2026 are unreliable on this topic. The comparison below is the eCFR’s own text: the version in effect on May 1, 2026 against the current version.
The four edits below are the whole delta between last season’s SOA checklist and this one.
| Provision | Text in effect May 1, 2026 | Current text | What it changes |
|---|---|---|---|
| §422.2264(c)(3)(i) | “At least 48 hours prior to the scheduled personal marketing” — with exceptions for SOAs completed in the last four days of a valid election period and for beneficiary-initiated walk-ins | “Prior to the personal marketing appointment” — no exceptions listed | Same-day SOAs are permitted by the federal text; carrier standards may still be stricter |
| §422.2264(c)(1)(ii)(D) | Educational events could receive contact information “including Business Reply Cards, but not including Scope of Appointment forms” | Educational events may receive contact information “including Business Reply Cards and Scope of Appointment forms” | A seminar can now book the follow-up appointment properly on the spot |
| §422.2264(c)(2)(i) | “Marketing events are prohibited from taking place within 12 hours of an educational event, in the same location” | A marketing event that directly follows an educational event requires notice that the educational event is ending and “a sufficient opportunity to leave” | The wait is gone; a scripted break announcement replaces it |
| §422.2264(c)(3) | Appointments “tailored to an individual or small group (for example, a married couple)” | The same phrase plus “for purposes of discussing marketing topics” | The trigger is the marketing content of the meeting, not the setting |
Both waiting periods came out of the same section. Source: eCFR, 42 CFR 422.2264, current text compared against the text in effect May 1, 2026.
One date to keep straight: the rule was published April 6, 2026 and the eCFR carries the amendment, but CMS’s FAQ memorandum states the new SOA rules “are applicable for all CY 2027 marketing and communications, beginning October 1, 2026.” Hall Render also notes CMS revised §422.2274(b)(3) in the same rule so the agent-facing obligation and the plan-facing obligation use matching language.
Does CMS require form CMS-10260?
The regulation resolves less of this than agents expect. Neither §422.2264(c)(3) nor §422.2274(b)(3) names a form number or prescribes a template. Hall Render’s read is direct: “Unlike other Medicare Advantage requirements, CMS does not provide a sample SOA form; however, CMS does provide guidance on what must be included in a valid SOA” — the firm lists product types (checkboxes are acceptable), the date of the appointment, and beneficiary contact information.
CMS-10260 is real, but it labels an information collection rather than a mandated agent template. Under the Paperwork Reduction Act it is catalogued at reginfo.gov as “Medicare Advantage and Prescription Drug Program: Final Marketing Provisions CFR 422.111(a)(3) and 423.128(a)(3) (CMS-10260),” OMB control number 0938-1051, approved through July 31, 2029. That is a reporting-burden approval, not a template CMS hands agents.
Practical translation: use the SOA your carrier or FMO gives you, keep the elements above intact, and do not build a bespoke form to save a field. Published agent guidance disagrees on this point — AgencyBloc’s SOA guide quotes NABIP for the position that “only CMS approved SOA forms can be used. Agents should not create and use their own form” — so the safe operating rule is your upline’s form, not your own.
On signatures, CMS closed the ambiguity itself. The FAQ memorandum states the in-writing requirement “does not refer to an actual wet signature on paper,” because the E-Sign Act of 2000 established that electronic signatures and records carry the same legal standing as paper documents. An e-signature workflow is compliant and it timestamps the thing the rule actually cares about.
The 12-month clock, and when one SOA carries forward
§422.2264(c)(3)(iii)(A) makes the SOA, business reply card, or request for additional information “valid for 12 months following the date of beneficiary’s signature date or the date of the beneficiary’s initial request for information.” Three follow-on questions come up constantly, and the CMS FAQ memorandum answers all three.
- Does the format lock you in? No. CMS states the 12-month validity applies “regardless of whether the personal marketing appointments held during the 12-month period occur in-person or otherwise, as long as the scope of products discussed and documented in the SOA remains the same.” A recorded telephonic SOA can support an in-person appointment later that year.
- Does a new plan year need a new SOA? Only if the SOA named a year. CMS quotes the final rule’s example — “if there is an SOA to discuss contract year 2026 plans, then a new SOA would be required to discuss contract year 2027 plans” — then clarifies that an SOA identifying a product line without referencing a plan year does not need to be replaced for a different plan year inside the 12 months, and that CMS does not require the SOA to include the plan year at all.
- Can you pre-collect before AEP opens? Yes. Marketing prospective plan year offerings is permitted on and not before October 1 under §422.2263(a), but CMS states plans and agents “may prepare for the upcoming marketing season before October 1 by collecting SOAs that cover upcoming plan year offerings,” provided the substantive marketing discussion happens on or after October 1.
