CMS Broker Consent Rules: An Agent Guide for 2026 OE

moderator · 11/13/2026 · 17 min read · 3,772 words

Prepare for 2026 Open Enrollment with our guide on CMS broker consent. Learn requirements for consumer authorization, NPN verification, and EDE transitions.

Open Enrollment preparation is more than reviewing carrier updates and staffing calendars. For agents, brokers, agencies, and agency owners, it also means reviewing how consumer authorization, Marketplace access, identity verification, and application records are handled from the first contact through submission and ongoing maintenance.

CMS broker consent requirements have received increased attention because unauthorized application access, enrollment changes, and plan switches can harm consumers and expose agents to audits, complaints, corrective action, or loss of Marketplace access. The practical takeaway is straightforward: before accessing, updating, or assisting with a Marketplace application, your business should be able to show who authorized the work, what the authorization covered, when it was given, and which agent or agency acted.

This guide explains the operational principles agents should review before 2026 Open Enrollment. Requirements, system controls, forms, pathway availability, and implementation details can change. Always consult current CMS and Marketplace materials, carrier requirements, state licensing rules, and your attorney or compliance professional before changing your workflow.

2026 Direct Enrollment Transition: Classic DE and EDE

Current CMS guidance says Classic Direct Enrollment, or Classic DE, is discontinued beginning November 1, 2026, with a limited one-time exception allowing previously approved Classic DE entities to continue through October 31, 2026 while transitioning to Enhanced Direct Enrollment, or EDE. This transition applies to web-brokers and Direct Enrollment entities participating in the applicable Federal Platform pathways. It does not automatically apply to every licensed agent or agency in every workflow.

Agents may use HealthCare.gov, the Marketplace Call Center, an approved web-broker or EDE environment, issuer pathways, or other authorized routes that apply to their role and state. Agents should follow current CMS instructions and should not assume all agents must use EDE. An agent using an approved EDE entity as a downstream agent or broker is not necessarily the EDE entity.

For current official guidance, review the CMS Health Insurance Exchange Guidelines, the CMS Enhanced Direct Enrollment partners and resources page, and the CMS FAQ regarding decommissioning Classic DE. If CMS changes the dates, role definitions, or scope of the transition, the CMS source documents control.

Consumer consent is not simply a courtesy call or a checkbox in a customer relationship management system. It is part of the record showing that an agent or broker was authorized to access confidential information and assist with Marketplace-related activity.

A strong consent process helps establish:

The consumer knowingly authorized a specific agent, broker, web-broker, or agency.
The agent’s work stayed within an approved purpose.
The consumer had an opportunity to review application information before submission.
The agency can identify which producer or staff member handled the account.
The business can respond efficiently if CMS, a carrier, a regulator, or a consumer requests documentation.

CMS has published a Model Consent Form for Marketplace agents, brokers, web-brokers, and agencies. The form is informational and may be tailored to a business model, but agencies should not assume that every internal form automatically satisfies current requirements.

Obtain and document Marketplace consent before the agent, broker, web-broker, or agency provides the applicable assistance in any of these situations:

Searching for an existing Marketplace application.
Assisting with an application for advance payments of the premium tax credit, or APTC, or cost-sharing reductions, or CSR.
Completing or assisting with enrollment in a Marketplace Qualified Health Plan, or QHP.
Providing ongoing account maintenance or responding to Marketplace or Call Center inquiries that involve the consumer’s application or enrollment, including authorized Marketplace Call Center changes.

For each trigger, the agent should follow the applicable CMS pathway and document consent before the activity occurs.

Lead-generation, TCPA, marketing, email, text, or permission-to-contact consent does not satisfy Marketplace agent or broker consent. Those contact permissions do not authorize account access, application changes, APTC or CSR assistance, QHP enrollment, or Marketplace Call Center activity.

The exact process may differ depending on whether you use HealthCare.gov, an approved EDE environment, an issuer-supported workflow, or a Marketplace Call Center. Your procedure should identify the approved pathway being used and the documentation required for that pathway.

