CMS Consent & Identity Proofing: 2026 Agent Compliance Guide

moderator · 11/13/2026 · 13 min read · 2,941 words

Master 2026 CMS broker consent and identity proofing rules. Learn NPN validation, PII handling, and ACA Marketplace compliance for the next Open Enrollment.

For ACA Marketplace agents and agencies, the practical takeaway is straightforward: a compliant workflow needs an identity-and-consent checkpoint before handling consumer personally identifiable information (PII), reviewing an application, or assisting with Marketplace eligibility and enrollment activities.

That checkpoint should not be treated as a single form or a one-time administrative task. It is a documented process that connects the consumer, the specific agent or agency, the permitted use of information, the agent’s authorization status, and the consumer’s confirmation that application information is accurate before submission.

CMS requirements and operational procedures can change. Agents should always follow the latest instructions from the CMS Marketplace registration and training page, their state insurance department, approved Marketplace technology partners, and their agency’s compliance counsel.

This guide explains the major areas ACA Marketplace agents should prepare for in 2026 and ahead of the next Open Enrollment cycle.

What the 2026 compliance workflow should accomplish

A strong workflow should be able to answer five questions quickly:

Who is the consumer or authorized representative?
Which agent, broker, web-broker, or agency received permission to assist?
What activities and uses of PII did the consumer authorize?
Is the agent properly registered, trained, licensed, and associated with the correct NPN and state authority?
Did the consumer review and confirm the application information before submission?

These questions matter because CMS has increased its focus on unauthorized Marketplace activity, inaccurate applications, inappropriate account access, and weak records. The 2026 HHS Notice of Benefit and Payment Parameters includes policies strengthening oversight, enforcement, suspension authority, and consumer protections involving agents, brokers, and web-brokers.

Compliance is not only about completing an enrollment transaction. It is also about being able to demonstrate how the transaction was authorized and how the information was handled.

Before providing Marketplace application or enrollment assistance, an agent or agency should obtain and document consumer consent consistent with applicable requirements.

The consent record should clearly identify:

The consumer or authorized representative.
The individual agent, broker, web-broker, or agency receiving consent.
The permitted purpose or purposes for accessing and using PII.
The scope of assistance.
The duration of consent.
The date consent was provided.
How the consumer may revoke or modify consent.
The privacy protections that apply to the consumer’s information.

Permitted purposes may include searching for an existing Marketplace application, assisting with an eligibility or enrollment application, helping with ongoing account maintenance when authorized, or responding to Marketplace inquiries about the consumer’s application.

The scope should be understandable to the consumer. Avoid broad language that makes it unclear who may access information or what the information may be used for.

CMS does not prescribe one universal format

The CMS Model Consent Form is designed as a practical example. CMS explains that its rules require certain content but do not prescribe one single manner of documenting consent.

Depending on the circumstances and applicable law, acceptable documentation may include:

A physical document with a wet signature.
An electronic document with a digital signature.
An email exchange.
A text-message record.
A recorded telephone call.
Another record that reliably captures the required information.

The important issue is not whether every agency uses the same form. The important issue is whether the agency can demonstrate that consent was obtained before assistance and that the record contains the required information.

For phone-based workflows, CMS provides model verbal scripts. Record the conversation only where permitted by applicable state law and agency policy. Call-recording rules vary, so agencies should confirm whether all-party or one-party consent requirements apply before implementing a recording process.

A consumer’s consent to receive a call, text, or email from a lead-generation platform is not automatically the same as consent for a specific agent to access a Marketplace application or assist with enrollment.

Those are separate compliance questions:

A marketing consent may authorize communications.
Marketplace consent authorizes a specific agent, broker, web-broker, or agency to perform defined assistance activities.
Platform terms may govern how a lead is transferred.
State and federal insurance requirements may impose additional documentation obligations.

Agents should not assume that a lead record alone proves Marketplace consent. Establish the direct agent-consumer authorization required for the work you intend to perform.

