Third-Party Marketing Organizations (TPMOs) in the CMS Regulatory Framework

Definition of TPMOs Under CMS Regulations

The Centers for Medicare & Medicaid Services (CMS) defines a Third-Party Marketing Organization (TPMO) as any organization or individual (including independent agents and brokers) that is compensated to perform lead generation, marketing, sales, and enrollment-related functions as part of the “chain of enrollment.” This chain of enrollment encompasses the steps a Medicare beneficiary takes from becoming aware of a Medicare Advantage (Part C) or Part D plan to making an enrollment decision bressler.com bluepeakadvisors.com. In practical terms, TPMOs can include licensed insurance agents and brokers, field marketing organizations (FMOs), call centers, online lead generators, and other marketing firms engaged in Medicare Advantage or Part D plan promotion and enrollment. Importantly, CMS clarified that TPMOs may be “first-tier,” “downstream,” or “related” entities (FDRs) of an MA or Part D plan, but they can also be entities that are not formal FDRs – if they provide marketing services to a plan or to an FDR of a plan bressler.com. In other words, the definition is intentionally broad to capture any third party involved in marketing or enrolling beneficiaries into Medicare plans, whether or not they have a direct contract with the insurer bluepeakadvisors.com.

Under CMS guidance, all independent agents and brokers are considered TPMOs and must adhere to TPMO rules advocateforagents.com. CMS emphasizes that Medicare Advantage Organizations (MAOs) and Part D sponsors bear ultimate responsibility for the actions of TPMOs working on their behalf bressler.com. An MAO’s contract with CMS requires oversight of all downstream entities, so plans must ensure TPMOs comply with Medicare marketing regulations just as if they were the plan itself bressler.com. In summary, a TPMO is not a formal designation of a separate business type but rather a regulatory category encompassing any third-party entity or person engaging in Medicare plan marketing/enrollment activities for compensation. This broad definition, adopted in regulation for Contract Year (CY) 2023, laid the groundwork for new compliance requirements described below.

Historical Overview of TPMOs in Medicare Marketing

Third-party marketing has long played a role in Medicare Advantage (MA) and Part D plan growth, but its oversight has evolved substantially. In the early years of Medicare Advantage (formerly Medicare+Choice), marketing was primarily done by insurance companies’ in-house teams and captive agents under strict CMS marketing guidelines. Independent brokers and agencies gradually became more involved, and by the 2000s, field marketing organizations (FMOs) emerged to recruit and manage networks of independent agents for MA plans. These third parties helped MA plans expand enrollment through local seminars, direct mail, and one-on-one sales. Lead-generators and telesales began to feature more prominently in the 2010s, especially as Medicare Advantage enrollment grew and moved online. By 2021, Medicare Advantage had over 26 million enrollees – roughly half of all Medicare beneficiaries – double the MA enrollment in 2010, a growth partly attributed to extensive marketing by insurers, brokers, and third-party firms activeprospect.com.

Regulatory oversight of marketing has seesawed over time. In the late 2000s, after reports of aggressive sales tactics, CMS tightened marketing rules (for example, requiring a 48-hour cooling-off period after a Scope of Appointment and forbidding certain sales at educational events). Some of these rules were later relaxed in the late 2010s – for instance, the 48-hour Scope of Appointment rule was eliminated in 2018, and CMS streamlined the Medicare Marketing Guidelines. Marketing surveillance also waned during that period finance.senate.gov. This lighter-touch approach coincided with a proliferation of TV and internet ads touting Medicare plan benefits. By 2020-2021, national TV commercials featuring celebrity spokespeople (e.g. former NFL quarterback Joe Namath) urged seniors to call “Medicare helpline” numbers that were in fact call centers for TPMOs bressler.com finance.senate.gov. These often promised extra benefits or money back on Social Security, without clear disclosure that they were advertisements for specific MA plans finance.senate.gov. The marketing landscape also saw an explosion of online lead generation: websites inviting beneficiaries to “find a Medicare plan” or compare options often collected personal data and sold these leads to brokers.

By 2021, complaints about Medicare plan marketing had surged. CMS reported receiving 39,617 complaints about MA and Part D plan marketing in 2021 – a 155% increase from 2020 ahcancal.org. Many complaints involved deceptive or high-pressure tactics by third parties. For example, some beneficiaries were misled into believing an independent help line was an official Medicare number, or that they would lose out on entitled benefits if they didn’t switch plans finance.senate.gov kff.org. State regulators and advocacy groups also observed alarming practices: seniors being enrolled in plans without their consent, sometimes targeting vulnerable individuals with cognitive impairments finance.senate.gov. One state insurance department described a 94-year-old woman with dementia in a rural area who was switched to a Medicare Advantage plan by a telemarketer – a plan that did not contract with her doctors or local hospital, thereby severely disrupting her care finance.senate.gov. Such stories, alongside numerous complaints of misleading advertisements and unwanted calls, raised red flags nationally.

Congress took notice of these trends. In October 2021, CMS issued a memorandum warning MA plans about third-party marketing abuses and reminding plans of their responsibility for oversight bressler.com. The memo (October 8, 2021) highlighted issues seen in certain TV ads (implicitly referencing the Joe Namath commercial) and advised plans to adopt best practices (e.g. verify enrollment understanding with outbound calls, monitor rapid disenrollments, review call recordings, require disclosure of lead sources, etc.) bressler.com bressler.com. In August 2022, Senate Finance Committee Chairman Ron Wyden launched an inquiry, gathering information from stateregulators on deceptive MA marketing. The Finance Committee’s majority staff issued a report in November 2022 titled “Deceptive Marketing Practices Flourish in Medicare Advantage”, documenting widespread problems bluepeakadvisors.com. The Senate report noted that CMS had conducted only one enforcement action for marketing violations since 2017, even as complaints skyrocketed finance.senate.gov. It urged CMS to strengthen consumer protections, some of which had been previously loosened finance.senate.gov finance.senate.gov.

CMS responded decisively in 2022 and 2023 with new regulations. On May 9, 2022, CMS published a final rule for Contract Year 2023 that established the TPMO definition and new marketing requirements cms.gov cms.gov. Further rule changes followed in 2023 and 2024, as detailed in the next section. These reforms aimed to reign in abusive practices by TPMOs while clarifying oversight obligations for insurers. In parallel, CMS increased oversight during the Annual Election Period (AEP). For AEP 2023, CMS officials reported conducting “secret shopping” of TPMO sales calls and events, discovering many agents providing inadequate or incorrect information bluepeakadvisors.com. Over 80% of sampled marketing calls reviewed by CMS in 2021 had deficiencies – for example, agents falsely claimed that if a drug wasn’t on a plan formulary the plan would “simply add it,” or told callers “nothing would change” about their current coverage after switching plans cms.gov. Armed with these findings, CMS put plans on notice that it would hold MAOs accountable for their marketers’ behavior, and indeed began issuing compliance actions and penalties to plan sponsors when their TPMOs violate rules bluepeakadvisors.com. This represented a new era of vigilance after a period of lax enforcement.

In summary, the role of TPMOs in Medicare marketing grew significantly over the past decade – from local agents to large-scale call centers and online platforms – but regulatory scrutiny was slow to catch up until the wave of complaints in 2021-2022 forced action. Today, TPMOs are recognized as key actors in MA and Part D enrollment, and they operate under a much sharper regulatory lens than just a few years ago.

CMS Regulations and Recent Rule Changes (2023–2025)

CMS has implemented a series of regulatory updates in 2022–2024 (effective for Contract Years 2023, 2024, and 2025 respectively) to govern TPMO activities. These changes were primarily codified in the Medicare Advantage and Part D communication/marketing regulations (42 C.F.R. §§ 422.2260 et seq. for MA, and parallel § 423.2260 et seq. for Part D). Below is an overview of key rules affecting TPMOs, with emphasis on the major new requirements introduced for CY 2023, 2024, and 2025.

Contract Year 2023 Rule Changes – New TPMO Definition, Disclaimers, and Oversight Requirements

The CY 2023 Final Rule (87 FR 27704, published May 2022) was a landmark in establishing explicit TPMO regulations. In this rule, CMS responded to the complaint surge by targeting third-party marketing practices:

• Formal Definition in Regulation: CMS added for the first time a regulatory definition of “Third-party marketing organization (TPMO)”, as discussed above, to eliminate confusion about whom the new marketing rules cover bressler.com. By defining TPMOs to include agents, brokers, and any compensated third party in the enrollment chain, CMS made clear that the new rules apply broadly – including to independent agents/brokers, call centers, and lead generators, whether or not they are direct contractors of the plan bressler.com.

• Standardized TPMO Disclaimer: CMS mandated a specific disclaimer that all TPMOs must use in marketing communications to inform beneficiaries of their limited plan offerings. The required disclaimer for 2023 was: “We do not offer every plan available in your area. Any information we provide is limited to those plans we do offer in your area. Please contact Medicare.gov or 1‑800‑MEDICARE to get information on all of your options.” bressler.com. This disclaimer must be prominently conveyed: for example, verbally within the first minute of any sales call, on TPMO websites, in electronic communications, and in print or TV ads (in a readable manner) bressler.com bluepeakadvisors.com. The intent is to prevent the misleading impression that a broker represents all Medicare plans when they do not. MA organizations are responsible for ensuring any TPMO selling their plans includes this disclaimer in all beneficiary interactions bluepeakadvisors.com.

• Call Recording Requirement: Starting in 2023, TPMOs are required to record all calls with beneficiaries in their entirety and retain the recordings bluepeakadvisors.com. This includes not only enrollment calls but any call that falls within the “chain of enrollment.” CMS initially interpreted this broadly to mean any call between a TPMO and a beneficiary (e.g. sales presentations, scope of appointment discussions, etc.) must be recorded cms.gov cms.gov. This rule applied to independent agents as well as call centers – even captive (exclusive) agents of one insurer were deemed TPMOs and thus had to record their sales calls cms.gov. The purpose is to create an audit trail for compliance and to deter misrepresentations, as recordings can be reviewed by CMS or plans to investigate complaints bressler.com. Plans were directed to ensure their TPMOs implement call recording systems for all sales/enrollment conversations.

• Expanded Plan Oversight Duties: CMS codified new oversight requirements for plans that use TPMOs bluepeakadvisors.com bluepeakadvisors.com. Even though MAOs were already obligated to oversee first-tier and downstream entities, the rule strengthened this by explicitly requiring that contracts with TPMOs (or with brokers/agents/FMOs managing them) include certain clauses. Plans must ensure that:

1. TPMOs disclose any subcontracted relationships involved in marketing, lead-gen, or enrollment (so the plan knows exactly who is actually making calls or fielding leads on its behalf) bluepeakadvisors.com.

2. All sales and enrollment calls are recorded and available for the plan to monitor bluepeakadvisors.com.

3. TPMOs report violations and disciplinary actions: TPMOs must inform the plan monthly of any staff disciplinary actions or any compliance violations (e.g. an agent found violating CMS rules) related to interactions with Medicare beneficiaries bluepeakadvisors.com. This creates a feedback loop so plans can address problem agents quickly.

4. TPMOs use the required disclaimer in all marketing interactions (as noted above).

Additionally, CMS stressed it is the plan’s responsibility to know how and where their TPMOs are obtaining leads and enrollments bluepeakadvisors.com. In other words, an MAO cannot turn a blind eye to a lead generator’s tactics or a call center’s script – the plan must exercise proactive oversight or face accountability.