A consumer saying “yes” during an informal conversation may not create a sufficient record. The consent record should clearly connect the consumer to the authorization and include the required details.

At a minimum, review whether your documentation captures:

The consumer’s name or the name of an authorized representative.
The name of the individual agent, broker, web-broker, or agency receiving consent.
The agent’s National Producer Number, or NPN, where applicable.
The purpose and scope of the authorization.
The date consent was provided.
The duration of consent.
How the consumer may revoke or modify consent.
The consumer’s affirmative action, such as a signature, electronic confirmation, email response, or recorded verbal authorization.

The CMS Model Consent Form includes examples for written consent, application review confirmation, and verbal scripts. If your agency uses an alternative form or electronic system, have a qualified compliance professional review it against current requirements.

Three different identity and authorization controls

These controls are related, but one does not substitute for another.

Agent authentication

Agents, brokers, and support staff should use individual credentials for Marketplace systems and other platforms that contain consumer information. Shared usernames, shared passwords, or shared multifactor authentication devices make it difficult to determine who accessed an account, when the access occurred, and whether the activity was authorized.

Your agency’s controls should address:

Unique usernames for each agent and permitted staff member.
Strong passwords and multifactor authentication where available.
Prompt removal of access when an employee leaves.
Periodic review of active users and permissions.
Secure storage of recovery codes and authentication devices.
Prohibition on sharing CMS portal credentials, passwords, or MFA methods.
Documented procedures for suspected account compromise.

Support staff may access PII only when the agency’s documented consent scope, role-based permissions, CMS rules, and applicable law permit it. Support staff must use individual credentials and must not use the writing agent’s credentials.

The CMS 2026 registration and training page and the CMS 2026 New Agents and Brokers Guide provide current information about Marketplace registration, training, and access requirements. Since CMS systems and registration windows can change, agents should verify current status directly through official CMS resources rather than relying on an old calendar or saved email.

Consumer or authorized-representative verification

Consumer or authorized-representative verification should be handled through the applicable Marketplace process. Depending on the transaction, this may involve the consumer participating in a call, completing a consumer-facing pathway, answering verification questions, or providing information through a designated system. If someone is acting for another person, document the representative’s authority according to applicable requirements.

Do not treat possession of a lead record, telephone number, email address, or consent-to-contact record as proof that you are authorized to access a consumer’s Marketplace record. A marketing lead and a Marketplace authorization are different records serving different purposes.

Similarly, a consumer’s consent to receive a call from an agent does not automatically authorize the agent to search for an existing Marketplace application, assist with APTC or CSR applications, complete QHP enrollment, perform account maintenance, or submit changes through the Marketplace.

EDE-specific identity proofing and agent/broker authorization

Approved EDE environments may impose additional identity proofing and agent or broker authorization controls based on the relevant EDE entity and downstream relationship. Those are EDE-specific controls within an approved EDE environment. They are not a universal requirement that every licensed agent or agency build, operate, or directly manage an EDE platform.

Agents who work through an approved EDE entity should follow the current rules, technical controls, and authorization structure that apply to that EDE relationship. Agents who are not operating as the EDE entity should not describe themselves as the EDE entity merely because they use that approved environment.

Call Center and enrollment association controls

CMS access controls may require a consumer Call Center three-way call or a consumer self-service pathway when an agent is not already associated with an enrollment. The operational lesson is important: documented consent alone does not override system-level access controls. If you are not already associated with an enrollment, follow the current Marketplace procedure instead of attempting to work around the restriction.

For additional current CMS materials, review the CMS 2026 EDE identity proofing and Agent/Broker Authorization resources.

NPN verification and Marketplace agent compliance

NPN verification is a foundational control for agent identity, licensing, Marketplace registration, and agency records. Your NPN should be accurate and associated with the correct individual producer.

Before Open Enrollment, confirm:

Your NPN is correct in CMS and agency systems.
Your resident and nonresident state licenses are active.
Your health-related line of authority is current where required.
Your name and license information are consistent across systems.
Your Marketplace registration and training status are current.
Your agency has an accurate roster of affiliated producers.
Staff understand which agent’s NPN should be connected to a consumer record.
Any agency-level information is documented separately from the writing agent’s information.

