Medicare Marketing Guidelines — The Phone Rules, Cited

Medicare Marketing Guidelines for Phone Outreach: What CMS Requires in 2026

Not legal or compliance advice. Medicare marketing is regulated by CMS and states; rules change annually. Confirm your outreach program with your compliance officer or counsel.

The Medicare marketing guidelines governing phone outreach hit a regime change in 2026. Through September 30, 2026, agents and third-party marketing organizations (TPMOs) run the 2023-era rules: the 48-hour Scope of Appointment wait, first-minute TPMO disclaimer, 10-year recording retention. From October 1, 2026, the CY2027 final rule (91 FR 17583, published April 6, 2026) rolls parts of that back. What never changes: you cannot cold call a Medicare beneficiary. Both rule sets below, cited to primary sources, as of July 2026.

The Two Rule Sets at a Glance

The CY2027 rule took effect June 1, 2026, but its marketing provisions apply from October 1, 2026.

No Cold Calls: The Unsolicited-Contact Rules

Under 42 C.F.R. § 422.2264 (Part D parallel: § 423.2264), MA organizations and their TPMOs and agents may not make unsolicited direct contact. Banned: telephone cold calls, robocalls, texts, voicemail drops, social-media DMs, door-to-door solicitation (except leaving materials at a pre-scheduled appointment where the beneficiary isn’t home), and approaching beneficiaries in common areas — parking lots, hallways, lobbies. Permitted unsolicited channels: conventional mail, print media, and email with an opt-out.

That defines what a dialer is for in Medicare work: beneficiaries who asked to hear from you — permission-to-contact leads, business-reply cards, inbound callbacks, existing clients. General telemarketing law still governs every dial; see TCPA for cold callers.

Permission to Contact and the Scope of Appointment

An SOA or a beneficiary’s request for information is valid for 12 months from the signature date or initial request — codified by the CY2024 final rule (88 FR 22120) at § 422.2264(c)(3). The older “one-time-use” lore is outdated at the federal level. What survives: permission covers only the products and scope the beneficiary agreed to discuss. Keep SOA records per CMS record-retention requirements — historically 10 years.

The 48-Hour SOA Rule: In Force Now, Gone October 1

Through September 30, 2026, an SOA must be documented at least 48 hours before a personal marketing appointment (§ 422.2264(c)(3)(ii), CY2024 final rule). Two exceptions: SOAs completed during the last four days of a valid election period, and unscheduled beneficiary-initiated walk-ins.

The CY2027 rule removes the wait: from October 1, 2026, an agent may collect an SOA and proceed to the appointment in the same call, meeting, or day. The documentation requirement itself survives.

Call Recording: Which Calls, and How Long to Keep Them

TPMOs must record “all marketing and sales calls, including the audio portion of calls conducted via web-based technology… in their entirety” (42 C.F.R. § 422.2274(g)) — the 2026 rulemaking did not eliminate the recording obligation.

Plan-year-2026 recordings sit under the 10-year retention standard from 2022–2023 rulemaking. From October 1, 2026, retention drops to 6 years — first 3 in audio, years 4–6 as audio or complete transcript (91 FR 17583). Caveat from trade sources: calls tied to an enrollment may still need 10-year retention under enrollment-record rules — confirm with compliance.

State call-recording consent laws apply on top — see call recording consent states. On tooling, plainly: recording in Enzo is optional, and Enzo makes no claim that it satisfies CMS recording or retention requirements — capturing and retaining every covered call is the agency’s responsibility, not the dialer’s.

The TPMO Disclaimer, Word for Word

Through September 30, 2026, TPMOs that don’t sell every plan in their area must deliver this disclaimer, per 42 C.F.R. § 422.2267(e)(41) as amended by the CY2024 final rule:

We do not offer every plan available in your area. Currently we
represent [insert number] organizations which offer [insert number]
products in your area. Please contact Medicare.gov, 1-800-MEDICARE,
or your local State Health Insurance Program (SHIP) to get
information on all of your options.

It’s required verbally within the first minute of a sales call, electronically in email and online chat, prominently on TPMO websites, and in marketing materials including TV ads.

From October 1, 2026, two things change: the SHIP reference is removed — the disclaimer points to Medicare.gov and 1-800-MEDICARE only — and the trigger shifts to “before any discussion of plan benefits” — general statements don’t trigger it. Verify the post-amendment string (§ 422.2267(e)(41) as amended by the April 2026 final rule) against 91 FR 17583 before printing it in your scripts.

The Calendar: October 1, AEP, and OEP

Marketing of next-plan-year products may begin October 1 (§ 422.2263(a)). AEP runs October 15 – December 7 — next: October 15 – December 7, 2026 for January 1, 2027 coverage — and the MA Open Enrollment Period runs January 1 – March 31 (§ 422.62). And CMS prohibits marketing that targets the OEP as a second enrollment window — no unsolicited OEP marketing (Medicare.gov).

The Medigap Carve-Out

Everything above — 42 C.F.R. Part 422/423 Subpart V and the Medicare Communications and Marketing Guidelines (MCMG) — applies to Medicare Advantage, Part D, and cost plans, not to Medicare Supplement (Medigap), which is governed by state insurance law under Social Security Act § 1882 and NAIC Models #650/#651 (NAIC, checked July 2026).

So the TPMO disclaimer, recording mandate, SOA rules, and unsolicited-contact rules don’t attach to Medigap-only sales. But state-regulated is not unregulated — several states restrict or require filings for Medigap telemarketing, and the federal TSR, TCPA, and DNC rules apply in full. A mixed MA-plus-Medigap call is pulled into the CMS rules by the MA portion.

Lead Data: CMS Consent Is Alive, the FCC Rule Is Dead

Two “one-to-one consent” rules got conflated in 2025 — only one died. The FCC’s lead-generation rule was vacated by the Eleventh Circuit on January 24, 2025 (Insurance Marketing Coalition v. FCC), and the FCC deleted the vacated language effective August 29, 2025. The CMS rule is separate and in force: beneficiary data collected by a TPMO may be shared with another TPMO or plan only with the beneficiary’s prior express written consent — CY2025 final rule (89 FR 30448) at § 422.2274(g), effective October 1, 2024, neither stayed by the Texas compensation litigation nor modified by the CY2027 rule. If you buy Medicare lead data, this is the rule your consent language answers to.

Where Enzo Fits — and Where It Doesn’t

Enzo sells no leads or data — it’s the dialer that works the consented lists your agency already has (medicare leads covers sourcing). The insurance dialer workflow inside these rules: CSV import and campaign scheduling for permission-to-contact lists against the October 1 / AEP calendar; preview and power dialing; 35–100 managed caller IDs with rotation and reputation monitoring; whisper and barge-in for coaching disclaimer timing; optional call recording. Campaign-level internal DNC is per-campaign only — marks don’t carry across campaigns — keep your master suppression list outside the dialer and re-apply it per campaign.

What Enzo is not: a compliance product. Recording in Enzo is optional, Enzo makes no claim that it meets CMS recording or retention requirements, and SOA documentation, disclaimer delivery, retention, and consent records sit with the agency. Pricing is published — from $99 per seat per month billed annually.

Calendar the October 1 changes and have compliance re-certify scripts and retention before AEP. See how Enzo runs consented Medicare call blocks — book a free 20-minute discovery call.

Rules and dates from the Code of Federal Regulations, the Federal Register (88 FR 22120; 89 FR 30448; 91 FR 17583), CMS memos, DOJ, NAIC, and Medicare.gov as of July 2026 — educational only, not legal or compliance advice; confirm current requirements with your compliance officer or counsel.