• Beneficiary Notification in Lead Generation: The 2023 rule also addressed a common lead-generation abuse: beneficiaries often submitted contact forms or called a number after seeing an ad, and then were surprised to be contacted by a licensed agent. CMS now requires that if a TPMO is collecting a beneficiary’s information for lead generation, the beneficiary must be notified that their information will be provided to a licensed agent for future contact or that they will be transferred to an agent bluepeakadvisors.com. In practice, a lead generator website might need to say (on the form) “By clicking, you agree to be contacted by a licensed insurance agent,” or a call center operator needs to inform the caller “I’m going to connect you with a licensed agent who can discuss plan options.” This ensures the person understands the next step is a sales interaction. Plans must ensure their TPMOs implement this disclosure in lead-gen activities bluepeakadvisors.com.

These changes effective in CY2023 were significant. CMS noted they were prompted by a doubling of marketing-related complaints from one year to the next, and were designed to “clarify” permissible TPMO conduct and enhance beneficiary protections bressler.com bressler.com. Plans and brokers had to implement call recording systems and update scripts/disclaimers by October 2022 for the AEP. TPMOs that failed to comply could trigger compliance actions against their contracting MAOs – for example, CMS warned it would conduct secret-shopper calls and if non-compliance was found, the plan sponsor would be subject to enforcement remedies bluepeakadvisors.com. The immediate impact of these 2023 rules was that independent agents and call centers had to become far more meticulous in their sales process (e.g. reading disclaimers, pressing record on calls) and plans had to strengthen oversight of all marketing partners.

Contract Year 2024 Rule Changes – Enhanced Marketing Restrictions and Oversight

Despite the new 2023 rules, CMS continued to observe undesirable marketing practices through late 2022. Complaints remained high during the 2023 AEP, and regulators (including state insurance commissioners and the NAIC) pushed for further tightening kff.org kff.org. CMS responded with an even more comprehensive set of changes in the CY 2024 Final Rule (88 FR 22120, published April 2023, effective for marketing starting Sept. 30, 2023). This rule included more than twenty revisions to MA/PDP marketing regulations bluepeakadvisors.com, many directly affecting TPMOs. Key provisions included:

• Requirement for Plan TPMO Monitoring Programs: CMS now explicitly requires MA and Part D sponsors to develop and implement formal “agent and broker monitoring and oversight plans.” Plans must have a structured program to monitor their agents and TPMOs and report non-compliant agents to CMS bluepeakadvisors.com. While oversight was always expected, CMS found plans were often reactive rather than proactive bluepeakadvisors.com. Under the new rule, at minimum, a compliant oversight plan should include regular review of complaints (CTM entries and internal grievances) by agent, random sampling and review of audio recordings of sales calls, real-time listening on live calls, and “secret shopping” of sales events (including in-person seminars and online webinars) bluepeakadvisors.com bluepeakadvisors.com. Starting in AEP 2023, if a sponsor discovers an agent or TPMO repeatedly violating rules or causing harm, the plan must report that agent to CMS (by adding them to an official “non-compliant” notification) bluepeakadvisors.com. Minor isolated issues need not be reported, but patterns of misconduct or anything potentially harmful to beneficiaries must be elevated bluepeakadvisors.com. This was a notable shift – CMS essentially mandated that plans police their marketing networks and involve CMS when necessary, creating a pathway to flag “bad actors” across the industry.

• Direct Submission of Marketing Materials by TPMOs: Another change aimed at large marketing firms: if a TPMO creates marketing materials that promote multiple plan sponsors (for example, a national lead aggregator’s TV ad that generates leads for several insurers), that TPMO is now required to submit the materials into CMS’s Health Plan Management System (HPMS) for approval bluepeakadvisors.com. Previously, only plan sponsors submitted marketing materials to CMS. Now, third-party marketing entities that operate across many plans must themselves file materials with CMS after obtaining each sponsor’s prior approval bluepeakadvisors.com. This ensures CMS can directly review multi-plan ads (like generic commercials listing benefits) rather than relying on each plan to file them. It closes a loophole where some ads slipped through unreviewed by CMS by not naming specific plans (they were considered “communications” rather than “marketing”). In fact, CMS also issued sub-regulatory guidance in May 2023 redefining any material that mentions plan benefits with an intent to sell as “marketing” (requiring approval), even if no plan names or premiums are mentioned advocateforagents.com advocateforagents.com. This reinterpretation (effective July 10, 2023) meant that those generic TV ads touting extras like dental, vision, and hearing now must be filed for approval advocateforagents.com advocateforagents.com. In short, TPMOs can no longer produce broad Medicare plan ads without regulatory oversight; everything with a benefit mention is subject to CMS review via HPMS.

• Revised TPMO Disclaimer Wording: CMS updated the required TPMO disclaimer for 2024 to provide more information. The original disclaimer was expanded to include mention of the State Health Insurance Assistance Program (SHIP) as an impartial resource, and to quantify how many organizations and plans the TPMO represents. Now, if a TPMO does NOT represent all plans in an area, it must state: “We do not offer every plan available in your area. Currently we represent \ [insert number of organizations] organizations which offer \ [insert number of plans] products in your area. Please contact Medicare.gov, 1‑800‑MEDICARE, or your local State Health Insurance Program (SHIP) to get information on all of your options.” advocateforagents.com advocateforagents.com. If a TPMO does sell all plans in the area (a rare case, but possible for an aggregator or SHIP), a different disclaimer is used: “Currently we represent \ [insert number of organizations] organizations which offer \ [insert number of plans] products in your area. You can always contact Medicare.gov, 1‑800‑MEDICARE, or your local SHIP for help with plan choices.” advocateforagents.com. These disclaimers still must be given within the first 60 seconds of a call and on all materials advocateforagents.com advocateforagents.com. The addition of plan counts and SHIP is meant to further clarify the TPMO’s scope and remind beneficiaries of unbiased resources.

• Narrowed Scope of Call Recording: CMS heard concerns that the 2023 “record all calls” rule was overly burdensome and not always relevant. The 2024 rule clarified that TPMOs only need to record marketing, sales, and enrollment calls – not every single call with a beneficiary bluepeakadvisors.com. Calls that are administrative in nature (setting up an in-person meeting, following up on a mailed packet, or fielding questions unrelated to sales) no longer require recording bluepeakadvisors.com. The intent is to focus on interactions where a plan is being discussed or sold. However, CMS explicitly stated that virtual/online sales calls (e.g. Zoom or Teams meetings) must have their audio recorded just like a phone call bluepeakadvisors.com. Plans will need to ensure TPMOs understand which calls count as “marketing/sales/enrollment” (essentially any substantive discussion or presentation about plan benefits) and have recording technology for those. This tweak balanced consumer protection with practicality.

• Ban on Misleading Use of Medicare Name or Logo: CMS addressed the phenomenon of ads and websites that mimicked official Medicare communications. The new rule prohibits TPMOs (and plans) from using “Medicare” or other federal terms/logo in a misleading manner bluepeakadvisors.com. For instance, using the Medicare card image or calling your hotline the “Medicare Hotline” is now explicitly forbidden unless approved by CMS. CMS found over a quarter of TV ads in 2022 included imagery of the red-white-and-blue Medicare card or a confusing “Medicare” hotline number kff.org. Now, such usage is a violation if it can trick beneficiaries into thinking the ad or caller is from the government kff.org. Plan sponsors will be held accountable if their marketing partners violate this, so they must ensure TPMOs do not misuse official branding bluepeakadvisors.com.

• Prohibition of Superlatives without Data: Building on existing rules against absolute “best” or “highest rated” claims, CMS now bans unsubstantiated superlative statements entirely, unless current data is cited to support the claim bluepeakadvisors.com. Any claim like “we are the best plan” or “number one in service” must be backed by actual data from the current or prior year and the supporting data must be referenced in the material bluepeakadvisors.com. This affects TPMO marketing because agents often like to pitch a plan as “highest ranked” – now they must have proof (e.g. J.D. Power ratings, CMS star ratings) and include it. Otherwise, such language is prohibited.

• No Advertising Benefits Not Available Locally: CMS now explicitly forbids marketing benefits that are not offered in the area where the ad is running bluepeakadvisors.com. This was to stop the practice of enticing beneficiaries with generous benefits that might only exist in some other state or plan. For example, an ad running in Ohio that mentions a plan benefit (like a $0 insulin program) which isn’t available in any Ohio plans would be prohibited (unless truly unavoidable). TPMOs must tailor their marketing to avoid creating false expectations – e.g. national TV spots should emphasize that benefits vary by ZIP code, or better, segment ads regionally. If a benefit mention is unavoidable in a mixed market (rare scenario), CMS expects a clear disclaimer. The bottom line: don’t bait consumers with benefits they can’t actually get through the plans you’re offering in their area bluepeakadvisors.com.

• Plan Name Must Be on All Marketing Materials: To reduce confusion from generic ads, CMS now requires that any marketing material must clearly display the name of the MA organization or Part D sponsor being advertised bluepeakadvisors.com. No more opaque come-ons like “Call now to upgrade your Medicare!” without identifying who it’s for. If a broker is advertising multiple plans, they likely need to list the plan names or at least the carrier names in the material. This helps consumers know the source of the advertisement and also helps regulators trace which plan(s) a misleading ad was promoting bluepeakadvisors.com. This rule dovetails with the material submission rule – if a TPMO ad lists multiple plan names, it presumably will be reviewed by each named plan and by CMS.

• Reinstating the 48-Hour Scope of Appointment Rule: CMS brought back a consumer protection that had been removed: the requirement that a Scope of Appointment (SOA) form be completed at least 48 hours prior to a personal marketing appointment, unless the beneficiary initiates a same-day meeting or is in the last few days of an enrollment period bluepeakadvisors.com. The SOA is a document outlining what will be discussed (e.g. MA plans, Part D plans) and is meant to prevent surprise sales pitches. Now, for scheduled appointments, agents should obtain the SOA 48 hours in advance (e.g. by mail or email) bluepeakadvisors.com. Exceptions: walk-in appointments or if an enrollment period is ending within 4 days (then 48 hours might not be feasible) bluepeakadvisors.com. This rule had been loosened in 2018, but due to renewed concern about high-pressure sales, it’s back. TPMOs must adjust their processes to comply (e.g. an agent can’t immediately pivot an educational event attendee into a sales meeting without waiting 48 hours and getting an SOA, unless it’s beneficiary-initiated).

• Separation of Educational and Marketing Events: CMS now prohibits holding a sales/marketing event within 12 hours of an educational event in the same location bluepeakadvisors.com. This aims to prevent agents from luring seniors to a “Medicare 101” session and then immediately switching to a sales pitch. The 12-hour, same-building separation ensures there’s a cooling-off period and clear delineation. “Same location” is defined broadly as the same building or adjacent buildings bluepeakadvisors.com. So an agent cannot host a morning “educational” talk at a community center and then a noon plan sign-up meeting next door. This reinstates prior CMS policy and reinforces the distinction between education (no selling, just general info) and marketing (sales) events.

• Ban on Distribution of SOAs at Educational Events: In line with keeping educational events non-salesy, CMS now forbids collecting Scope of Appointment forms or setting future marketing appointments during an educational event bluepeakadvisors.com bluepeakadvisors.com. Agents may hand out business reply cards (BRCs) for attendees to request follow-up, since BRCs are a passive vehicle controlled by the beneficiary bluepeakadvisors.com. But agents can no longer proactively snag SOAs or lock down one-on-one meetings while purporting to “educate.” This prevents blurred lines between educating and selling.