CMS states that the Agent and Broker FFM Registration Completion List contains NPNs for agents and brokers who completed current-year registration. CMS also notes that NPNs are self-reported during registration and should be validated against state or NAIC records.

CMS requirements versus eMavio verification

CMS registration, training, authentication, consent, application access, and enrollment procedures are government or Marketplace requirements. They are separate from eMavio’s internal directory verification process.

eMavio is a lead-generation platform and insurance directory, not a CMS-approved EDE entity, primary or upstream EDE entity, downstream web-broker, Marketplace enrollment platform, CMS registration provider, issuer, or government agency. eMavio does not provide an EDE environment, operate a CMS-approved EDE integration, submit Marketplace applications through CMS APIs, perform CMS identity proofing, obtain Marketplace consent on an agent’s behalf, provide plan comparisons or recommendations, assist with enrollment, or enroll consumers.

eMavio’s internal NPN and licensed-state checks are directory verification only, not CMS validation, CMS registration, CMS approval, or proof of Marketplace authorization.

Agents remain responsible for CMS registration, training, and agreements, state licensing, consent, identity controls, privacy and security, application review, and record retention.

A strong workflow is repeatable. It should not depend on one experienced employee remembering to save a form or add a note.

Step 1: Identify the assistance request

Record what the consumer is asking the agency to do. Is the consumer requesting general contact, application assistance, an account update, enrollment support, or a response to an existing Marketplace inquiry?

The request should help determine which consent language and Marketplace pathway apply.

Step 2: Confirm identity and authority

Confirm the consumer’s identity using the applicable Marketplace process. If someone is acting for another person, document the representative’s authority according to applicable requirements.

Do not assume that a spouse, adult child, caregiver, employer representative, or household member can automatically authorize every action.

Explain what information the agency may access, why it is needed, who may use it, how long consent lasts, and how the consumer may revoke it.

If support staff may access the record, the documentation should reflect the agency structure, documented consent scope, role-based permissions, CMS rules, and applicable law. Support staff may access PII only when those conditions permit it, and they must use individual credentials rather than the writing agent’s credentials.

Use a written, electronic, text, email, or recorded-call method that is permitted under current CMS guidance and applicable state law. Capture the date and time using a consistent system.

For recorded calls, review state recording-consent requirements before implementation. Store the recording or a reliable, retrievable record in a secure, searchable repository. CMS requires consent documentation to be maintained for a minimum of 10 years, subject to any longer applicable state, contract, privacy, or legal requirement.

Step 5: Document application review

Before submission, give the consumer or authorized representative an opportunity to review the eligibility application information and confirm that it is accurate and complete. Use the CMS Model Consent Form and Model Eligibility Application Review materials as current official references for your workflow review.

The retained application-review record should show:

The date of review.
The consumer or authorized representative’s name.
The assisting agent, broker, or web-broker name.
That the required application attestations were explained.
That the consumer or authorized representative had an opportunity to ask questions.
The consumer or authorized representative’s confirmation that eligibility application information was accurate and complete before submission.

This application-review record should be retained for the same CMS minimum 10-year period, subject to any longer applicable state, contract, privacy, or legal requirement.

Step 6: Record the system activity

Your CRM or agency management system should show the workflow from lead intake to completed consent, application review, submission, follow-up, and revocation if applicable.

A useful audit trail may include:

User ID.
Date and time.
Consumer record accessed.
Action performed.
NPN associated with the action.
Consent document location.
Application review confirmation.
Notes about a three-way call or consumer-submitted action.
Any escalation or correction.

A quick “the customer said it was okay” note is difficult to verify. It may not identify the scope, date, agent, duration, or revocation process.

Better practice: Use approved language and create a dated, retrievable consent record.

Shared credentials

Shared credentials destroy individual accountability and increase the risk of unauthorized access.

Better practice: Issue individual credentials, restrict permissions, and review access regularly.

Missing timestamps

A form without a date or a CRM note without a reliable timestamp may not establish whether consent came before assistance.

