CY2027 Medicare Marketing Compliance Checklist for Agents

Medicare marketing compliance is not a one-time training topic. It is an operating discipline that touches every part of an agency: licensing, beneficiary contact, appointment preparation, event management, call technology, data access, record retention, and audit response.

For CY2027, several Medicare marketing changes take effect on October 1, 2026. The most important operational updates include the elimination of the 48-hour wait between a completed Scope of Appointment (SOA) and a personal marketing appointment, the removal of the 12-hour gap between educational and marketing events under the required transition controls, and updated timing for the Third-Party Marketing Organization (TPMO) disclaimer.

This checklist is designed for agents, agencies, field marketing organizations, and support teams preparing for CY2027. It separates the CMS baseline from additional requirements that may come from plan contracts, state law, privacy rules, or agency policy.

Important: This article is general compliance information, not legal advice. Review your current plan contracts, applicable law, written procedures, and compliance counsel guidance before changing your workflow.

CY2027 Medicare marketing compliance at a glance

Before changing a form, script, event process, or recording system, review these core points:

• CY2027 changes take effect October 1, 2026.

• The 48-hour wait between a completed SOA and a personal marketing appointment is eliminated.

• The SOA itself is still required where applicable. Written SOA requirements and exceptions must be checked for each interaction.

• The TPMO disclaimer must be provided before any discussion of plan benefits.

• The 12-hour gap between an educational event and a marketing event is removed. A transition is permitted when the required notice is provided and attendees have a sufficient opportunity to leave.

• SOAs may be collected at educational events under the CY2027 rules.

• The 2027 Annual Election Period (AEP) is October 15 through December 7.

• Do not treat a proposed reduction from 10 years to 6 years as a universal record-retention rule. Retention must be reviewed across CMS requirements, contracts, state law, privacy and records rules, and agency policy.

Read the CMS CY2027 Agent and Broker Training and Testing Guidelines and compare them with the written requirements that apply to your organization.

Master checklist: CMS minimums versus other requirements

Use this table as a review framework. The “CMS baseline” column should not be treated as the only source of obligations. Your plan contract, state, privacy requirements, or internal policy may be stricter.

Compliance areaCMS baseline to verifyPlan contract and state-law reviewPrivacy and agency-policy reviewIndividual credentialsConfirm that each person participating in Medicare marketing activity has the credentials and training status required for the role.Verify state licensing, appointments, product authority, and plan-specific credentialing before activity begins.Maintain an up-to-date credential file and suspend access when credentials expire or cannot be verified.Written SOADetermine whether the interaction requires an SOA and use the current approved form or process. The SOA remains required where applicable.Check written SOA rules and exceptions for the plan, state, interaction type, and appointment channel.Store the completed SOA with the correct beneficiary and appointment record.PMA timingThe 48-hour wait between completed SOA and personal marketing appointment is eliminated for CY2027.Confirm how each contracted plan defines and documents a personal marketing appointment.Update scripts, scheduling tools, and staff training so the removed wait is not confused with removal of the SOA requirement.Inbound and outbound contactClassify how the interaction began and whether it became an individualized marketing discussion.Review plan procedures for inbound calls, web forms, chats, walk-ins, referrals, and outbound outreach.Require staff to document the contact source, purpose, consent or opt-out status, and escalation path.TPMO disclaimerProvide the TPMO disclaimer before discussing any plan benefits.Use the approved wording and confirm the required organization and product information.Lock the disclaimer into scripts and workflows so it cannot be skipped or delivered late.Call recordingIdentify required marketing, sales, and enrollment calls, including applicable web-based technology interactions.Confirm which systems, call types, vendors, and subcontractors are covered by the plan contract.Test recording, access, storage, retrieval, quality checks, and failure escalation.Retention reviewDo not rely on an unconfirmed universal retention period.Review the plan’s written retention instructions and applicable state requirements.Reconcile CMS requirements, plan contracts, privacy and records rules, litigation holds, and agency policy.Educational eventsKeep educational content separate from marketing content and use the current event controls. SOAs may be collected at educational events under CY2027 rules.Confirm approved event descriptions, materials, notices, and transition procedures.Track event versions, attendee notices, opt-outs, and staff assignments.Marketing eventsVerify that plan-specific discussions and marketing materials occur only under the applicable marketing-event process.Review plan approval requirements, venue rules, scripts, materials, and reporting.Keep an event file with approvals, materials, attendance information, and incident notes.Event transitionsThe 12-hour gap is removed. A transition is permitted with required notice and a sufficient opportunity for attendees to leave.Confirm the exact notice language and timing required by the plan or state.Train presenters to pause, announce the transition, document the notice, and honor departures.Support-staff accessConfirm what access is necessary for each role.Check vendor, downstream entity, and plan requirements for staff handling beneficiary information.Apply role-based access, minimum necessary permissions, individual logins, and access reviews.Beneficiary opt-outsProvide and document applicable opt-out opportunities.Review contact, event, communication, and plan-specific opt-out rules.Maintain suppression records and ensure opt-outs are visible to agents, call-center staff, and vendors.Escalation proceduresEstablish a process for suspected noncompliance or missing documentation.Follow plan reporting and incident-notification requirements.Define who can pause activity, correct a script, preserve records, and notify leadership or counsel.Audit filesMaintain evidence that required procedures are being followed.Retain plan approvals, training evidence, monitoring results, and requested reports.Organize a complete, access-controlled file that can be retrieved without reconstructing the history later.