• Time Limits on Contact Permissions: CMS decided that beneficiary consent for contact should not be open-ended. The rule places a 12-month expiration on SOAs, BRCs, or any permission to contact bluepeakadvisors.com. In other words, if a beneficiary filled out a card or gave an SOA last year, a TPMO cannot keep contacting them indefinitely on that old consent. After a year, the consent is stale and new permission is needed to discuss plans. This protects seniors from being hounded years later due to one inquiry. TPMOs must track dates of consent cards and purge or refresh those older than 12 months.

• Pre-Enrollment Checklist (PECL) Enhancement: CMS uses a Pre-Enrollment Checklist to ensure agents review key points (like provider network, drug coverage, etc.) with prospective enrollees. Complaints showed beneficiaries often didn’t realize their prior coverage (like an employer plan or Medigap) would end once they enrolled in an MA plan. Thus, CMS added “effect on current coverage” as a required discussion item on the PECL bluepeakadvisors.com. Agents/TPMOs must explicitly inform people, for example, “if you have VA benefits or Medigap, those may change or you can’t use them if you enroll in this MA plan.” Moreover, for telephonic enrollments, the agent must go through the PECL with the caller before submitting the application bluepeakadvisors.com. Plans can decide whether the entire checklist must be read verbatim or if a conversational review is acceptable, but the agent must confirm the beneficiary understands these points bluepeakadvisors.com. This is a safeguard so that enrollments are fully informed and there are no surprises.

The above list covers many of the 2024 rule updates aimed at TPMO practices. The overarching theme was tightening controls to prevent misleading marketing and forcing plans to actively police their marketing agents. These changes became effective for the marketing cycle that began October 1, 2023 (for CY 2024 enrollments) bluepeakadvisors.com. CMS made clear these policies were driven by the continued high volume of marketing complaints and documented confusion caused by certain third-party ads bluepeakadvisors.com. Essentially, CMS “raised the bar” for marketing conduct: transparency, truthfulness, and accountability are the new watchwords.

For compliance officers and marketers, the 2024 final rule required significant adjustments – from rewriting disclaimers and ad copy, to retraining agents on what they can/can’t say or do, to enhancing monitoring protocols. Insurers had to revise contracts with agencies and FMOs to incorporate the new provisions (e.g. requiring an oversight plan, specifying updated disclaimer usage, etc.), and to update internal compliance checklists in line with CMS’s expanded list of prohibited marketing practices.

Contract Year 2025 Rule Changes – Data Privacy, Consent, and Compensation Reforms

CMS’s most recent rulemaking, the CY 2025 Final Rule (89 FR 27732, released April 2024), builds on prior changes with a focus on protecting beneficiary data and curbing problematic compensation arrangements involving TPMOs. Key provisions affecting TPMOs and their partner plans include:

• Restrictions on TPMO Lead Sharing – Prior Consent Requirement: CMS is cracking down on the trafficking of beneficiary contact information among marketing firms. In the past, a senior might call one toll-free number or click on a website, only to have their phone ring off the hook from various other companies due to lead reselling. **Starting with CY 2025, a TPMO that collects a beneficiary’s personal data for marketing or enrollment **may not share or sell that data to another TPMO without the beneficiary’s prior express written consent cms.gov sheppardhealthlaw.com. Each instance of data sharing requires a separate clear and conspicuous consent specific to the recipient entity sheppardhealthlaw.com. Blanket consents (e.g. one checkbox that authorizes sharing with “marketing partners”) will no longer suffice – the consent must be one-to-one. For example, if an online lead generator wants to sell a lead to three insurance agencies, the beneficiary must have affirmatively agreed to be contacted by each of those three (perhaps by listing them by name in the consent form) activeprospect.com. Moreover, TPMOs cannot condition access to information or services on the beneficiary agreeing to share their data activeprospect.com. This aligns with consumer protection norms (similar to FTC/FCC rules) and effectively halts the common industry practice of widespread lead brokering without explicit consumer permission. The rule does allow live “warm transfers” between TPMOs as a limited exception: if a beneficiary is on a call with TPMO A and verbally agrees to be transferred to TPMO B and is immediately connected, that real-time consent is sufficient without a written form sheppardhealthlaw.com. But if TPMO A wanted to later give/sell the person’s number to TPMO B to call them later, written consent is required. This new consent regime takes effect October 1, 2024 (for AEP leading into 2025) activeprospect.com. Practically, TPMOs that generate leads (e.g. internet sites, call centers) must overhaul their consent collection methods – likely by adding explicit consent checkboxes or signed agreements for any downstream transfers. MA plans and FMOs will also need to ensure any leads they purchase come with the proper consent trail, or else they risk violating CMS rules by using “tainted” leads.

• Anti-Steering and Compensation Reforms: CMS is also addressing concerns that compensation structures for agents, brokers, and TPMOs have led to biased plan recommendations. Traditionally, plans pay agents a CMS-capped commission (fair market value or “FMV” amount) for each enrollment, and could also pay additional “administrative” fees or bonuses. CMS observed that certain large FMOs and TPMOs were receiving lucrative bonus payments or overrides that might incentivize them to favor one carrier over another sheppardhealthlaw.com sheppardhealthlaw.com. For example, a plan might offer a higher bonus per enrollment once an agent sells 100 policies, or pay FMOs for “marketing support” beyond the actual enrollment commission. The 2025 rule makes several changes:

• No Anti-Competitive Contract Terms: CMS prohibits MAOs and Part D sponsors from including any contract terms with agents, brokers, or TPMOs that create an incentive to steer beneficiaries to particular plans for reasons other than the beneficiary’s needs cms.gov sheppardhealthlaw.com. It explicitly calls out volume-based or preferential bonuses as problematic. For instance, an agreement that says “if you enroll 50 members, we’ll pay an extra $X per member for all enrollments” or “maintain a 50% market share with our plan or lose your contract” would be impermissible sheppardhealthlaw.com. Such clauses could cause agents to push one plan to hit targets rather than objectively helping the client. CMS will enforce this by reviewing agent/FMO contracts (they indicated they may request contracts during audits or via the OIG) sheppardhealthlaw.com. Plans must remove any “quid-pro-quo” terms that could inhibit an agent’s impartiality.

• Unified, Fixed Compensation Rates: CMS is redefining “compensation” for agents/brokers to include virtually all payments related to enrollment activities cms.gov sheppardhealthlaw.com. In the past, certain payments (marketing support, training fees, etc.) were not counted under the commission cap. Going forward, the compensation will be a single fixed amount (for initial enrollments and a smaller fixed amount for renewals) that is the same across all plans. CMS is effectively setting a national standard commission. In the final rule, CMS decided to raise the baseline commission by $100 for initial MA enrollments compared to the proposal cms.gov sheppardhealthlaw.com, to account for incorporating those prior ancillary payments. The result is that starting in CY 2025, all MA plans will pay the same flat commission (the exact dollar value will be published by CMS) and cannot compete by offering higher commissions. This removes financial bias in plan choice – an agent will make the same amount no matter which MA plan they enroll the client in. It also simplifies oversight because plans no longer need to report compensation structures; CMS will know the rate.

• Elimination of Separate Administrative Fees: As part of the above, CMS is eliminating the allowance for separate administrative payments to TPMOs sheppardhealthlaw.com sheppardhealthlaw.com. Payments for things like lead generation, appointment setting, or other services must now be rolled into the unified compensation or paid at fair market value outside of enrollment. The goal is to prevent disguised extra commissions. By folding everything into one standardized commission, CMS aims to stop the “bidding war” among plans using higher payments to gain distributor favor sheppardhealthlaw.com sheppardhealthlaw.com. Agents and FMOs should see more transparency and consistency in what they are paid, and ideally will focus on fitting the beneficiary to the best plan rather than chasing a bonus.

These 2025 changes underscore CMS’s focus on consumer protection and market fairness. The data-sharing consent rule is fundamentally about privacy and choice: beneficiaries should control who contacts them and not be unwittingly subject to dozens of sales calls due to fine-print consents cms.gov cms.gov. The compensation changes are about removing perverse incentives that could lead to high-pressure tactics or biased advice cms.gov cms.gov. From a compliance perspective, MA organizations will need to amend their broker/FMO contracts for 2025 to ensure no prohibited terms and to align with the new compensation framework. Many insurers will be revising how they pay FMOs and agents (for example, replacing tiered bonus schemes with the flat CMS-defined amount). TPMOs that historically relied on large override bonuses will need to adjust their business models.

Table: Summary of Major TPMO-Related Rule Changes (2023–2025)

To recap the evolution of requirements, the table below highlights key regulatory changes for TPMOs in each of these recent rule-making cycles:

Sources: 87 Fed. Reg. 27704 (May 9, 2022) cms.gov cms.gov; 88 Fed. Reg. 22120 (Apr. 12, 2023) bluepeakadvisors.com bluepeakadvisors.com; 89 Fed. Reg. 27732 (Apr. 12, 2024) cms.gov cms.gov; and associated CMS fact sheets/guidance.

As the table illustrates, the regulatory framework has rapidly evolved in just a few years. These rules are now largely codified in 42 C.F.R. §§ 422.2260–422.2267 and 423.2260–423.2267, with additional requirements in agent/broker compensation regulations (§§ 422.2274, 423.2274, etc.). CMS is also updating its sub-regulatory guidance (like the Medicare Communications and Marketing Guidelines) to reflect these changes bluepeakadvisors.com bluepeakadvisors.com. Compliance officers should be aware that CMS may continue to refine these rules annually, depending on industry behavior and beneficiary feedback.

Compliance Obligations for TPMOs and Medicare Advantage Organizations

The new regulations impose compliance obligations on both TPMOs and the plan sponsors (MAOs/PDPs) that utilize them. In essence, Medicare plans are accountable for ensuring any third-party marketers abide by CMS rules, and TPMOs in turn must adhere to a stringent set of requirements or risk losing plan contracts and facing regulatory action.

Obligations on MA Organizations and Part D Sponsors (Plans):

• Oversight and Monitoring: MAOs and Part D sponsors must actively oversee all TPMO activities related to their plans. CMS has underscored that plans are responsible for their first-tier, downstream, or related entities’ compliance with Medicare’s rules bressler.com. This means if a TPMO (even one not formally contracted but working indirectly through an FMO) engages in misconduct, CMS will hold the plan sponsor liable bluepeakadvisors.com. As described earlier, plans are now required to have a written monitoring plan for agents and TPMOs bluepeakadvisors.com. They should conduct regular audits: listen to call recordings, secret-shop sales events, track complaints by agent, etc. bluepeakadvisors.com bluepeakadvisors.com. If patterns of non-compliance are found, plans must take corrective action and, for serious cases, report the agent/TPMO to CMS starting in 2023 bluepeakadvisors.com.

• Contractual Controls: Plans must insert specific clauses into contracts or agreements with any TPMO (or with agencies that contract TPMOs) to enforce CMS requirements bluepeakadvisors.com. Required provisions include:

• TPMO must reveal all subcontractors it uses for marketing or lead-gen (no undisclosed “downline” call centers) bluepeakadvisors.com.

• TPMO must record and retain all marketing/sales calls with beneficiaries bluepeakadvisors.com.

• TPMO must provide monthly compliance reports of any violations or disciplinary actions related to Medicare marketing bluepeakadvisors.com.

• TPMO must use the CMS-required disclaimer in all marketing content bluepeakadvisors.com bluepeakadvisors.com.

• Starting 2024, contract language should reflect updated rules (e.g. new disclaimer text, recording only certain calls, etc.) bluepeakadvisors.com.

