October 1, 2026 is the date to watch. CMS’s new Medicare marketing rules start to govern contract year 2027 sales then, and some reach the phone call itself. Agents no longer wait 48 hours after a Scope of Appointment, and older call recordings can be kept as transcripts. The Telephone Consumer Protection Act didn’t change. A marketing organization facing a robocall or Do Not Call claim still wins or loses on its consent and opt-out records.
What did CMS change in the 2027 Medicare marketing rule?
It loosened several timing rules for agents and third-party marketing organizations (TPMOs). The changes are in CMS’s contract year 2027 final rule, published April 6, 2026 at 91 FR 17384 and effective June 1, 2026. The rule states that “the new marketing and communications policies in this rule are applicable for all contract year 2027 marketing and communications, beginning October 1, 2026.”
The biggest change for sales calls is the Scope of Appointment. The version of 42 C.F.R. § 422.2264(c)(3)(i) in force before the rule required the Scope of Appointment to be recorded “At least 48 hours prior to the scheduled personal marketing” appointment, with two exceptions. The current text says only that “Prior to the personal marketing appointment, the MA plan (or agent or broker, as applicable) must agree upon and record the Scope of Appointment with the beneficiary(ies).” It adds that the form “must be in writing for in-person personal marketing appointments.” The final rule explains that this gives beneficiaries “the flexibility to fill out an SOA just prior to discussing plan products or in advance of a future personal marketing appointment.”
Events changed too. Agents at an educational event may now receive “Business Reply Cards and Scope of Appointment forms,” under the current § 422.2264(c)(1)(ii)(D). The 12-hour gap between an educational event and a marketing event in the same building is gone. In its place, attendees must be told the educational event is ending and given “a sufficient opportunity to leave.”
Two changes reach the sales call directly. The TPMO disclaimer, which states how many organizations and plans the TPMO represents, used to be “Verbally conveyed within the first minute of a sales call” under the earlier § 422.2267(e)(41)(ii). It must now be “Verbally conveyed during sales calls prior to the discussion of any benefits,” under the current version. And call recordings have a fixed retention period. Under the current § 422.2274(g)(2)(ii), marketing and sales calls “must be recorded and retained in their entirety for a minimum period of 6 years.” The audio must be kept for the first three years. After that, the rule allows “complete and accurate transcript recordings” instead.
Which Medicare calling rules didn’t change?
The cold-calling ban and the TPMO data-sharing consent rule are still in place. Under § 422.2264(a)(2)(iv), plans and their agents may not, if the contact is unsolicited, “Use telephone solicitation (that is, cold calling), robocalls, text messages, or voicemail messages.” The listed examples include calls based on referrals and calls to people who attended a sales event without giving permission. Under § 422.2264(a)(3), a call isn’t unsolicited “if the beneficiary provides consent or initiates contact with the plan.”
The data rule is in § 422.2274(g)(4). Beneficiary data a TPMO collects “may only be shared with another TPMO when prior express written consent is given by the beneficiary,” through a disclosure that “lists each entity receiving the data.” The FCC tried to impose a similar one-seller-at-a-time consent rule on every industry, and the Eleventh Circuit vacated it before it took effect, as covered in the post on the one-to-one consent rule. For Medicare leads, CMS’s version survives. A lead form that names a long list of marketing partners in fine print is a CMS problem even where it might pass under the TCPA.
Plans are answerable for all of it. Under § 422.2274(g)(1), when a TPMO isn’t otherwise a downstream contractor, “the MA organization is responsible for ensuring that the TPMO adheres to any requirements that apply to the MA plan.” That’s why carrier contracts with TPMOs keep getting longer, and why a TPMO’s call records often end up in front of a carrier’s compliance team before they reach a court.
Does a Scope of Appointment count as TCPA consent?