1. Confirm individual credentials before marketing activity

A compliant process starts with the people who are permitted to perform the work. Create a credential checklist for every agent, broker, employee, contractor, downstream entity, and support staff member who may participate in Medicare marketing, sales, enrollment, or related administrative activity.

At minimum, your internal review should identify:

• State license status and expiration date

• Required appointments or authorizations

• Plan-specific contracting status

• Required training and testing completion

• National Producer Number or other identifying information used in enrollment workflows

• States and products in which the individual is authorized to operate

• Date of the most recent credential review

• Person responsible for approving or suspending access

Support staff may not be agents, but they can still affect compliance. A scheduler, call-center representative, lead manager, or administrative employee might control an appointment, deliver a script, access an SOA, handle a recording, or process an opt-out. Assign access according to job duties rather than giving every user the same permissions.

2. Review the SOA process and PMA timing

The CY2027 change removes the 48-hour wait between a completed SOA and a personal marketing appointment. That does not mean the SOA process disappears.

The practical checklist is:

1. Identify whether the contact is an interaction for which an SOA is required.

2. Use the current written SOA process.

3. Check the applicable rules and exceptions for that interaction.

4. Confirm that the appointment stays within the documented scope.

5. Record when and how the SOA was completed.

6. Make the SOA available for monitoring and audit.

The key training message should be simple: the waiting period is gone; the SOA requirement where applicable remains.

Avoid relying on old scheduling software that automatically blocks an appointment for 48 hours. At the same time, do not remove SOA prompts entirely. Have compliance or operations review every automation change before it reaches agents.

3. Classify inbound and outbound contact correctly

Inbound contact is not automatically outside the compliance workflow. Outbound contact is not the only contact that deserves review.

Your process should distinguish among:

• Agent- or plan-initiated outreach

• Beneficiary-initiated calls

• Web forms and chats

• Walk-in or unscheduled office conversations

• Referrals and lead transfers

• General educational questions

• Individualized discussions that become marketing or sales conversations

The classification should be documented before the conversation advances. If a general inquiry turns into a discussion of plan benefits, staff should know which controls activate next. This is particularly important when a person moves between a lead form, a call queue, a web chat, and a licensed agent.

A short contact-classification field in your customer relationship management system can help, but the field should not replace training. Staff need a clear escalation path when they are unsure whether a contact has become an individualized marketing interaction.