Better practice: Use systems that automatically record date and time and prevent post-dating where possible.

Mismatched NPNs

An application or Call Center interaction may identify one agent while the consent form names another. Agency ownership, writing-agent details, and staff access can become confused.

Better practice: Reconcile the NPN across consent documents, CMS records, agency systems, and application notes.

Unauthorized application access

A lead, referral, or marketing opt-in is not the same as Marketplace authorization.

Better practice: Do not access or change an application until the required consent and identity controls are complete.

Weak record retention

Saving records only in an inbox, local desktop folder, or a system that cannot export documents creates a problem when staff leave or an audit request arrives.

Better practice: Use a secure, centralized repository with access controls, backups, search, retention rules, and an export process.

2026 implementation checklist

Use this checklist as a starting point for internal review:

Verify your NPN against current state licensing records.
Confirm active health-related lines of authority in each state where you work.
Confirm Marketplace registration and training status through current CMS resources.
Use only individual CMS and Marketplace credentials.
Enable multifactor authentication where available.
Review agency user access and remove inactive users.
Select an approved consent process for written, electronic, email, text, or recorded-call documentation.
Capture the consumer’s name, agent or agency name, NPN, purpose, scope, date, duration, and revocation method.
Obtain consent before searching for an existing Marketplace application, assisting with an APTC or CSR application, completing or assisting with QHP enrollment, or providing account maintenance or Marketplace or Call Center assistance involving the consumer’s application or enrollment.
Confirm the consumer’s identity through the applicable Marketplace pathway and document representative authority when someone is acting for the consumer.
Document the application review before submission, including the date of review, the consumer or authorized representative’s name, the assisting agent, broker, or web-broker name, that required application attestations were explained, that the consumer or authorized representative had an opportunity to ask questions, and confirmation that eligibility application information was accurate and complete before submission.
Verify that application information is complete and accurate before submission.
Follow current procedures for unassociated agents and Call Center activity, including a three-way call or consumer self-service pathway when required by CMS access controls.
Protect PII during collection, transmission, storage, and disposal.
Retain consent and application-review documentation for a minimum of 10 years, subject to any longer applicable state, contract, privacy, or legal requirement.
Train producers, customer service representatives, virtual assistants, and agency owners.
Test whether your records can be located and produced promptly.
Review your workflow with legal or compliance counsel before Open Enrollment.

Family meeting with an insurance professional in a bright, modern office

A practical compliance table

Workflow areaWhat your agency should verifyEvidence to retainAgent identityCorrect individual producer, credentials, and NPNRegistration record, NPN record, user IDState authorityActive license and applicable health-related authorityLicense records and renewal documentationConsumer identityConsumer or authorized representative confirmed through the applicable process, with representative authority documented when applicableVerification record or system confirmationConsentConsent obtained before the applicable trigger activitySigned form, electronic record, email, text, or recordingScopeAuthorization identifies permitted activities, PII use, and any permitted staff accessConsent language and agency procedureApplication reviewRecord shows date of review, consumer or authorized representative’s name, assisting agent, broker, or web-broker name, explained attestations, opportunity to ask questions, and confirmation that eligibility application information was accurate and complete before submissionReview form, electronic attestation, or recordingCall Center accessConsumer authorization and NPN association handled correctly, with three-way call or consumer self-service pathway used when requiredCall notes, three-way call record, or system recordStaff accessOnly authorized personnel can view consumer information, and staff use individual credentials rather than the writing agent’s loginUser permissions and access logsRetentionConsent and application-review records are secure, searchable, retrievable, and retained for a minimum of 10 years, subject to any longer applicable requirementRepository record and retention scheduleRevocationAgency can record and honor a consumer’s withdrawal of consentRevocation request and completion note

How eMavio can fit into an agent’s intake process

eMavio connects consumers with independent, state-licensed health insurance agents through a lead-generation platform and insurance directory. For agents and agencies, the platform is designed to help make qualified consumer opportunities easier to discover and manage.

