Top Five Compliance Commandments for Medicare Marketers

​Companies marketing Medicare plans are always under the microscope, but they will soon be subjected to a far greater degree of regulatory scrutiny during the upcoming open enrollment period. This is due to the fact that there are multiple federal agencies, namely the Centers for Medicare & Medicaid Services (CMS), Federal Trade Commission (FTC), and Federal Communications Commission (FCC) all maintain oversight of Medicare marketing activities, making compliance critical to avoid substantial penalties and regulatory sanctions.

To keep these regulators at bay, Third-Party Marketing Organizations (TPMOs) offering Medicare plans to the public must understand and adhere to the five compliance essentials discussed below

1. Obtain Prior Express Written Consent Under the Medicare One-to-One Rule

While the FCC’s one-to-one consent rule for TCPA compliance was eliminated in 2025 following court challenges, CMS maintains its own separate one-to-one consent requirement for Medicare marketing that became effective on October 1, 2024 and remains in effect to this day. The CMS rule requires TPMOs to obtain separate, specific prior express written consent from each Medicare beneficiary before sharing their personal data with another TPMO for marketing purposes.

This consent must be obtained through a "clear and conspicuous disclosure" that specifically names the TPMO that will receive the beneficiary's information. The rule eliminates the practice of using broad consent language or hyperlinks containing lists of multiple marketing partners. For real-time transfers, verbal consent is permitted but must be recorded and include the beneficiary explicitly naming the receiving TPMO.

The consent requirement extends beyond initial data collection to any subsequent sharing, creating a chain of accountability throughout the Medicare sales process. In addition, companies must maintain detailed records of all consents obtained and make them available for CMS review upon request.

2. Comply with TCPA Telemarketing and Messaging Requirements

Medicare marketers must navigate complex Telephone Consumer Protection Act (TCPA) requirements when conducting outreach campaigns. The TCPA requires prior express written consent before making autodialed calls or sending text messages to consumers, including Medicare beneficiaries.

Permission to Contact (PTC) forms must include proper TCPA disclaimers and cannot be combined with Medicare plan enrollment forms. Moreover, PTC forms must clearly state the scope of consent and include language such as "I understand that [Agent Name] may contact me regarding Medicare Health Plans including Medicare Supplement, Medicare Advantage, and Part D Plans."

Marketers must also honor National Do Not Call Registry requirements and maintain company-specific do-not-call lists. The National DNC Registry applies to all telemarketing businesses, and violations can result in fines up to $53,088 per call. Even during the frantic, fast-paced open enrollment period, TPMOs cannot disregard federal and state telemarketing laws or DNC requests.

3. Adhere to CMS Marketing Material Approval and Disclosure Requirements

All marketing materials must receive CMS approval before use, including widely available benefit information such as dental, vision, and hearing coverage details. This requirement applies to all communications that market Medicare Advantage, Part D, or Cost plan benefits, regardless of distribution method.

TPMOs must include specific disclaimers on all marketing materials depending on their market coverage. Companies representing fewer than all available plans must include: "We do not offer every plan available in your area. Currently we represent [number] organizations which offer [number] products in your area. Please contact Medicare.gov, 1-800-MEDICARE, or your local State Health Insurance Program (SHIP) to get information on all of your options."

In addition, marketing materials cannot contain misleading information, absolute superlatives, or suggest government endorsement. Companies must ensure all content is factually accurate and avoid scare tactics or high-pressure sales language.

4. Maintain Strict Sales Event Registration and Location Compliance

Medicare sales events require advance registration with CMS and must comply with detailed location and conduct restrictions. Events must be reported to CMS at least 30 days in advance, with exact reporting deadlines varying by carrier.

Sales activities are prohibited in healthcare treatment areas, including exam rooms, patient rooms, treatment areas where patients interact with healthcare providers, and pharmacy counters where medications are dispensed. However, activities are permitted in common areas such as waiting rooms, hospital cafeterias, and community rooms.

Event marketing materials must include required accessibility and disclaimer language, including "For accommodation of persons with special needs at sales meetings call [insert phone and TTY number]" and "Not affiliated with or endorsed by the government or federal Medicare program." Also, companies cannot require attendees to provide contact information to RSVP or fill out enrollment forms during the event.

5. Implement Comprehensive Agent and Broker Oversight Programs

Medicare plans must maintain oversight programs that monitor agent and broker activities and report noncompliance to CMS. These programs must include training requirements, compensation compliance monitoring, and corrective action protocols.

Agent compensation must comply with fair market value requirements and cannot exceed established caps for initial enrollment and renewal years. While recent court decisions have vacated certain compensation restrictions, basic fair market value requirements remain in effect.

Plans must ensure agents complete annual certification processes and maintain current licenses in all states where they conduct Medicare marketing activities. Agents must explain the effect of enrollment choices on current coverage and cannot engage in cross-selling non-healthcare products during Medicare appointments.

Companies must also establish procedures for tracking and responding to beneficiary complaints promptly, with documentation requirements that support CMS audits and enforcement reviews. The oversight program must include regular auditing of marketing activities to identify potential compliance risks before they result in regulatory violations.

Final Takeaway

Medicare marketing compliance during open enrollment requires careful coordination across multiple regulatory frameworks, with severe financial and operational consequences for violations.

Companies must establish comprehensive compliance programs that address consent management, telemarketing restrictions, material approval processes, event management, and agent oversight to successfully navigate this complex regulatory environment while serving Medicare beneficiaries effectively.