That third answer has a direct campaign implication: the SOA is a September asset, not an October one. Building the pre-season consent list is one of the few AEP moves that is entirely inside the rules, and it belongs in the timeline covered in our Medicare AEP marketing playbook.
Where you may and may not collect an SOA
The event rules and the health-care-setting rules answer this, and they are more permissive in some places and stricter in others than agents assume.
The regulation names the settings explicitly, so this table is a lookup rather than an interpretation.
| Setting | SOA collection | Citation |
|---|---|---|
| Educational event | Permitted — SOA forms may be made available and received | §422.2264(c)(1)(ii)(D) |
| Marketing or sales event | Permitted, for future personal marketing appointments | §422.2264(c)(2)(ii)(C) |
| MA organization activity in a health care setting | Permitted, in common areas only | §422.2266(b), §422.2266(e)(1) |
| Areas where care is administered — exam rooms, hospital patient rooms, treatment areas, pharmacy counter areas | Marketing activities and materials are not permitted there at all | §422.2266(a) |
| Plan-initiated provider activity | Prohibited — the provider may not accept or collect SOA forms | §422.2266(d)(1)(i) |
| I-SNP social workers in a long-term care facility | Prohibited — they may not accept or collect an SOA or enrollment form | §422.2266(f)(3) |
The common-area list in §422.2266(b) is worth reading before you plan a clinic partnership: common entryways, vestibules, waiting rooms, hospital or nursing home cafeterias, and community, recreational, or conference rooms. A table in a waiting room is inside the rules; the same table moved down the hall into a treatment area is not.
What an SOA does not authorize once you are in the room
The SOA is a boundary, not a license. §422.2264(c)(3)(ii) lists what you may do at a personal marketing appointment: provide marketing materials, distribute and accept plan applications, conduct marketing presentations, and review the beneficiary’s individual needs “including, but not limited to, health care needs and history, commonly used medications, and financial concerns.”
The prohibitions in §422.2264(c)(3)(iii) are the part that catches people:
- No marketing of any health care related product beyond the agreed, documented scope.
- No marketing of additional health related lines of plan business without a separate SOA identifying them.
- No marketing of “non-health related products, such as annuities.”
That third bullet is a marketing-architecture problem, not just a script problem. If your book runs on senior cross-sell, the annuity or final-expense conversation needs its own entry point, its own consent, and its own follow-up sequence rather than a bolt-on at the end of a Medicare appointment. We keep those tracks separate for exactly this reason, which is how the funnel logic in our guide to winning annuity clients through marketing is structured.
TPMO: are you the “third party”? Almost certainly
CMS regulates most Medicare marketing through the Third-Party Marketing Organization (TPMO) category. The definition at §422.2260 is deliberately broad: “organizations and individuals, including independent agents and brokers, who are compensated to perform lead generation, marketing, sales, and enrollment related functions as a part of the chain of enrollment.” Solo agents, agencies, FMOs, and lead vendors all qualify. You cannot opt out by calling yourself “just an agent.”
TPMO status is what triggers the disclaimer and the recording obligation:
- Disclaimer — standardized content set out at 42 CFR §422.2267(e)(41): “We do not offer every plan available in your area. Currently we represent [insert number of organizations] organizations which offer [insert number of plans] products in your area. Please contact Medicare.gov or 1-800-MEDICARE to get information on all of your options.” The regulation says it must be “verbally conveyed during sales calls prior to the discussion of any benefits” — a stricter trigger than the “first minute of the call” shorthand agents still repeat — plus conveyed electronically in email or chat, “prominently displayed on TPMO websites,” and included in any marketing materials.
- Recording — §422.2274(g)(2)(ii): “All marketing and sales calls, including the audio portion of calls conducted via web-based technology, must be recorded and retained in their entirety for a minimum period of 6 years,” audio-only for the first 3 years and audio or complete transcripts for years 4 through 6. This sits in the list of terms a plan’s contract with a TPMO must guarantee, which is why carriers ask to see your recording setup. The gap to check is the marketing portion of the call, not the application.
The second disclaimer, the one nobody quotes
§422.2267(e)(41) contains two versions. The one quoted above is the first. If the TPMO does sell for all MA organizations in the service area, the required statement is: “Currently we represent [insert number of organizations] organizations which offer [insert number of plans] products in your area. You can always contact Medicare.gov or 1-800-MEDICARE for help with plan choices.” The obligation to use either version attaches, per (e)(41)(i), to “any TPMO … that sells plans on behalf of more than one MA organization.”
