Medicare AEP Call Rules: Compliance Guide for Agents
The Medicare Annual Enrollment Period (AEP) is the busiest stretch of the year for insurance agents, field marketing organizations and the call centers that support them. It's also when regulators, consumer groups and plaintiffs' lawyers pay the closest attention. Medicare marketing calls sit under two separate rulebooks at once: the Centers for Medicare & Medicaid Services (CMS) marketing rules, and the Telephone Consumer Protection Act (TCPA) plus the Do Not Call rules that govern every telemarketing call in the US.
This guide brings both together in plain English, so agents and call centers can run AEP outreach without putting their appointments, contracts or bank accounts at risk.
Two rulebooks, one phone call
It helps to keep the two systems separate in your head:
| Rulebook | Who enforces it | What it controls |
|---|---|---|
| CMS Medicare Communications and Marketing Guidelines | CMS, through plans and their contracts | Who you may contact, what you must say, what you must record, what you can't promise |
| TCPA and Telemarketing Sales Rule | FCC, FTC, state attorneys general, private lawsuits | Consent for autodialed and recorded calls, Do Not Call scrubbing, calling hours, caller ID |
A call can satisfy one rulebook and still break the other. A beautifully scripted, fully disclosed sales call to a beneficiary who never asked to be contacted violates CMS rules. A call to someone who did ask for information, but whose number is on the National Do Not Call Registry and was dialed from a purchased list without proper consent, creates TCPA exposure.
No cold calling Medicare beneficiaries
The single most important CMS rule for call centers: plans, agents and brokers may not make unsolicited contact with Medicare beneficiaries. That means no cold calls to sell Medicare Advantage or Part D plans, no door-knocking, and no unsolicited texts or voicemails.
Outbound calls are allowed when the beneficiary has asked to be contacted. That permission has limits:
- It's specific. Permission given to one agency or about one topic isn't a blank cheque for every agent and every product.
- It isn't permanent. CMS treats permission to contact as time-limited, so a request from a previous year isn't automatically valid this AEP.
- It must be documented. If a beneficiary or a plan auditor asks why you called, you need the record of the request: the form, the date, the wording, and the source.
Calling existing clients about their current plan and returning a beneficiary's call are treated differently from unsolicited outreach, but the safest practice is still to keep a record of every contact reason.
Lead vendors and permission to contact
Many Medicare complaints trace back to purchased leads. A "Medicare lead" sold by a vendor is only useful if the beneficiary actually asked to be contacted by your organization about the topic you're calling about. Before AEP, ask every lead vendor for:
- The exact form or page the beneficiary filled out, with the consent language as it appeared.
- The date and time of the submission, and the IP address or other proof it came from the beneficiary.
- The list of companies named on that form.
If a vendor can't produce that, the lead is a cold call waiting to become a complaint. See our guide to TCPA compliance for bought leads for a deeper checklist.
Scope of Appointment and the 48-hour rule
Before a personal marketing appointment, agents must document a Scope of Appointment (SOA) — the products the beneficiary agreed to discuss. CMS generally requires the SOA to be completed at least 48 hours before the appointment. There are narrow exceptions, including beneficiary-initiated walk-ins and appointments in the final days of an enrollment period.
For telesales teams this matters in two ways:
- An outbound call that turns into an unplanned sales presentation can breach the SOA requirement.
- Products outside the agreed scope can't be pitched on the same appointment.
- Beneficiary asks to be contactedThrough a form, a business reply card, an inbound call or a referral you can document
- Record permission to contactStore the source, date, wording and the topics covered
- Complete the Scope of AppointmentProducts to be discussed, signed or recorded, normally 48 hours before the meeting
- Hold the sales conversationRead the TPMO disclaimer in the first minute and stay within the agreed scope
- Record and keep the callRetain marketing, sales and enrollment calls for 10 years
The TPMO disclaimer in the first minute
Third-party marketing organizations (TPMOs) — which includes most independent agencies, FMOs and lead-generating call centers — must read a standardized disclaimer within the first minute of a sales call. The disclaimer tells the beneficiary that the agency doesn't offer every plan in the area, how many organizations and plans it represents, and that the beneficiary can contact Medicare or their State Health Insurance Assistance Program (SHIP) for information on all options.
Script it, put it at the top of every sales script, and spot-check recordings to confirm agents are actually reading it rather than paraphrasing.
Call recording requirements
TPMOs must record marketing, sales and enrollment calls with beneficiaries in their entirety, including the audio of virtual meetings, and keep those recordings for 10 years. Make sure your dialer and telephony setup:
- Records the full call, not just the agent leg or a sample.
- Stores recordings where they can be retrieved by beneficiary, date and agent.
- Keeps them for the full retention period, with backups.
Recording also protects you. When a beneficiary claims they never agreed to something, the recording is your evidence.
Marketing language and Medicare branding
CMS rules restrict how Medicare itself can be referenced:
- Don't imply you're calling from Medicare or a government agency.
- Don't use the Medicare name, CMS logo or an image of the Medicare card in a misleading way or without the required permission.
- Avoid superlatives and benefit claims you can't support, and don't promise savings or extra benefits the plan doesn't provide in the beneficiary's area.
Impersonation complaints are one of the fastest ways to end up in front of a plan's compliance department.
Where the TCPA comes in
Even when CMS rules are satisfied, every outbound Medicare call is still a telemarketing call.