• By 2025, contracts must avoid any commission structures that conflict with CMS compensation rules (e.g. volume bonuses) sheppardhealthlaw.com.

Plans should review and update all broker and vendor agreements to incorporate these points. If a plan delegates marketing to an FMO, the plan must ensure the FMO flows these requirements down to any independent agents or call centers they engage.

• Training and Communication: Plan sponsors are expected to convey all new regulations and guidance to their TPMOs. CMS expects sponsors to ensure TPMOs are aware of and trained on the rules bluepeakadvisors.com. Best practice is for plans to provide compliance training or bulletins to all contracted agents and agencies whenever CMS updates policies. For example, after the 2024 final rule, plans should train TPMOs on the new disclaimer, the do’s and don’ts of marketing (no superlatives, no misleading Medicare references, etc.), and the new consent requirements for lead sharing. Regular training and attestation can demonstrate the plan’s good-faith efforts to prevent violations.

• Approval of Marketing Materials: Plans must rigorously review any marketing materials developed by TPMOs for their plan. Every marketing piece needs the plan’s sign-off before submission to CMS. If a TPMO is multi-plan, the sponsor should coordinate with the TPMO and other plans to ensure the material is submitted to CMS by the TPMO (as required) once all plan approvals are in place bluepeakadvisors.com. Plans should not allow unapproved materials to be used; doing so could result in CMS enforcement if discovered. Additionally, plans should verify that all materials include required elements (disclaimers, plan name, etc.) and do not include prohibited content. Routine spot-checking of advertisements (TV, online, mailers) is advisable to catch any compliance issues early bluepeakadvisors.com bluepeakadvisors.com.

• Monitoring Lead Generation and Sales Conduct: Plans need to know how TPMOs are generating leads and what they are doing with them. CMS explicitly stated plans must have knowledge of how/where TPMOs obtain leads or enrollments bluepeakadvisors.com. This implies plans should inquire and document the lead sources used by their marketers (e.g. web ads, purchased lists, cold-calling – note cold calls to Medicare beneficiaries are prohibited unless there’s prior consent). With the new data-sharing consent rule for 2025, plans should ensure any leads delivered by a TPMO have the proper consents attached. On sales conduct, plans should consider requiring TPMOs to use approved scripts for presentations and calls (indeed, some carriers now mandate agents to follow a script, especially for telesales advocateforagents.com). Plans also must keep an eye on complaint metrics: rapid disenrollments (“rapid dis-enrolls” within 90 days of joining) often indicate a potentially misleading sale, and CMS expects plans to monitor those by agent as a performance indicator bressler.com.

• Accountability and Corrective Action: If a TPMO violates the rules, the plan sponsor is expected to take corrective action. This can range from retraining the agent, to issuing a warning, to terminating the relationship for egregious or repeated offenses. CMS has signaled that it will use compliance and enforcement actions against plans when serious marketing violations occur bluepeakadvisors.com. Those enforcement actions might include Civil Money Penalties (CMPs) or even intermediate sanctions (like suspending a plan’s enrollment activities) for systematic issues cms.gov. Therefore, plans have a strong incentive to self-police their TPMOs to avoid larger regulatory penalties.

Obligations on TPMOs (Agents, Brokers, Marketing Firms):

• Adhere to All Marketing Rules: TPMOs must conduct their marketing and sales in strict compliance with Medicare’s marketing regulations and the guidance from their contracted plans. This means using the required disclaimer on all materials and calls bressler.com, ensuring truthful and non-misleading information is given, and following all the prohibitions (no unsolicited contacts beyond what’s allowed, no using Medicare name falsely, etc.). Agents should familiarize themselves with the entire list of “Prohibited Marketing Practices” CMS enumerates (many of which were updated in 2023/2024). For example, TPMOs cannot cold-call prospective enrollees (calling a Medicare beneficiary without prior consent is forbidden under both CMS and TCPA/telemarketing rules), cannot send unsolicited emails without an opt-out, cannot approach beneficiaries in common areas (like parking lots) to solicit, etc. They also must not cross-sell non-health products during a Medicare sales presentation (e.g., pitching life insurance during a Medicare Advantage meeting is prohibited). All these rules, historically in CMS guidelines, now carry the weight of regulation.

• Call Recording and Record Retention: Agents and TPMO call centers need to record all required calls (and starting in 2024, at least all marketing, sales, enrollment calls) and store those recordings securely for the required retention period (typically 10 years under CMS record retention requirements for plan sponsors, which likely applies similarly to their FDRs). If a beneficiary requests their call recording or if CMS audits, the TPMO should be able to produce it. Failure to record or retain could be seen as a violation. Additionally, for virtual sales meetings (Zoom, etc.), the audio must be recorded bluepeakadvisors.com, so TPMOs need technology solutions for that.

• Providing Required Notifications: During any lead generation interaction, TPMOs must give the notice about an agent contacting them, as noted before bluepeakadvisors.com. Also, if using online forms, the privacy policy or consent language should reflect the new one-to-one consent rule by 2025: the form should list any specific partner companies that might follow up, rather than a blanket “partners may call you.” Post-2024, TPMOs that want to share a lead must implement a system to collect express written consent (e.g., an electronic signature or checkbox that explicitly names the other TPMO).

• Monthly Reporting to Plans: TPMOs are on the hook to self-report any compliance issues to the plans they work with bluepeakadvisors.com. In practice, an agent who gets a state insurance department sanction or a consumer complaint should be reporting that to their upline or directly to the plan as required. Similarly, TPMO organizations may need to submit a log each month to each plan listing any known issues (e.g., “Agent John Doe – reprimanded for not using disclaimer on two calls, retrained on 10/15”). This is a significant new compliance step – TPMOs need internal tracking of potential violations and a process to disclose them. Not reporting and later having CMS uncover an issue could be very problematic.

• Disclose Subcontractors and Business Relationships: If a TPMO outsources any piece of its operation (say a call center hires a third-party telemarketing firm, or a lead generator uses an external data vendor), those relationships must be disclosed to the plan bluepeakadvisors.com. Practically, TPMOs should maintain an updated list of all downstream entities and provide that to the plan. Some plans now ask agents to fill questionnaires about how they market (e.g., do you buy leads? from whom? do you have telemarketers working for you?). Full transparency is required. By 2024, plans may also require TPMOs to notify them when they add a new subcontractor and possibly require approval bluepeakadvisors.com.

• Submission of Materials to CMS: If a TPMO creates marketing material that is generic or multi-plan (for instance, a website that compares plans, or a TV ad that invites calls for Medicare plan help without naming a plan), the TPMO may now be responsible for submitting that through HPMS once plans sign off bluepeakadvisors.com. This is a new operational duty that many third-party marketers didn’t handle before (it was always the plan filing things). So TPMOs might need to get access to HPMS through a plan sponsor or coordinate closely with one lead plan to do the filing. Ensuring all marketing materials are approved by CMS prior to use is absolutely required; using unapproved materials is a severe violation.

• Consent Management: Under the 2025 rules, TPMOs that want to share leads will need to manage the prior express written consent (PEWC) documentation. This is analogous to compliance with the Telephone Consumer Protection Act (TCPA) for marketing calls: TCPA already requires prior express written consent to call a consumer’s cell phone for telemarketing. Now CMS adds that plus consent for passing the data along. So a best practice for TPMOs is to integrate consent capture (electronic signatures) that clearly name each party. They should also be prepared to show proof of consent if asked by a regulator or consumer – meaning storing the consent forms/records. ActiveProspect (the source of the blog we saw) and similar companies offer lead certification services that might become more commonly used in this space activeprospect.com. TPMOs cannot simply rely on fine print; they need auditable consent records.

• Avoiding Prohibited Conduct: This is broad but crucial – TPMOs must be vigilant to avoid any practices CMS or other authorities have flagged as unlawful or misleading. For example:

• No high-pressure or “scare tactic” language (e.g. “This is your last chance to get benefits” or implying the agent is from Medicare).

• No enrolling a beneficiary without their agreement (seems obvious, but complaints indicate some bad actors were enrolling people who just inquired). The enrollment process must include a clear application signature or recorded affirmation from the beneficiary.

• No “churning” – i.e., repeatedly switching someone’s plan for compensation without a meaningful benefit to the person.

• Ensuring any telephonic enrollment includes reading required statements and now reviewing the Pre-Enrollment Checklist including effect on other coverage bluepeakadvisors.com.

• Complying with state laws as well – many states have their own rules for marketing Medicare plans (often aligning with CMS, but states may add, for instance, that agents must say their first name and state license number at the start of a call, etc.). TPMOs should check state insurance department bulletins for any additional requirements.

In sum, TPMOs have a duty to conduct themselves as extensions of the plan in the eyes of CMS. A good mindset is that anything the plan itself is prohibited from doing, the TPMO must also avoid. CMS officials have explicitly said they consider TPMOs subject to the same requirements as plans when performing those functions bluepeakadvisors.com bluepeakadvisors.com. So compliance officers at TPMOs should maintain robust policies mirroring CMS rules and ensure all their agents/staff are trained and periodically audited.

Notably, independent agents (who might consider themselves “just one person” not a big organization) are still TPMOs and must comply fully advocateforagents.com. This has been a point of confusion among some agents, but CMS and industry communications have reinforced that yes, even one independent broker is a “TPMO” under the rules and must, for example, record their sales calls and use the disclaimer cms.gov cms.gov.

Risks, Penalties, and Enforcement Actions for TPMO Non-Compliance

Non-compliance with the above obligations poses serious risks to both plans and TPMOs. CMS has several enforcement tools to address marketing violations, and it has signaled a willingness to use them more aggressively in light of recent issues. Key risks and penalties include:

• Civil Money Penalties (CMPs): CMS can impose financial penalties on Medicare Advantage or Part D plan sponsors for each violation of marketing regulations or for each affected enrollee. For example, if a plan’s contracted TPMO ran an unapproved advertisement or made misleading claims that led to enrollments, CMS might levy a CMP per incident. CMPs can range from thousands to tens of thousands of dollars depending on the violation’s severity and scope (often indexed by the number of beneficiaries impacted). In 2023, CMS reportedly issued CMPs to some plans based on marketing misrepresentations by their agents, indicating the agency’s intent to hold plans financially accountable.

• Enrollment/Marketing Sanctions: CMS can impose intermediate sanctions on a plan, such as suspension of the plan’s ability to market or enroll new members, if it determines there’s a systemic problem (e.g. a pattern of deceptive marketing). Such a sanction is a strong corrective measure – it essentially freezes the plan’s growth until issues are fixed and CMS is satisfied. Given how competitive MA enrollment is, this is a severe outcome that plans desperately want to avoid. If, for instance, a plan is found to have consistently neglected oversight such that multiple TPMOs under its umbrella misled consumers, CMS could decide to halt that plan’s new enrollments until trust is restored cms.gov. Historically, marketing sanctions were used in the late 2000s against some plans for agent misconduct. We may see a return of that approach if abuses continue.

• Termination of Contracts: In extreme cases, CMS could initiate action to terminate a plan’s Medicare contract for non-compliance. While marketing issues alone would rarely escalate to termination, if combined with other compliance failures, it’s possible. Additionally, state insurance departments can take action against agents and brokers – including license revocation – for fraudulent or egregious practices. If a TPMO were involved in widespread fraud (for example, forging enrollment signatures or willfully misrepresenting plans), individuals could face not only administrative penalties but also potential legal action (consumer protection lawsuits or even criminal fraud charges in rare cases).