The eMavio intake record should not be treated as a replacement for Marketplace consent, Marketplace authorization, consumer verification, application review, or any CMS-controlled pathway. If a consumer is referred to your agency through eMavio, your team remains responsible for completing any required consumer or authorized-representative verification, obtaining Marketplace-specific consent, documenting application review, following current CMS and carrier procedures, and maintaining required records.

eMavio’s internal NPN and licensed-state checks are directory verification only, not CMS validation, CMS registration, CMS approval, or proof of Marketplace authorization. Agents remain responsible for CMS registration, training, agreements, state licensing, consent, identity controls, privacy and security, application review, and record retention.

Agents can use the eMavio agent signup page to review the platform and begin the agency account process.

When directing consumers to research local professionals, remind them to use the eMavio website and its directory to research and select a local health insurance agency. The agency and licensed agent, not eMavio, are responsible for regulated insurance advice, plan discussions, application assistance, and enrollment work.

Not every marketing or general information call is necessarily the same as a Marketplace-consent trigger. However, consent should be obtained before searching for an existing Marketplace application, assisting with an APTC or CSR application, completing or assisting with QHP enrollment, or providing ongoing account maintenance or Marketplace or Call Center assistance involving the consumer’s application or enrollment. Consult current CMS guidance and your compliance counsel for your specific workflow.

No. A lead opt-in generally authorizes contact for the purpose described in the lead form. It does not automatically authorize account access, application changes, APTC or CSR assistance, QHP enrollment, Marketplace or Call Center activity, or use of PII beyond the stated scope.

The answer depends on the form language, agency structure, and current requirements. The record should clearly identify the agent, broker, web-broker, or agency receiving consent and explain who may access PII. Have the form reviewed before using it across a team.

CMS requires consent and application-review documentation to be maintained for a minimum of 10 years, subject to any longer applicable state, contract, privacy, or legal requirement. Your system should make records secure, searchable, and retrievable throughout the full retention period.

Does NPN verification by eMavio mean an agent is CMS compliant?

No. eMavio’s NPN and licensed-state verification is part of its directory and lead-generation model. It is directory verification only and does not provide CMS validation, CMS registration, CMS approval, legal advice, compliance guarantees, plan recommendations, enrollment authorization, or proof of Marketplace authorization.

Sources and verification

For current official reference materials, review the CMS Health Insurance Exchange Guidelines, the CMS Enhanced Direct Enrollment partners page, the CMS FAQ regarding decommissioning Classic DE, the CMS 2026 EDE identity proofing and Agent/Broker Authorization resources, the CMS 2026 registration and training page, the CMS 2026 New Agents and Brokers Guide, and the CMS Model Consent Form and Model Eligibility Application Review materials.

CMS guidance controls if dates, pathway availability, role definitions, documentation requirements, or access procedures change. Do not rely on unofficial summaries as authority.

Final Safe Harbor reminder

Marketplace agent compliance is an ongoing responsibility. CMS broker consent, agent authentication, consumer or authorized-representative verification, EDE-specific controls where applicable, NPN verification, application review, and secure documentation should operate together as one controlled workflow.

Implementation details may change before or during the 2026 plan year. Do not rely on an old form, saved script, prior Open Enrollment procedure, or third-party summary as your only source. Review current CMS and Marketplace instructions, carrier requirements, state law, agency contracts, and legal or compliance guidance before assisting consumers.

eMavio is a lead-generation platform and insurance directory, not a licensed insurance agency, broker, company, CMS-approved EDE entity, web-broker, Marketplace enrollment platform, CMS registration provider, or government agency. It does not provide recommendations, guidance, plan comparisons, Medicare explanations, coverage recommendations, plan selection, enrollment assistance, CMS identity proofing, Marketplace consent, or application submission, and does not enroll consumers. eMavio does not store Marketplace PII or consent records beyond the lead-generation information collected for its directory and matching services. Any Verified Local Agent or NPN positioning is subject to eMavio review and is directory verification only, not CMS validation, approval, endorsement, or a compliance guarantee.

Use the eMavio agent signup page to review the platform and begin the agency account process.

CMS Broker Consent Rules: An Agent Guide for 2026 OE

2026 Direct Enrollment Transition: Classic DE and EDE