Licensed health insurance agent reviewing an authorization document with a consumer using a tablet

Identity proofing and agent authorization

Agent identity proofing through the current CMS process

Agents and brokers who participate in the Federally-facilitated Marketplace must follow the current CMS registration and training process. CMS materials for Plan Year 2026 described identity proofing through the CMS Enterprise Portal and remote identity verification.

CMS may request personal information such as a home address, personal phone number, and personal email address for identity verification. If remote verification is unsuccessful, the current process may provide an alternate method, such as completing verification directly with the identity-proofing vendor using a code or other instructions.

Do not treat a historical portal label or workflow as permanent. CMS has used different identity-management terminology over time, including transitions from older enterprise identity systems to current Identity Management processes. Always follow the current CMS instructions rather than relying on screenshots, saved bookmarks, or outdated internal procedures.

Registration, training, agreements, and completion status

Agent identity proofing is only one part of Marketplace authorization. Agents should also confirm that they have:

Created or maintained the correct CMS account.
Requested the applicable agent or broker role.
Completed the required Marketplace training.
Completed the applicable MLMS profile.
Entered the correct individual, business, or web-based entity information.
Entered the correct NPN in the correct profile field.
Reviewed and accepted the applicable Marketplace agreement or agreements.
Obtained a completion certificate where applicable.
Confirmed completion through the current CMS tracker or registration status process.

CMS’s new agent and broker registration and training guide emphasizes that agents must not share CMS credentials, passwords, or multifactor authentication details. Each producer should use their own credentials.

NPN verification and licensed-state validation

NPN verification is an important operational control, but an NPN by itself does not prove that an agent is authorized to assist in every state or with every Marketplace activity.

Agencies should verify:

The NPN belongs to the individual producer or the correct business entity.
The NPN was entered accurately during CMS registration.
The agent has an active health-related license or Line of Authority where required.
The agent is authorized in the state where the consumer is seeking coverage.
The state license information is current.
The name and entity information align across CMS, state records, and internal systems.

CMS states that the Agent and Broker FFM Registration Completion List contains NPNs for agents and brokers who completed registration for the applicable year. The list should be checked along with state and other licensing records. CMS also provides information about state health-related Lines of Authority through its agent and broker resources.

A practical agency control is to maintain a state-by-state license matrix with expiration dates, license types, health-related authority, appointment information where applicable, and the date each record was last reviewed.

Application review and accuracy confirmation

Consumer consent allows an agent to perform authorized assistance. It does not eliminate the need for a final application review.

Before submitting an eligibility or enrollment application, the consumer or authorized representative should have an opportunity to review the information and confirm that it is accurate and complete.

The review should address information that can affect eligibility or financial assistance, including:

Household members.
Tax-filing status.
Expected annual household income.
Employer coverage information.
Social Security numbers or immigration document information, when applicable.
Residential and mailing addresses.
Current coverage status.
Qualifying life-event details, when relevant.
Preferred contact information.
Attestations presented at the end of the application.

The CMS Model Eligibility Application Review Form includes language documenting that the consumer reviewed the application and confirmed its accuracy before submission.

For a telephone process, the agent may use CMS’s model review script as a starting point. The agent should explain the applicable attestations, invite questions, review the application information, and ask the consumer to confirm that the information is accurate before submission. If the call is recorded, the recording must be handled securely and retained in a way that allows it to be produced if required.

Agency controls for Open Enrollment readiness

A well-designed agency workflow should place compliance controls at each stage rather than relying on a final review after an application is submitted.

Intake and lead handling

At intake, record:

Lead source.
Date and time received.
Consumer contact information.
State and ZIP code.
Assigned agent or agency.
Communication permissions.
Any restrictions on contact or data use.

Do not treat a consumer’s submission to a directory or lead platform as Marketplace enrollment consent. Use the lead record to begin a compliant agent-consumer conversation, then document the required Marketplace consent before providing covered assistance.