Two operational notes follow. The bracketed counts are yours to maintain, and they change whenever you add or drop a carrier appointment — so the disclaimer on your website is a maintained field, not static copy. And (e)(41)(iv) says “prominently displayed,” which is a placement standard a footer link does not meet on a phone. When we build insurance landing pages, disclaimer placement is set at the template level so a new page cannot ship without it.
The TPMO obligations that are not the disclaimer
§422.2274(g) is where the rest of the third-party regime lives, and it is worth reading in full. The contract between a TPMO and a plan (or a plan’s FDR) must ensure the TPMO discloses “any subcontracted relationships used for marketing, lead generation, and enrollment,” records and retains calls as above, “reports to plans monthly any staff disciplinary actions or violations of any requirements that apply to the MA plan associated with beneficiary interaction to the plan,” and uses the required disclaimer.
Two more paragraphs bear directly on how leads are generated and traded:
- Lead-generation disclosures, §422.2274(g)(3). A TPMO conducting lead generation must disclose to the beneficiary that their information “will be provided to a licensed agent for future contact” — verbally on the phone, in writing on paper, electronically in email or chat — and must disclose that the beneficiary “is being transferred to a licensed agent who can enroll him or her into a new plan.” Those are two separate disclosures, and a lead form that omits the first is a compliance defect in the form itself.
- Data sharing between TPMOs, §422.2274(g)(4). Since October 1, 2024, beneficiary data collected by a TPMO for MA marketing or enrollment “may only be shared with another TPMO when prior express written consent is given by the beneficiary,” obtained “through a clear and conspicuous disclosure that lists each entity receiving the data and allows the beneficiary to consent or reject to the sharing of their data with each individual TPMO.” A generic “our marketing partners” checkbox does not describe that mechanism.
Referral programs have a ceiling too. Under §422.2274(f), a referral payment “may not exceed $100 for a referral into an MA or MA-PD plan and $25 for a referral into a PDP plan.” That is a design constraint on any client-referral incentive you advertise.
Finally, the carrier is required to watch. §422.2274(c)(9)(ii) obligates MA organizations to establish and maintain a system for confirming that “agents and brokers appropriately complete Scope of Appointment records for all personal marketing appointments (including telephonic and walk-in).” That clause is why SOA records get pulled at all. The same section also requires annual training and testing with a passing score of “85 percent or higher on all forms of testing” (§422.2274(b)(2)), and requires plans to submit agent and broker marketing materials to CMS through HPMS prior to use (§422.2274(c)(7)) — worth knowing before you assume a piece of creative can go live the week you designed it.
SOA vs TPMO disclaimer: two rules, two failure modes
| Requirement | What it documents | Timing | Failure mode to check |
|---|---|---|---|
| Scope of Appointment | Product types the beneficiary agreed to discuss | Agreed and recorded before the appointment; in writing if in person (§422.2264(c)(3)(i)) | Signed at the start of the same meeting |
| TPMO disclaimer | That you represent a limited set of plans | Verbally before any benefits are discussed; displayed on web/materials (§422.2267(e)(41)) | Read late, or omitted on the website |
| Call recording | Full marketing + sales conversation | Recorded live, retained in entirety (§422.2274(g)(2)(ii)) | Only the application is recorded |
| Retention | Call audio archive | Minimum 6 years — audio for years 1-3, audio or transcript for years 4-6 | Records not retrievable on carrier audit |
Retention: six years, twelve months, and where the ten-year number comes from
Three different clocks get blurred together in this question, and only one of them belongs to the SOA.
Each clock below comes from a different section of part 422, which is why they do not reconcile.
| Clock | Length | What it actually governs | Citation |
|---|---|---|---|
| Marketing and sales call recordings | 6 years minimum | Audio format for years 1-3; audio or complete transcripts for years 4-6 | §422.2274(g)(2)(ii) |
| SOA validity | 12 months | How long the beneficiary’s agreement stays usable, from the signature or initial request date | §422.2264(c)(3)(iii)(A) |
| MA organization books and records | 10 years | The plan’s own “books, records, documents, and other evidence of accounting procedures and practices”, including marketing agreements | §422.504(d) |
The 10-year figure that circulates in agent guidance — AgencyBloc’s guide states SOA forms must be kept “for a minimum of 10 years” regardless of whether a plan was sold — is not a number the SOA rule states. Part 422’s 10-year clock is the contract record-retention provision at §422.504(d), which binds the MA organization. What that means for you in practice: your obligation is whatever your carrier and FMO contracts impose, and they can and do reach past the federal marketing floor. Get the number from your upline in writing, and store to the longest one. Choosing an upline whose compliance posture you can live with is part of the decision covered in our guide to choosing an FMO.