• Compliance Letters and Corrective Action Plans: More commonly, CMS might issue a compliance notice or warning to a plan if it detects marketing issues (e.g., through secret shopping or complaint patterns). The plan would then have to file a Corrective Action Plan (CAP) detailing how it will remediate the issue (such as terminating a rogue agent, retraining all agents on a certain rule, or sending clarification letters to misled enrollees). The plan’s performance will be monitored for improvement. Multiple compliance notices without correction could escalate to the penalties above.

• Star Ratings Impact: Medicare Advantage plans have star ratings that incorporate various performance measures. One measure involves beneficiary complaints (from the CTM – Complaint Tracking Module). A surge in complaints about a plan’s marketing could indirectly hurt its star rating because CMS tracks complaint rates per thousand enrollees. In 2022, CMS in fact created a measure to identify plans with high marketing complaints and potentially ding their ratings finance.senate.gov. This means plans have a clear incentive to minimize complaints – which in practice means ensuring their TPMOs are not generating grievances. A lower star rating has downstream effects (like losing a quality bonus or being less attractive to consumers). Thus, TPMO non-compliance can tangibly affect a plan’s business through the star ratings system.

• Damage to Reputation and Beneficiary Harm: Beyond formal penalties, there are reputational and ethical risks. Plans associated with deceptive marketing can suffer reputational damage with consumers and regulators. Likewise, TPMO companies caught in bad acts might lose their contracts with multiple insurers (as insurers move to distance themselves). We’ve seen instances where large insurers cut ties with certain lead vendors after compliance issues. There’s also the direct harm to beneficiaries: enrollment in an unsuitable plan due to misinformation can lead to unpaid medical bills or loss of provider access, causing real financial or health consequences for the individual. Regulators prioritize preventing such harm, and if it occurs, they may require the plan to remedy it (for example, by offering a special enrollment period to affected members to switch out of a wrongly sold plan).

• Federal and State Investigations: Intense scrutiny continues from bodies like the Senate Finance Committee and state Attorneys General. For example, the Senate report in 2022 highlighted that some TPMOs were cold-calling seniors or enrolling them without consent finance.senate.gov. As a result, one recommendation was to increase oversight and potentially involve law enforcement for fraudulent marketing finance.senate.gov finance.senate.gov. The Federal Trade Commission (FTC) has also gotten involved in related areas – in 2022 the FTC filed a complaint against Benefytt Technologies (a parent of a Medicare lead generation firm) for deceptive marketing of health plans finance.senate.gov finance.senate.gov. While that case was more about short-term health insurance, it signals willingness to tackle misleading health marketing. A TPMO engaging in blatantly deceptive advertising could conceivably face FTC action under unfair/deceptive acts statutes, in addition to CMS action. State insurance regulators likewise can fine agencies or revoke licenses.

Enforcement examples to date: CMS rarely publicizes specific agent actions, but anecdotal reports from the 2023 AEP indicated CMS did order certain misleading TV ads off the air. In one instance, CMS in October 2022 directed MA organizations to withdraw any ads that failed to mention a specific plan name or that used words/imagery that could confuse beneficiaries (essentially implementing ahead of schedule what became the 2024 rule) ahcancal.org. This was reported in industry press when CMS intervened to stop some generic commercials ahcancal.org. Additionally, some large brokers have reportedly been audited or warned. We can expect that CMS will continue “secret shopping” and might publish summary findings or best practices based on those efforts. The October 2022 HPMS memo by CMS (from the Medicare Drug & Health Plan Contract Administration Group) explicitly said CMS would monitor and take compliance actions for misleading marketing, citing secret shopper call results bluepeakadvisors.com. Plans then were urged to self-police as a result.

In short, the cost of non-compliance can be high: monetary fines, lost business (if you can’t market/enroll for a period), and even legal liability. Both plans and TPMOs must treat compliance as a top priority to avoid these outcomes. The environment now is such that regulators are actively looking for cases to make examples of, to deter would-be bad actors and rebuild trust after the widely publicized marketing issues.

TPMO Operational Models: Lead Generation, Enrollment Platforms, and Telesales

TPMOs do not all operate in the same way; rather, several distinct operational models have developed in the Medicare marketing space. Understanding these models is important for tailoring compliance oversight and recognizing how regulations apply in each context:

• Lead Generation Firms: These TPMOs specialize in capturing consumer interest and contact information, then passing leads to parties who will complete the sale. Lead gen TPMOs often run online comparison websites, social media ads, TV commercials, or mass mail campaigns that invite Medicare beneficiaries to request more information. For example, a website might ask users to enter their zip code and phone number to see available plans, or a TV ad might have viewers call a toll-free number (“Call now to see what benefits you deserve!”). The lead gen entity typically does not directly enroll the beneficiary; instead, it sells or transfers the lead to insurance agents or insurers. Some well-known examples include sites like Medicare.com (under private ownership) or helplines that are actually fronts for broker networks. Lead generators may be paid per lead or per successful enrollment referral. Compliance challenges in this model include ensuring the advertising is accurate (not overpromising benefits) and that consent is properly obtained for any subsequent contact (especially after the new prior consent rule activeprospect.com). Also, lead gen firms must use the TPMO disclaimer so consumers know they aren’t seeing every plan bressler.com. With the 2025 changes, lead generators must be particularly careful about sharing leads: they need to implement one-to-one consent for each downstream buyer of the lead sheppardhealthlaw.com. Many of the notorious issues (like the Joe Namath ads via the “Medicare Coverage Helpline”) fall under this model – a lead gen ad that funneled callers to a network of brokers finance.senate.gov finance.senate.gov. As regulators crack down, lead gen TPMOs are adapting by including more disclaimers and transparency, but they remain a focal point for oversight because they are often the first touch point for beneficiaries and set the expectations.

• Telesales Call Centers: These TPMOs handle the entire enrollment process over the phone. They typically employ licensed agents who can discuss plan options with a caller and enroll them during the call. Telesales operations might be run by large insurance agencies, FMOs, or even by third-party vendors contracted by plans. Some are inbound-only (taking calls from interested leads, often supplied by lead gen efforts), while others make outbound calls to prospects who have given permission (for instance, following up on a lead card or web inquiry – never cold-calling without consent). Call center TPMOs often represent multiple insurance carriers, allowing them to compare several plans for the caller (hence the importance of the disclaimer that they might not have every plan). They typically record calls (now required by regulation) and often follow scripts to ensure compliance. The operational challenge here is quality control: ensuring hundreds of agents on the phones are all providing accurate, complete information and not using high-pressure tactics. This is where recording and monitoring is critical – supervisors should regularly review call recordings. CMS’s secret shopping found some large call centers failed to explain key information or gave wrong info in the majority of calls cms.gov cms.gov. Thus, these organizations have had to implement stronger training and oversight. Telesales TPMOs must also manage Scope of Appointment rules (now needing 48-hour lead time for appointments if outbound) and the PECL checklist for enrollments bluepeakadvisors.com. A subset of this model includes “Enrollment hotline” services that insurers might hire – e.g., a plan might contract a third-party call center to handle enrollment calls during open enrollment. In those cases, even if the call center only sells that one plan, CMS considers them a TPMO (compensated third party) and all rules (like recording) apply.

• Field Marketing Organizations (FMOs) and Agent Networks: An FMO is essentially a wholesaler/distributor in the insurance market that recruits independent agents to sell carriers’ products. FMOs often provide marketing support, training, and leads to their agents in exchange for an override commission from the carriers. FMOs can be considered TPMOs if they perform marketing functions (many do – they might have websites or run ads to generate leads for their downline). However, a lot of FMO activity is about enabling face-to-face sales by independent agents. For compliance, plans need to ensure FMOs pass through all requirements to their agents. FMOs might run customer relationship management (CRM) platforms or enrollment platforms for agents, which need to incorporate disclaimers and compliance checkpoints (for example, requiring an agent to confirm they provided the disclaimer and got an SOA before letting them submit an app). FMOs also often hold educational and marketing events via their agent force, so the rules about separating educational from sales events, not collecting SOAs at educational events, etc., must be communicated to every agent in the field. Another operational consideration is complaint tracking: an FMO may have oversight of a thousand independent agents – they should have systems to track complaints per agent and to quickly address any issues (especially since plans will ask the FMO for those monthly violation reports). Large FMOs have compliance departments now to keep their agents in line, because a compliance failure by one agent can jeopardize the FMO’s contract with a carrier.

• Digital Enrollment Platforms: In recent years, several online services have emerged that allow beneficiaries to compare and enroll in MA or Part D plans through a website. These include insurer-run tools and third-party websites (like eHealth, MedicarePlanFinder, and others). These platforms often still involve a licensed agent “behind the scenes” (for regulatory reasons, often an agent must complete the enrollment or at least be attributed to it), but the consumer experience is primarily digital. These platforms are TPMOs if they are not owned by a plan. They must follow the marketing rules in their web content: e.g., display the TPMO disclaimer on the website bluepeakadvisors.com, ensure that any plan information is accurate and approved by CMS (plans must approve the content/information being shown about their plan). If the platform doesn’t show all plans, it must clearly state that (which is the point of the disclaimer). For compliance, these platforms also have to follow the new data sharing consent rules – if they plan to share a user’s data for follow-up by partners, they need to get express consent naming those partners. The platforms also often request the user’s contact info to allow licensed agents to call and assist; that initial contact has to be consented and likely recorded if it turns into an enrollment discussion. Digital TPMOs need robust privacy policies and consent forms now to ensure they aren’t inadvertently “selling” data in violation of CMS’s new rule. Another nuance: some digital brokers have arrangements to appear on Medicare.gov’s Plan Finder tool as enrollment partners – those come with additional CMS oversight. Overall, while digital platforms promise convenience and choice, they must meet the same standards of neutrality and clarity. Any decision-support tools they use (like showing certain plans first) should be justifiable and not misleading.

• Hybrid Models: Many TPMOs operate in multiple channels. For instance, a company might run TV ads (lead gen), have an inbound call center (telesales), and also provide leads to field agents via an FMO structure. Compliance becomes complex as they must cover all bases. Additionally, some carriers use “captive” TPMOs – external agencies dedicated to selling one carrier’s products. Even though they represent one carrier, if they are not direct employees, they are third-party and the rules like call recording still apply (captive agents are explicitly within the TPMO definition) cms.gov.

Regardless of model, the chain of enrollment concept ties them together: from the moment a beneficiary’s attention is captured (lead gen) through the sales conversation (telesales/agent) to the enrollment completion (submission via platform or call), CMS wants transparency and accuracy at each step. Each type of TPMO must implement the appropriate controls for their piece of the chain.

For compliance officers, it’s critical to map out “who does what” in your organization’s marketing funnel. Identify if you function as lead generator only, or full-service enrollment, or an FMO managing others. Each function has targeted rules (e.g. consent forms for lead gen, call scripts for telesales, agent oversight for FMOs). Ensuring that every stage – advertising, lead capture, sales pitch, enrollment – is compliant will collectively ensure the entire chain is compliant.

CMS Guidance Documents and Memoranda Shaping TPMO Oversight

In addition to formal rulemaking, CMS has issued guidance documents, memoranda, and FAQs that provide interpretation and expectations regarding TPMO activities. Some notable ones include:

• October 8, 2021 CMS Memorandum on Third-Party Marketing: This was an early warning shot to MA plans about the conduct of third-party marketers bressler.com. In this memo (referenced in the Bressler legal update), CMS reminded plans that they are responsible for FDR compliance bressler.com and highlighted that even ads not mentioning a specific plan constitute marketing if they mention benefits or costs bressler.com. CMS laid out best practices for plans: e.g., conducting follow-up calls to new enrollees to ensure they understand their plan, monitoring rapid disenrollments for signs of mis-selling, listening to sales call recordings, requiring lead sources to be disclosed, etc. bressler.com. Many of these suggestions foreshadowed the rules that would come (like recording calls, identifying lead sources) bressler.com. Compliance officers likely have this memo in their archives; it signaled that CMS was tracking the issue closely even before formal rules hit.