Before accessing or handling application information, record:

Consent date and time.
Consent method.
Agent or agency name.
Individual NPN and agency NPN, where applicable.
Permitted purpose.
Duration.
Revocation method.
Identity-proofing status where required by the applicable CMS or EDE workflow.
Any failed proofing or escalation outcome.

Secure storage and access

Use secure systems with:

Role-based access.
Multifactor authentication.
Encryption in transit and at rest where available.
Access logs.
Individual user accounts.
Document version control.
Defined retention and deletion schedules.
Secure disposal procedures.

Limit access to the people who need the information for an authorized business purpose. An agency should be able to identify who viewed, edited, exported, or transmitted a consumer record.

Quality assurance and escalation

Before Open Enrollment, agencies should test a sample of completed files. QA sampling can check whether:

Consent occurred before assistance.
The authorized agent is clearly identified.
NPN and state license information are correct.
Application review was documented before submission.
Any recording is accessible and lawfully obtained.
The record is stored in the correct consumer file.
Revoked consent is reflected in the system.
No shared credentials were used.

Create an escalation process for mismatched identity information, uncertain authority, suspected unauthorized activity, inaccurate applications, data incidents, and consumer complaints. Employees should know when to stop a transaction and involve a compliance manager.

Control versus evidence: a practical audit table

Compliance controlEvidence an agency should be able to locateConsumer consent obtained before assistanceSigned form, email, text record, or permitted recordingAgent or agency clearly identifiedName, NPN, contact details, and agency informationPermitted use of PII documentedConsent language describing scope and purposeConsent duration and revocation processForm field, message, script, or policy recordAgent identity proofing completedCMS status, registration record, or completion documentationCurrent Marketplace registration and trainingCertificate, transcript, tracker result, or RCL listingNPN validation completedCMS registration information and state license verificationCorrect licensed state confirmedLicense lookup, LOA record, or internal license matrixApplication reviewed before submissionSigned review form, electronic confirmation, or permitted recordingSecure access maintainedUser access list, audit log, and MFA recordsRevocation handledRevocation request, timestamp, system update, and follow-up actionQA performedSampling log, findings, corrections, and manager signoff

Retention periods may depend on CMS requirements, state law, contractual obligations, privacy rules, and the agency’s documented schedule. Do not invent a universal retention period. Instead, confirm the applicable requirements and ensure records remain accessible for the required period.

Common failure modes to eliminate

A rushed call during Open Enrollment is not a reason to skip the consent checkpoint. If consent is required, document it before searching for an application or providing covered assistance.

Consent should identify the actual agent, broker, web-broker, or agency receiving authorization. Avoid relying on an old record that does not state its duration, scope, or revocation process.

Missing agent identity or NPN information

A consent record that names only a generic “insurance representative” may be difficult to connect to the producer who handled the account. Include the relevant individual and agency details.

Working in the wrong licensed state

An agent may be licensed in several states, but each consumer interaction must be checked against the agent’s current authority and the applicable Marketplace process.

Entering inaccurate household or income data

Agents should never guess or silently “fix” information to produce a desired eligibility result. Ask the consumer to review and confirm the information, document corrections, and follow the applicable application process.

Never share CMS credentials, passwords, MFA codes, consumer login credentials, or access tokens. Shared access weakens accountability and can create an audit trail that does not accurately identify the person who acted.

Using unverified vendors

Before connecting a CRM, dialer, document service, identity tool, or data vendor to an agency workflow, review its security controls, contractual terms, data-use practices, access permissions, and compliance responsibilities.

Treating a lead-generation platform as an enrollment system

A directory or lead platform can help create a connection. It does not replace CMS registration, consumer consent, identity proofing, licensing, application review, or the approved enrollment pathway.

How eMavio fits into an agent compliance workflow

eMavio is a Safe Harbor lead-generation platform and directory. It connects consumers with local insurance professionals and is not a CMS enrollment system.

eMavio does not:

Perform CMS identity proofing.
Obtain consumer consent for Marketplace enrollment assistance.
Provide plan comparisons.
Recommend coverage.
Provide insurance guidance.
Select plans for consumers.
Provide enrollment assistance.
Enroll consumers in health insurance plans.
Act as a licensed insurance agency, broker, agent, or insurance company.