The third-party layer: carrier oversight of your vendors
TPMO rules do not stop at your own conduct. Carriers are required to oversee the TPMOs in their distribution chain, which means the lead vendors and downlines you work with pull you into their compliance posture too. If you buy leads, the consent trail behind those leads is part of your exposure. This overlaps with federal telemarketing law — the TCPA still governs how you dial and text regardless of CMS — which we cover in TCPA compliance when buying insurance leads.
Practical implications:
- Document where every Medicare lead came from and what the beneficiary consented to.
- Keep the disclaimer and SOA logic baked into scripts, not bolted on.
- Re-approve vendor consent language annually; carriers increasingly ask for it.
- Ask any lead vendor to show you the §422.2274(g)(3) disclosures as the beneficiary saw them, and the §422.2274(g)(4) per-entity consent screen if the lead was shared.
Building SOA and TPMO into the funnel, not around it
Agents who treat these as friction cut corners and end up in complaint reports. Agents who build them into the process get something valuable back: a clean paper trail that protects commissions, plus a full-call library that makes coaching real. When we build compliant Medicare marketing systems, disclaimer placement above the fold and explicit consent capture are checklist items, not afterthoughts. The same lens decides which channels are worth running at all, which is how we sort how Medicare agents get clients compliantly before any budget is committed.
A few ways the rules shape good marketing:
- Landing pages carry the TPMO disclaimer prominently and capture permission explicitly.
- Scripts open with the disclaimer and route the SOA before any product discussion.
- CRM stores the signed SOA next to the call recording, so an audit is a five-minute retrieval, not a scramble.
- Forms name the licensed agent who will follow up, because §422.2274(g)(3)(i) requires that disclosure at the point of collection.
The CRM point deserves a field list rather than a slogan. The record you want to be able to pull in one query is: product categories agreed, whether the SOA names a plan year, signature or initial-request date, appointment date, channel, the SOA artifact itself (form, recording, or electronic record), and the full call audio. Those seven fields cover what §422.2274(c)(9)(ii) obliges a carrier to confirm about you, which is the shape an audit request tends to take — our comparison of the best CRM options for insurance agents covers which systems hold them without a workaround.
A pre-season audit you can run in an afternoon
- Open your website on a phone. Is the disclaimer visible without scrolling to the footer, and do the organization and plan counts match your current appointments? (§422.2267(e)(41)(iv))
- Pull three recent recordings at random. Does the disclaimer land before the first benefit is described, not after the rapport-building?
- Pick one enrollment from last season and try to retrieve the SOA and the full call audio in under five minutes.
- Check whether your SOA template names a plan year. If it does, plan on re-collecting for the new contract year.
- Read your lead vendor’s opt-in page as a beneficiary would. Are both §422.2274(g)(3) disclosures there?
- Confirm your recording covers the marketing conversation, not just the application walkthrough.
- Ask your FMO, in writing, for its SOA retention standard and its position on same-day SOAs now that the 48-hour text is gone.
- Diary the October 1 line: SOAs for next year’s products can be collected earlier, but the marketing discussion waits.
If you would rather have someone else run that pass, that is exactly what a free marketing audit is for; if you already know you want the build, our published pricing starts at $2,500 a month and the Medicare agent website page shows what the compliant version looks like. For seasonal context, pair this with our Medicare AEP marketing playbook and the Medicare OEP marketing rules for agents, and for the January-to-March cohort work, the turning-65 marketing system.
The one-line summary
Agree and record the SOA before you meet — in writing if it is in person — state the TPMO disclaimer before you discuss any benefits, record the whole call, and keep marketing and sales call audio for at least six years. Then re-verify all of it against the current regulation text every plan year, because these rules move and your license is the one on the line.
This article is marketing guidance, not legal or compliance advice. CMS rules, SOA timing, and TPMO obligations are updated frequently; confirm specifics with official CMS sources, your carrier, and your upline before acting.
- CMS Medicare Marketing Rules for Agents: A Plain-English Walkthrough
The 4 CMS Medicare marketing rules agents break most, in plain English: the TPMO disclaimer, call recording, Scope of Appointment, and Permission to Contact.
- Insurance Marketing Compliance for Agents: What Actually Trips People Up
Insurance marketing compliance for agents: TCPA consent, CAN-SPAM, FTC endorsement rules, state advertising rules and the CMS Medicare disclaimers.
- TCPA Consent for Insurance Leads: What to Demand Before You Buy
TCPA compliance for insurance agents buying leads: consent rules, the vacated FCC one-to-one rule, record-keeping, and what to demand from vendors.