Do Not Call scrubbing
Selling Medicare Advantage or supplement plans is a telephone solicitation. Numbers on the National Do Not Call Registry can only be called if you have an exemption — usually an established business relationship or the beneficiary's written permission to call that number. You must scrub your call lists against the registry at least every 31 days, along with any state lists and your own internal do-not-call list.
Consent for autodialed and recorded calls
Calls to cell phones using an autodialer or a prerecorded voice need prior express written consent for telemarketing. Ringless voicemail and recorded "press 1" messages are treated as prerecorded calls. If your dialer can place calls automatically, assume these rules apply.
Calling hours
Calls must fall between 8 a.m. and 9 p.m. in the beneficiary's local time, and several states are stricter. Florida, Oklahoma and Maryland, for example, limit calls to 8 p.m. and cap the number of calls per day on the same subject. Our free calling-time checker shows the allowed window for any US number.
An AEP compliance checklist for call centers
- Confirm every outbound record has documented permission to contact, scoped to your agency and topic
- Scrub lists against the National DNC Registry, state lists and your internal DNC list within the last 31 days
- Remove known TCPA litigators before dialing
- Separate cell phones from landlines and confirm consent for any autodialed or recorded calls
- Load the TPMO disclaimer at the top of every sales script
- Capture Scope of Appointment 48 hours ahead where required
- Record every marketing, sales and enrollment call in full and keep it 10 years
- Block calls outside each state's legal calling hours
- Train agents never to imply they represent Medicare
- Log and honor do-not-call requests immediately
Make scrubbing part of the AEP workflow
During AEP, lists change daily. New leads arrive, beneficiaries ask to stop being called, and numbers get reassigned. A workable routine is to scrub every new batch before it reaches the dialer, and re-scrub working lists weekly. Carrier Fence checks numbers against DNC, honeypot and litigator data in one pass and returns the line type, carrier and calling hours for each number, so you can see at a glance which records need consent before an autodialed call. Start with 500 free coins.
A worked example: one lead, start to finish
A beneficiary fills out a form on a comparison site asking for information about Medicare Advantage plans. Here's how a compliant agency handles that lead:
- The lead arrives with its consent record. The form named the agency, asked permission to call about Medicare Advantage and Part D plans, and was submitted two days ago. The agency stores the wording, date and submission record.
- The number is scrubbed. It isn't on the agency's internal do-not-call list or a litigator list. It is on the National Do Not Call Registry, but the beneficiary's written request to be contacted by this agency covers the call.
- Line type and hours are checked. The number is a cell phone in Florida. Because the agency has written consent, an agent may call; the call happens before 8 p.m. local time, and no more than three attempts are made in 24 hours.
- The first call sets an appointment. The agent introduces themselves and the agency, reads the TPMO disclaimer within the first minute because the conversation turns to plan options, and agrees with the beneficiary on which products to discuss. The Scope of Appointment is recorded.
- The sales conversation happens at least 48 hours later. The agent stays within the agreed scope, and the whole call is recorded and stored for 10 years.
Every step leaves a record. If the beneficiary or a plan auditor asks questions later, the agency can answer each one in minutes.
Common myths about AEP calling
| Myth | Reality |
|---|---|
| "If they're 65 and on a list, we can call them." | Unsolicited contact with Medicare beneficiaries to market MA or Part D plans is prohibited. |
| "A lead from last year still counts." | Permission to contact is limited in time and scope. Get fresh permission. |
| "The TPMO disclaimer can go at the end." | It must be read within the first minute of a sales call. |
| "Only enrollment calls need recording." | Marketing, sales and enrollment calls must be recorded in full. |
| "DNC doesn't apply because it's insurance." | Medicare plan sales calls are telephone solicitations under federal law. |
Key terms
- AEP: the Annual Enrollment Period, October 15 to December 7, when beneficiaries can change Medicare Advantage and Part D coverage.
- TPMO: third-party marketing organization — agencies, FMOs and lead generators that market plans for plan sponsors.
- SOA: Scope of Appointment, a record of which products the beneficiary agreed to discuss.
- Permission to contact: a beneficiary's request to be contacted, which allows outbound calls within its scope.
- SHIP: the State Health Insurance Assistance Program, which gives free, unbiased Medicare counseling.
Frequently asked questions
Can Medicare agents cold call during AEP?
No. CMS prohibits unsolicited contact with Medicare beneficiaries to market Medicare Advantage or Part D plans. You may call beneficiaries who asked to be contacted, current clients about their existing coverage, and people returning your call.
Does the Do Not Call Registry apply to Medicare insurance calls?
Yes. Calls selling Medicare plans are telephone solicitations, so numbers on the National Do Not Call Registry can only be called with an exemption, such as an established business relationship or the beneficiary's written permission.
What is the 48-hour rule for Medicare appointments?
CMS generally requires a Scope of Appointment to be documented at least 48 hours before a personal marketing appointment, so the beneficiary has time to consider what will be discussed. There are limited exceptions, such as beneficiary-initiated walk-ins.
Do Medicare sales calls have to be recorded?
Third-party marketing organizations must record marketing, sales and enrollment calls with beneficiaries in their entirety and keep the recordings for 10 years.
What must the TPMO disclaimer say?
It must explain that the organization doesn't offer every plan available in the area, state how many organizations and plans it represents, and tell the beneficiary they can contact Medicare or their local SHIP for information on all options. It must be read within the first minute of a sales call.
This article is general information, not legal advice. CMS guidance changes from year to year; confirm current requirements with your carriers and compliance counsel before AEP.