• May 9, 2022 Contract Year 2023 Final Rule (87 FR 27704) Preamble: While not a separate guidance document, the Federal Register preamble that accompanied the 2023 final rule contains CMS’s explanations and rationale for the TPMO requirements. It’s a useful resource for understanding CMS’s intent. For example, CMS cited the statistic that marketing complaints to 1-800-Medicare more than doubled from 2020 to 2021 and that secret shopping showed 80% of reviewed calls were poor – giving context to why disclaimers and recordings were mandated bressler.com. The preamble also likely responds to comments from industry on the proposed rule (some may have objected to the burden of recording or asked for clarifications). Compliance professionals often glean details from this narrative to guide implementation (like clarifying that “all calls” meant all chain-of-enrollment calls, which later got officially clarified in 2024).

• October 19, 2022 CMS FAQ and Best Practices Memo: Right as AEP for 2023 was starting, CMS released a FAQ document and an HPMS memo to plan sponsors focusing on TPMOs bluepeakadvisors.com. The FAQ (Frequently Asked Questions) document addressed common queries about the new requirements (e.g., confirming that yes, the call recording requirement applies to all agents/brokers, even “captive” agents cms.gov, and clarifying scenarios like voicemail callbacks, etc.). The HPMS memo (authored by Kathryn A. Coleman, Director at CMS) outlined “Monitoring Activities and Best Practices during the AEP” finance.senate.gov. It described how CMS would be monitoring marketing, including secret shopping calls, and reiterated that some agents were found to be non-compliant or pressuring beneficiaries bluepeakadvisors.com. It urged plans to be vigilant and listed things CMS expected (like making sure benefits aren’t misrepresented). This memo essentially put industry on notice that CMS was actively watching the 2023 enrollment period and expected immediate improvements even before the next rule. It also may have provided interim clarifications – for example, CMS gave examples of reportable offenses for agents (like repeatedly failing to cover required topics) that plans should report up bluepeakadvisors.com bluepeakadvisors.com.

• May 10, 2023 HPMS Memo Redefining “Marketing”: As noted earlier, CMS issued sub-regulatory guidance in May 2023 that broadened the definition of “marketing” versus “communications.” Historically, materials that mentioned benefits in a general way (without plan names or costs) could be considered “communications” not subject to CMS approval. CMS reversed that position effective July 10, 2023, via memo. The memo said any material that includes plan benefits and has intent to draw people into enrollment is marketing and must be submitted to HPMS advocateforagents.com advocateforagents.com. This was a significant shift that was not explicitly a part of the formal rule text (at that time), but CMS used interpretive authority. The memo likely provided examples, as the agent-oriented summary indicates: listing a bunch of generic benefits like “dental, vision, transportation” with a call-to-action is now considered marketing advocateforagents.com advocateforagents.com. The rationale is that the intent matters, not just the presence of a plan name or premium. Educational settings can still mention such benefits if no sales intent (e.g., in a Medicare 101 class, you can generically say MA plans may have dental), but any hint of solicitation triggers marketing rules advocateforagents.com advocateforagents.com. This guidance has practical effects: many lead-gen ads had used generalized language to avoid filing with CMS – that loophole closed. Compliance folks had to ensure all such materials got filed and had the TPMO disclaimer and all required info since July 2023 advocateforagents.com.

• CMS Marketing Guidelines & Annual Memoranda: CMS traditionally published the “Medicare Communications and Marketing Guidelines (MCMG)” – a sub-regulatory document consolidating rules and guidance for plan marketing. In recent years, CMS has been moving most of those guidelines into the regulations themselves, but the guidance still exists as a reference. CMS has promised to update the Medicare marketing guidelines to reflect new rules (for example, to give additional examples of reportable agent conduct as noted in the 2024 rule preamble bluepeakadvisors.com). Compliance officers should look out for updates to these guidelines, which often come via HPMS memos or website postings. They cover nitty-gritty details like font sizes on disclaimers, required call script language, etc., and incorporate changes from final rules.

• Plan-Specific Guidance and Job Aids: While not CMS documents, many plans and Field Marketing Organizations put out job aids, checklists, and FAQs for their agents to operationalize CMS rules. For instance, there have been “TPMO Compliance Checklists” circulated that list all the things an agent must do on a call: give disclaimer, confirm SOA, go through PECL, etc. Some large insurers (UnitedHealthcare, Humana, etc.) have their own training modules reflecting CMS guidance. These are worth mentioning because they often interpret CMS’s stance in concrete terms and can sometimes go beyond CMS requirements as an extra precaution.

• Industry Commentary and CMS Responses: CMS sometimes issues clarification based on industry feedback outside formal rulemaking. For instance, after 2023 AEP, agent associations lobbied CMS to clarify the call recording rule, which likely influenced the explicit change in 2024 to limit the scope. Similarly, if CMS notices confusion (like how to handle Zoom calls or in-person meetings relative to call recording), they might address it in a memo or FAQ update. Staying plugged into CMS’s Medicare Agent/Broker portal and HPMS emails is key – CMS sends communications to plan sponsors which then filter them to agents. One example in 2024 was a CMS memo clarifying that the TPMO disclaimer did not need to be read verbally by agents in a one-on-one in-person meeting (since the reg specifically said first minute of a call, not meeting) – some plans still required it, but CMS’s silence or statements in training calls might clarify such nuances.

• Enforcement Memos: If CMS finds a particularly troubling trend, they may issue a general memorandum to all plans. For instance, hypothetically, if CMS secret shops in 2024 showed many agents not adhering to the 48-hour SOA rule, CMS could remind plans via HPMS to enforce that. These memos often precede or obviate the need for formal enforcement, by warning the industry.

• OIG or GAO Reports: The HHS Office of Inspector General and the Government Accountability Office sometimes study aspects of MA marketing or enrollment. While not direct CMS guidance, their reports can shape future CMS actions. A GAO report in the past on marketing misconduct might have been part of the impetus for changes. Likewise, OIG might audit how CMS is implementing these oversight rules. Keeping an eye on those can give a sense of where regulators might focus next.

In conclusion, CMS’s guidance apparatus (HPMS memos, FAQs, etc.) is an essential complement to the formal regs. They often provide timely clarifications that help avoid missteps. Compliance officers should ensure they are receiving all relevant CMS communications (usually via the plan if you’re at a TPMO, or directly if you’re at a plan) and integrate that guidance into training and policies immediately. Given how dynamic this area has been, missing a memo could mean missing a critical instruction (like the expanded definition of marketing in 2023).

Perspectives from Industry Stakeholders and Policy Experts

The rapid changes in TPMO regulation have elicited a range of responses from industry stakeholders, consumer advocates, and policy experts. Here is an overview of some perspectives:

• Health Insurers and MA Plans (via trade groups like AHIP): Generally, large Medicare Advantage organizations have supported efforts to curb egregious marketing by third parties, because those practices can harm the overall reputation of MA plans. America’s Health Insurance Plans (AHIP) and the Better Medicare Alliance (BMA) have both acknowledged the issue of “bad actors” in marketing and expressed support for protecting beneficiaries. That said, plans are also cautious about increased administrative burden. In public comments on proposed rules, some insurers likely urged CMS to strike a balance so that not all agents are treated as suspect due to the few bad actors. For example, plans were concerned about the cost and feasibility of recording all agent calls and storing them, as well as potential chilling of marketing efforts that responsibly increase enrollment. After the rules took effect, insurers invested in compliance (like more trainings, auditing) and, at least publicly, affirmed their commitment to oversight. We haven’t seen public pushback against the concept of the disclaimer or consent requirements from major insurers – they appear to have accepted these as necessary. The big remaining concern for insurers might be the agent compensation changes for 2025, since it fundamentally alters how they can compete for agent relationships. Some insurers or marketing organizations might have opposed the fixed-rate commission idea (preferring to maintain flexibility to reward high performers), but CMS’s rationale was to prevent steering, and consumer advocates have lauded that move. Overall, insurers want to avoid a repeat of the negative press from 2021-2022, so many are in favor of weeding out deceptive marketing, even if it means more compliance work.

• Agents and Brokers (individuals and agencies): Reactions in this group are mixed. Independent agents and small agencies often pride themselves on client service and might feel that the new rules punish everyone for the sins of large call centers. Many agents were frustrated by the call recording requirement, citing cost of recording systems, privacy concerns (some clients are uneasy being recorded), and the sheer hassle of storing years of calls. Agent associations like the National Association of Health Underwriters (NAHU, now rebranded as NABIP) advocated for narrowing that requirement – a win for them came with the 2024 rule clarifying it’s only marketing/enrollment calls, not all calls advocateforagents.com. Agents also had concerns about the TPMO disclaimer; some felt it can undermine their credibility or confuse clients. However, many comply and simply explain to clients why they have to say it. There has also been grumbling about the 48-hour SOA return – agents say it can impede their ability to help beneficiaries quickly, especially if someone wants to enroll near a deadline. But others acknowledge it helps prevent impulsive sales. Agent forums and blogs (like those by insurance FMOs) have mostly been busy explaining the new rules and advising compliance, as non-compliance could mean loss of carrier contracts.

Some agents worry that too many restrictions might drive independent brokers out of the MA market or favor only the big organizations that can handle compliance overhead. On the other hand, many agents welcome the crackdown on shady lead generators and cross-sellers, since those give the whole profession a black eye. A common sentiment: “We support getting rid of bad actors, but hope CMS doesn’t over-regulate and make it impossible for good agents to do business.” The fixed compensation rule for 2025 was actually met with cautious optimism by some brokers – knowing everyone will get paid the same could reduce cut-throat competition and focus more on service. But those agents who benefitted from bonuses or high commissions from certain plans will feel the pinch. The ultimate agent perspective is likely to evolve after these rules take effect and they see real impacts on their business.

• Third-Party Marketing Firms and FMOs: Large marketing organizations (some backed by private equity and worth billions in market cap) have been active in commenting on regulations through industry coalitions. They often argue that they provide valuable services (education, choice) and that only a small fraction of actors are truly bad. They likely pushed back on proposals like the outright ban on lead data sharing (which CMS softened to a consent requirement) sheppardhealthlaw.com. The consent requirement will significantly affect lead aggregators – companies that built a business on selling Medicare leads will now have to get consent per buyer, which could shrink the lead market or at least add friction. Some marketing firms might pivot more to directly enrolling rather than selling leads, to avoid the consent issue (i.e., keep the consumer in-house through the sale). FMOs have generally supported clarifying compliance rules, because they operate in a highly regulated space already and want a level playing field. One can find quotes from FMO executives committing to stronger oversight and praising CMS for addressing fraudulent marketing, as it ultimately protects the integrity of the MA program, which all their livelihoods depend on.