Agents remain responsible for their own CMS registration, Marketplace training, agreements, licensing, NPN accuracy, consent documentation, application review, privacy, security, record retention, and compliance with all applicable state and federal rules.

Agents can also review eMavio’s existing agent growth resources and directory-focused article when evaluating how a directory fits into their business development process. Those resources do not replace official CMS guidance or legal advice.

Pre–Open Enrollment readiness checklist

Use this checklist before accepting a high volume of Marketplace inquiries:

Confirm the current CMS registration and training window.
Complete or renew CMS registration and applicable agreements.
Confirm agent identity proofing under the current CMS process.
Verify individual and business NPN information.
Check the CMS Registration Completion List or current tracker.
Validate each producer’s health-related license and state authority.
Update consent forms, email templates, text workflows, and call scripts.
Confirm that consent is captured before application assistance.
Add a separate application review and accuracy-confirmation checkpoint.
Review state call-recording laws before recording conversations.
Test secure document storage and access permissions.
Remove shared accounts and shared MFA practices.
Confirm revocation and correction workflows.
Run QA samples from the prior season.
Train staff on escalation and incident reporting.
Verify vendors and data-sharing agreements.
Create an audit response folder with policies, logs, and sample records.

For agents interested in joining the eMavio network, use the agent account registration page. Agents may claim a directory profile and submit their NPN and licensed states for review. Verified Local Agent positioning is available only if approved after review. Any badge or listing is subject to review and is not an endorsement, certification, guarantee, or representation that an agent satisfies CMS or state requirements.

Frequently asked questions

CMS broker consent is the documented permission a consumer or authorized representative gives to a specific agent, broker, web-broker, or agency to perform defined Marketplace assistance activities. The record should identify the parties, purpose, scope, duration, date, and revocation process.

No. CMS provides a model consent form, but the model is not presented as the only acceptable format. Written, electronic, email, text, or recorded verbal documentation may be appropriate when it captures the required information and complies with applicable law.

No. Identity proofing verifies identity through the applicable CMS or Marketplace process. Consent documents the consumer’s permission for a specific party to provide assistance. Agencies should treat them as separate controls.

Does NPN verification prove that an agent can work in every state?

No. NPN verification should be combined with current state licensing, health-related Line of Authority, and other applicable authorization checks. An agent should confirm authority for the specific consumer and state before assisting.

Not automatically. Lead-generation consent and Marketplace agent consent may serve different purposes. The agent or agency must establish and document the authorization required for the assistance it provides.

What should an agent do if remote identity verification fails?

Follow the current CMS instructions for the alternate verification process. Do not bypass the process, use another person’s account, or ask someone else to share credentials. If the issue remains unresolved, contact the designated CMS support channel or escalate internally.

Final reminder for agents

The safest Open Enrollment workflow is not the fastest workflow on paper. It is the workflow that prevents unauthorized access, creates a clear consumer record, confirms agent authority, and gives the consumer a meaningful opportunity to review application information before submission.

Use official CMS materials as the source of truth, validate NPN and license-state information, secure every record, and train your team before volume increases.

eMavio can help agents build visibility through a local directory connection, but it does not replace the agent’s CMS responsibilities. Agents who want to claim a profile and submit their NPN and licensed states for review can register through the eMavio agent portal.

Mandatory disclaimer: eMavio is a lead-generation platform and directory, not a licensed insurance agency, broker, or company. It does not provide insurance recommendations, guidance, plan comparisons, Medicare explanations, coverage recommendations, plan selection, or enrollment assistance, and does not enroll consumers. Agents remain responsible for CMS requirements and all applicable state and federal rules. Any eMavio listing or Verified Local Agent positioning is subject to review, is not an endorsement or guarantee, and does not confirm compliance with CMS or state requirements.