• Consumer Advocates and Policy Experts: Organizations such as the Medicare Rights Center, Center for Medicare Advocacy (CMA), and NAIC (National Assoc. of Insurance Commissioners) have been vocal about marketing issues. The NAIC (which represents state regulators) even drafted model language to curb misleading marketing. Consumer advocates largely applaud CMS’s changes as necessary consumer protections. The Center for Medicare Advocacy, for example, published issue briefs highlighting deceptive marketing and urging CMS and Congress to do more medicareadvocacy.org. They are likely pleased with things like the return of the 48-hour rule, disclaimers, and especially the data-sharing consent, because it addresses the root cause of many nuisance calls. However, some advocates feel the measures are necessary but not sufficient. For instance, CMA has argued for even more enforcement and a reversal of Medicare Advantage advertisements that confuse people about original Medicare vs MA medicareadvocacy.org. Some experts have suggested requiring all marketing materials to be standardized or reviewed by a neutral party, or even banning TV ads for Medicare Advantage entirely – though that’s unlikely. The Senate Finance Committee, as a policymaker voice, recommended reinstating certain Trump-era loosened rules and seems satisfied that CMS did exactly that (like bringing back the multi-language insert for materials, which CMS did in 2024 for some plan types, and the SOA timing) finance.senate.gov finance.senate.gov.

One area of debate is whether state regulators should have a larger role. States license the agents who make these sales, but Medicare marketing is largely federally regulated. NAIC and some senators have discussed giving states more enforcement power, or making it easier to report rogue agents across states. CMS has started sharing info with states more proactively. So policy experts are looking at the federal-state cooperation angle as well.

• Media and Public Perception: Media reports, like those from KFF and Kaiser Health News, have highlighted beneficiary horror stories and are generally supportive of the crackdown finance.senate.gov medicareadvocacy.org. They often cite the staggering number of TV ads (KFF found ~9,500 airings per day during OEP 2022) and the confusion they cause kff.org. Journalists have scrutinized the industry, noting how some brokers might steer people to plans that give them higher pay, or how fine print consents lead to a bombardment of calls finance.senate.gov finance.senate.gov. With these new rules, media outlets will likely follow up to see if complaints drop and if seniors report a better experience. If not, they may press for more action.

In summary, industry stakeholders are adapting: insurers and FMOs by bolstering compliance and accepting new rules, agents by implementing changes (albeit with some initial frustration), and marketing firms by modifying their models. Consumer advocates and policymakers are cautiously optimistic that these rules will curb the worst behaviors, but remain vigilant and ready to call out any loopholes or enforcement gaps. One shared perspective is clear: all sides have an interest in restoring trust in the Medicare plan enrollment process, which had been eroded by bad actors. The hope is that tougher rules and oversight will ultimately lead to fewer complaints and a better-informed beneficiary population, which benefits legitimate businesses and consumers alike.

Case Examples Illustrating TPMO Compliance Pitfalls

To ground the discussion, here are a few illustrative scenarios and real-world examples that highlight common compliance pitfalls for TPMOs and their partnering plans:

• Case 1: Misleading Celebrity Ad Leads to Consumer Confusion – The "Medicare Coverage Helpline" TV Commercial: In 2018, a television ad began airing featuring football legend Joe Namath urging seniors to call the Medicare Coverage Helpline. The ad promised that viewers might be eligible for extra benefits and even said they could get money added back to their Social Security checks finance.senate.gov. What went wrong: The ad did not clearly explain that it was for Medicare Advantage plans, not a general Medicare benefit. It omitted that not all providers are in network and that benefits vary by area finance.senate.gov. It also prominently featured the Medicare card image and used the term “Medicare” in a way that many mistook as an official government source finance.senate.gov. When consumers called, they reached a lead-generating call center (TogetherHealth, a subsidiary of Benefytt Tech.), which then routed calls to agents who could enroll them in certain MA plans finance.senate.gov. States received numerous complaints about these ads. In fact, at least five state insurance regulators specifically flagged the Joe Namath ads in letters to the Senate Finance Committee finance.senate.gov. Lawsuits were filed, and the ad was eventually updated to include disclaimers (after CMS rule changes). Compliance takeaways: This scenario underscores why CMS now bans using Medicare imagery or implying ads are from Medicare kff.org. It also shows the harm of not including disclaimers – many callers thought they were contacting an official source and that all plans were being considered, when in fact only certain plans were offered. The company behind these ads faced not only regulatory scrutiny but also an FTC investigation into its parent company’s marketing practices finance.senate.gov. Under current rules, such an ad would need a clear disclaimer (“We do not offer every plan…”) and the removal of Medicare branding to be compliant, and all scripts used would need to be filed and approved.

• Case 2: "Enroll Me Without Asking" – Unauthorized Enrollments by a Call Center: A state insurance department reported an incident where an insurance telemarketer enrolled a 94-year-old woman with dementia into a Medicare Advantage plan without her informed consent finance.senate.gov. The woman lived in a rural area and the plan she was put in did not have her local hospital or doctors in network, causing significant disruption to her care finance.senate.gov. What went wrong: This is an example of outright abusive sales tactics – possibly the agent simply used the personal data to forge an enrollment or rushed the call without the beneficiary understanding. It violates numerous rules: lack of valid consent or understanding (which is essentially fraud), likely no proper Scope of Appointment, failure to ensure the plan was suitable, etc. Compliance takeaways: This extreme case is why CMS emphasizes review of enrollments and rapid disenrollments. A plan seeing a new 94-year-old enrollee out of area might question how that sale happened. Plans should track agents who have unusual enrollment patterns (e.g., signing up very elderly or vulnerable folks who then disenroll). Also, the new PECL requirement (explaining effect on current coverage) might help in cases where an enrollee doesn’t realize their doctor isn’t in network – although with cognitive impairment, no amount of checklist can fix an unethical agent. The key is to prevent such enrollments by filtering out bad agents. Under CMS’s 2024 oversight plan requirement, an agent causing harm like this should be reported to CMS bluepeakadvisors.com so they can potentially be banned from selling Medicare products.

• Case 3: Unsubstantiated "Best Plan" Claims in Marketing Materials: A regional FMO produced a flyer for its agents that said, “We work with the #1 Medicare Advantage plan in our state – rated best in customer satisfaction!” However, it turned out this claim was based on an internal survey, not an official rating, and was from three years ago. What went wrong: Using superlatives (“#1”, “best”) without current supporting data is now prohibited bluepeakadvisors.com. Even if data exists, it must be recent and cited. In this case, the claim was misleading and stale. If CMS or a state regulator saw this flyer (for example, submitted via HPMS or given by a secret shopper), they could flag it. Compliance takeaways: TPMOs must be very careful in marketing language. Any ranking or claim needs a citation (e.g., “J.D. Power 2023 survey”). It’s safer to avoid superlatives altogether unless instructed by the plan with proper backup. Plans reviewing TPMO materials should strike unverifiable claims to avoid compliance actions.

• Case 4: Missing Disclaimer on Website Leading to Enforcement: A multi-state insurance brokerage launched a Medicare-focused website comparing plans but forgot to include the required TPMO disclaimer on the homepage. The site collected leads for multiple MA plans. During a CMS audit (or possibly a competitor’s complaint), this omission was discovered. What went wrong: This violates the explicit requirement to prominently display the disclaimer on TPMO websites bressler.com bluepeakadvisors.com. The brokerage also did not submit the website to CMS via HPMS, thinking it was just “educational,” but since it invited people to contact for plan information, CMS viewed it as marketing. Compliance takeaways: Websites are treated like any other marketing material. They need disclaimers, and if they mention benefits or plan info, they need filing. In a real case, CMS could issue a notice to the plans that the broker represents, requiring corrective action (take down site until fixed, etc.). The plans would then pressure the brokerage to comply immediately. For TPMOs, the lesson is to incorporate compliance checks in all digital content development and err on the side of filing with CMS if there’s any doubt.

• Case 5: Data Sharing Without Consent – List Brokerage Post-2025: Imagine a lead generation firm in late 2024 continues its old practice: it runs online ads, collects thousands of beneficiary contacts (who maybe checked a generic consent like “I agree to be contacted by marketing partners”), and sells these leads to five different agencies. In January 2025, beneficiaries start complaining they are getting calls from multiple companies they never heard of, all because they clicked one website. What went wrong (going forward): Under the new rules effective October 2024, that generic consent is not sufficient activeprospect.com activeprospect.com. The firm did not obtain the required prior express written consent naming each of the five agencies. Each sale of data was essentially unauthorized by CMS’s standard. Compliance takeaways: This scenario is exactly what CMS’s consent rule is designed to stop. If discovered, the lead gen TPMO and potentially the buying agencies would be in violation. CMS could, through the plans, enforce that these leads not be used. A plan that received enrollments via such leads might have to notify those beneficiaries of their right to opt out of further contact or even offer a special enrollment period if they feel the marketing was improper. The TPMO would need to overhaul its consent process immediately or face being cut off by carriers. We can anticipate CMS may test lead vendors by submitting info and seeing how many callbacks happen without proper consent trails.

• Case 6: Failure to Report Agent Misconduct: A plan’s internal compliance team discovers that one of its top-selling agents (who works through a big FMO) has been misrepresenting plan benefits – telling clients that a certain specialist is covered when he isn’t. The compliance officer at the plan warns the FMO, which says they’ll retrain the agent. But the plan does not report this to CMS, thinking a warning was enough. Months later, CMS during an audit asks for the plan’s log of reported agents and finds that this agent wasn’t reported despite multiple complaints and clear rule violations. What went wrong: As of late 2023, plans are required to report agents who are found to be non-compliant (especially repeat issues) to CMS bluepeakadvisors.com. By trying to handle it quietly and not informing CMS, the plan violated the reporting requirement. Compliance takeaways: Plans have to follow through on the new oversight and reporting rules. This scenario illustrates that even if an issue seems resolved, CMS wants to know about serious cases. The plan should have reported the agent after the first or second substantiated misrepresentation, not just internally admonish them. Now the plan might itself face a compliance action for failure to report, and CMS could question whether the agent should be allowed to keep selling.

These cases highlight common pitfalls: misleading advertising, high-pressure or unauthorized enrollments, missing disclaimers, improper data sharing, and lapses in oversight/reporting. Each pitfall directly correlates to a rule CMS has put in place. By studying these scenarios, compliance professionals can better understand how a lapse can translate into real harm or regulatory trouble, and thus reinforce prevention measures.

Best Practices for TPMO Compliance and Oversight

Given the complex and evolving regulatory landscape, it is critical for both TPMOs and the MA/PDP organizations they work with to adopt robust compliance practices. Below are best practices recommended by regulators and industry experts to ensure TPMO marketing is compliant and effective oversight is in place:

1. Establish a Comprehensive TPMO Oversight Program: MA plans should develop a detailed TPMO Oversight Plan that goes beyond the minimum CMS requirements bluepeakadvisors.com bluepeakadvisors.com. This written plan should outline how the organization will vet, train, monitor, and, if necessary, discipline the agents, brokers, and marketing vendors that fall under the TPMO definition. It should assign clear responsibilities to specific departments or staff (e.g., sales compliance manager, broker management team) for each aspect of oversight bluepeakadvisors.com bluepeakadvisors.com. Ensure the program includes:

• Complaint Tracking and Analysis: Log all beneficiary complaints related to marketing (from CMS CTM, 1-800-Medicare, internal hotlines, etc.) and track them by agent/TPMO bluepeakadvisors.com bluepeakadvisors.com. Look for trends (e.g., Agent X has 5 complaints about misleading drug coverage info). Use complaint data as a trigger for intervention.

• Call Review Protocols: Since calls are recorded, implement a routine for auditing call recordings. For example, randomly sample a certain percentage of each agent’s calls each month for compliance checks bluepeakadvisors.com. Also, listen to calls in real-time occasionally (live monitoring) to catch issues as they happen bluepeakadvisors.com. Focus especially on telephonic enrollments, as those are easy to identify and crucial to get right bluepeakadvisors.com. Have a checklist for reviewers to flag if the disclaimer was given, if benefits were accurately described, if no prohibited language was used, etc. Provide feedback to agents promptly.

• Secret Shopping: Conduct or commission secret shopper activities for both in-person seminars and online webinars or sales events bluepeakadvisors.com. This can be done by plan staff or third-party compliance firms. The idea is to see firsthand what sales presentations are like and ensure they match compliance expectations (e.g., no unapproved materials, no pressure tactics). Document the findings and address any shortcomings with the agent or TPMO entity.

• Regular Reporting and Reviews: Require that the compliance team reports oversight findings to senior plan management and perhaps to a compliance committee. This elevates the visibility of marketing compliance and ensures adequate resources are devoted to it. CMS now expects plans to be able to produce their oversight plans and evidence of monitoring on request bluepeakadvisors.com bluepeakadvisors.com, so having it organized is key.

2. Thoroughly Vet and Document All TPMO Relationships: Make sure you know your TPMOs. Plans should maintain an updated inventory of all TPMOs involved in marketing their products – including direct contracts and those indirectly through FMOs bluepeakadvisors.com bluepeakadvisors.com. For each, document the services they perform (lead gen, field sales, call center, etc.), how they are compensated, and any sub-delegates they use. Conduct due diligence before contracting:

• Check the background of key individuals (any regulatory actions against them?).

• Ask for references or performance history, particularly if they operate in other states or for other plans.

• Ensure they have a valid license (for agents/brokers) in each state and carry errors & omissions insurance.

• Review their marketing materials or scripts upfront – get a sense of their style and compliance culture.

• Verify that they have not been the subject of CMS compliance notices or state sanctions (plans can ask CMS account managers if there are known issues, or use NAIC’s State Producer Licensing Database for agent violations). This vetting helps avoid onboarding a problematic partner. It’s better to be selective with whom you allow to market your plans.

3. Strengthen Contracts and Enforcement Clauses: As discussed, contracts must contain CMS-required clauses bluepeakadvisors.com, but go further by adding specific performance and compliance expectations. For example:

• Insert a clause that TPMOs must adhere to all CMS Medicare Communications & Marketing Guidelines and regulations, and any plan-specific marketing rules, with violation grounds for termination.

• Require indemnification provisions where the TPMO will cover the plan for any fines or penalties arising from the TPMO’s non-compliance.

• Set service-level expectations: e.g., call center average hold times, quality scores, etc., if applicable – as these indirectly tie to beneficiary experience.

• Include a right for the plan to audit the TPMO’s records, including listening to call recordings or reviewing lead consents, on demand.

• Specify the training requirements (like TPMO agents must complete the plan’s annual certification or training modules on compliance).

• Outline a graduated disciplinary process: e.g., first violation – warning and retraining; second – probation; third – termination. And reserve the plan’s right to immediately terminate or suspend an agent for serious infractions (e.g., misrepresentation, fraud). Ensure that downstream agreements (like between an FMO and an independent agent) also mirror these terms. The plan can require in its FMO contract that the FMO’s sub-agents be held to the same standards.

4. Provide Ongoing Training and Clear Guidance: Education is one of the best defenses against unintentional non-compliance. Both plans and TPMO organizations should:

• Conduct training before AEP each year to update on new CMS rules or guidance. For 2024, for example, training should have covered the new disclaimer verbiage, the 48-hour SOA, etc. Make training mandatory and track completion.

• Use real examples in training. Show agents what a compliant vs non-compliant call looks like (perhaps by playing anonymized call snippets). Highlight common mistakes like forgetting the disclaimer or using superlatives.

• Distribute quick-reference guides: e.g., a one-pager on “Medicare Marketing Do’s and Don’ts” or a flowchart of steps for compliant enrollment (SOA → Needs analysis → plan comparison → PECL → enrollment verification).

• Ensure agents understand why these rules exist – e.g., share that complaints were up 165%, etc., to underscore the importance of compliance ahcancal.org. Often, understanding the rationale improves buy-in.

• Have a contact person or help desk for agents’ compliance questions. It’s better they ask “Can I say this in an ad?” beforehand than do it and find out it was wrong later. Some FMOs have dedicated compliance officers agents can call for guidance.

• Include training on related laws: e.g., TCPA (do-not-call, consent requirements), HIPAA Privacy (if dealing with personal health info), and Anti-Kickback Statute (if any referral arrangements exist). While CMS focuses on marketing rules, agents should not inadvertently violate other laws while marketing.

5. Implement Rigorous Marketing Material Review Processes: Every piece of marketing content – whether a flyer, mailer, TV script, website content, or seminar handout – should undergo compliance review before use. Best practices:

• Create a checklist for marketing material compliance. For example, check for: presence of required disclaimer (and correct wording/font), plan name shown (if required), benefits mentioned only if available in that area, no forbidden phrases (“Medicare-endorsed”, etc.), inclusion of any necessary legal text (like TTY number, hours of operation for numbers listed, etc.), and that the material is not misleading or confusing in overall impression.

• Keep an inventory of all materials and their HPMS submission IDs or filing confirmation. If a regulator inquires, you should be able to pull exactly what was used and evidence of approval.

• If multiple plans are involved in one piece, coordinate the review among them to avoid conflicting edits. One strategy is to have a “lead carrier” whose template is then shared with others.

• Leverage automation where possible: some organizations use tools that scan content for certain risky terms or for required elements, as a first pass.

• Don’t overlook agents’ self-made materials. Many independent brokers produce their own business cards, Facebook ads, or local brochures. Plans/FMOs should clearly communicate that any agent-created ad must be approved by the plan (or by the FMO’s compliance) before dissemination. Provide an easy channel for them to submit materials for approval.

• As part of oversight, periodically search the internet and social media for your plan’s name to catch any unapproved marketing. It’s not uncommon to find an agent’s Facebook post that wasn’t cleared and may say something problematic. When found, take swift action to correct it.

6. Engage in Proactive Beneficiary Communication: Some plans have started reaching out to new enrollees (especially those from TPMO sources) to confirm they understood their enrollment and are satisfied. For instance, sending a welcome letter or making a welcome call that, in addition to on-boarding, says “If you have any questions or feel something is not what you expected, please contact us or your agent.” This can catch issues early (within the window where one can still disenroll if needed). It also acts as a check on the TPMO – if many new members express surprise about something, it flags a potential misrepresentation upstream. CMS actually suggested in 2021 that plans do verification calls instead of just letters bressler.com. Even though doing so isn’t mandatory, it’s a best practice to ensure enrollment was appropriate. It can mitigate harm and also provide evidence of good faith if a complaint later arises (the plan can show they tried to verify understanding).

7. Cultivate a Culture of Compliance and Ethics: Ultimately, compliance cannot catch everything if the culture is to “sell at any cost.” Both plan sponsors and TPMOs should instill in their teams that the beneficiary’s best interest comes first. Some ways to encourage this:

• Set realistic sales targets that don’t implicitly encourage cutting corners. Avoid overly aggressive quotas.

• Recognize and reward agents for quality (low complaint rates, high retention of members) not just quantity. This reinforces doing the job right.

• Provide agents with tools to truly compare plans objectively (even those you may not sell), so they feel comfortable acknowledging if another plan might be better for the client – with the understanding that in the long run, honesty builds reputation and referrals.

• Encourage agents to report any unethical practices they observe among peers or lead vendors, without fear of retaliation. Have a confidential way to submit concerns.

• Keep leadership messaging consistent that long-term success in Medicare products relies on member satisfaction and compliance, not just on hitting enrollment numbers. If a TPMO is only ever pressured “enroll enroll enroll,” problems will happen. So balance that with messages about retention and compliance.

8. Stay Updated and Adaptable: Regulations may continue to change. Compliance officers should keep up with:

• CMS rulemaking (proposed rules often come in the fall, final rules in spring – reading the preambles gives a glimpse of CMS’s concerns).

• HPMS memos (subscribe or ensure someone at your org is reading and disseminating relevant ones quickly).

• Industry conferences/webinars: NAHU/NABIP, AHIP, and various law firms host webinars on new rules – these can be valuable to attend for insights.

• Networking with peers: Many plan compliance folks network to discuss challenges and interpretations. While each must implement individually, hearing how others tackle, say, the data consent requirement or call recording storage can spark ideas.

• Updating internal policies promptly: When a new rule or guidance comes, update your SOPs, training, and manuals accordingly. Don’t rely on outdated printed manuals from last year – they should be refreshed each year with new regulations.

• Audit yourself: Periodically, do a self-audit of your marketing compliance program (or hire an external consultant to do so) to identify any gaps. For instance, ensure you could produce all required documentation if CMS randomly selected you for a marketing audit.

By implementing these best practices, organizations can significantly reduce the risk of non-compliance and also improve the quality of their marketing efforts. Ultimately, compliant marketing is about building trust – with Medicare beneficiaries who need accurate information, and with regulators who need to ensure program integrity. A well-structured compliance and oversight approach for TPMOs not only avoids penalties but also leads to more satisfied, well-matched enrollees, which is a win-win for beneficiaries and plans alike.

In conclusion, Third-Party Marketing Organizations play a critical and now carefully regulated role in the Medicare Advantage and Part D landscape. The rules introduced in 2023-2025 signal that CMS expects transparency, accuracy, and accountability at every step of the marketing and enrollment process. Compliance officers, healthcare marketers, and regulatory analysts must work together to ensure these standards are met – protecting beneficiaries while enabling fair competition and growth in the Medicare plan market. With diligent oversight and adoption of best practices, TPMOs can continue to contribute positively to beneficiary choice and education, within the guardrails set by CMS’s regulations and guidance.

Sources:

• CMS, Contract Year 2023 MA and Part D Final Rule, 87 Fed. Reg. 27704 (May 9, 2022) cms.gov bressler.com.

• CMS, Contract Year 2024 MA and Part D Final Rule, 88 Fed. Reg. 22120 (Apr. 12, 2023) bluepeakadvisors.com bluepeakadvisors.com.

• CMS, Contract Year 2025 MA and Part D Final Rule, 89 Fed. Reg. 27732 (Apr. 4, 2024) cms.gov cms.gov.

• CMS Medicare Communications & Marketing FAQs (Oct. 19, 2022) cms.gov cms.gov.

• CMS HPMS Memo, Monitoring Activities and Best Practices during AEP (Oct. 19, 2022) bluepeakadvisors.com bluepeakadvisors.com.

• Senate Finance Committee Majority Staff, Deceptive Marketing Practices Flourish in Medicare Advantage (Nov. 2022) finance.senate.gov finance.senate.gov.

• Bressler Amery & Ross, Medicare Advantage Marketing in 2023 – Recent CMS Compliance Updates (Feb. 23, 2023) bressler.com bressler.com.

• BluePeak Advisors, Third Party Marketing Organization Requirements – Not Just a Sales Dept. Responsibility (June 1, 2023) bluepeakadvisors.com bluepeakadvisors.com.

• ActiveProspect, Prior Express Written Consent for TPMOs: New Rules (Feb. 21, 2025) activeprospect.com activeprospect.com.

• KFF, How Health Insurers and Brokers Are Marketing Medicare (Sep. 20, 2023) kff.org kff.org.

• AHCA/NCAL, Medicare Advantage Plan Marketing Media Summary (Dec. 2022) ahcancal.org ahcancal.org.

• Sheppard Mullin, CMS Issues CY2025 MA and Part D Final Rule (Apr. 15, 2024) sheppardhealthlaw.com sheppardhealthlaw.com.