Not by itself. A Scope of Appointment records which products the beneficiary agreed to discuss. TCPA consent answers a different question, and for a telemarketing call made with an autodialer or an “artificial or prerecorded voice,” the FCC requires prior express written consent under 47 C.F.R. § 64.1200(a)(2). The definition in § 64.1200(f)(9) calls for a written agreement “bearing the signature of the person called,” naming the seller and the phone number, with a disclosure that signing isn’t a condition of purchase. Most Scope of Appointment forms don’t contain that disclosure.
A signed form still helps a defense. It shows the beneficiary asked to talk about specific products, which matters for a live call challenged under the Do Not Call rules and for showing that a call wasn’t unsolicited under CMS’s rule. What it rarely covers is the automated follow-up: the reminder texts, the prerecorded voicemail, the dialer campaign weeks later. Those need their own consent, and a company that treats the Scope of Appointment as a blanket permission slip is taking a real risk.
The end of the 48-hour wait makes this easier to get wrong. With no waiting period, agents will often take the Scope of Appointment on the same inbound call where the pitch happens. That’s a good record for that call, because the recording shows the beneficiary called in and agreed to the topics. It says nothing about the outbound messages that follow.
| Rule | Before contract year 2027 | For contract year 2027 marketing | What it means for TCPA defense |
|---|---|---|---|
| Scope of Appointment timing | At least 48 hours before the appointment, with exceptions | Any time before the appointment, in writing if in person | Not TCPA consent, but good evidence the beneficiary asked for the call |
| Educational events | No Scope of Appointment forms, and a 12-hour gap before marketing | Forms may be collected, with notice and a chance to leave | Event sign-ups still need their own consent for automated follow-up |
| TPMO disclaimer | Within the first minute of a sales call | Before any benefits discussion | The call opening is still where prerecorded-voice claims start |
| Call recordings | Record calls in their entirety | 6 years, with audio for 3 and then audio or full transcript | Keep the audio once a claim arrives |
| Cold calls and data sharing | Banned if unsolicited, with per-entity consent to share data | Unchanged | Consent screens remain the core defense evidence |
Should Medicare call centers switch old recordings to transcripts?
Only on a schedule that stops the moment a claim arrives. The CMS rule sets a minimum for oversight, not a litigation hold. Once a demand letter or complaint names a number, the audio for every call to that number should be preserved in its original form, even if it’s past the three-year mark and the CMS rule would allow a transcript.
The reason is specific to TCPA claims. The TCPA’s robocall provision, 47 U.S.C. § 227(b)(1), applies when a call uses an “artificial or prerecorded voice,” and a transcript can’t show that. A recording that opens with a live agent asking for a name and ZIP code may be the best evidence a company has. A transcript of the same words proves much less. Converting audio after a claim arrives also invites a spoliation argument that can cost more than the claim.
Exposure under the TCPA hasn’t moved. A prerecorded or autodialed telemarketing call without the required consent carries $500 per violation, and a court may increase that up to $1,500 if the violation was willful or knowing. Private Do Not Call claims under § 227(c)(5) carry up to $500 per violation, with the same increase for willful or knowing violations, and require more than one call in a 12-month period. Medicare campaigns tend to run on high volume during the enrollment periods, so per-call numbers add up fast. The earlier post on insurance telemarketing and the TCPA covers purchased leads and transfer call centers in more detail, and the firm’s Medicare and insurance TCPA defense page describes how those claims are defended.
What to pull when a Medicare calling claim arrives
- Put the call audio itself under a litigation hold, along with the dialer and texting-platform logs and the consent and Scope of Appointment records for the number.
- Export the opt-out and internal do-not-call entries for that number with their dates, including stop requests spoken on recorded calls.
- Retrieve the National Do Not Call Registry scrub records and the download dates used for the campaign.
- Gather the lead-purchase and TPMO agreements, the data-sharing consent screens, the scripts, and any recorded or synthetic-voice files.
- Speak with a lawyer before answering the demand, contacting the beneficiary, or offering anything to settle.
Questions about the 2027 Medicare marketing changes
Can an agent drop the 48-hour wait for calls placed now?
CMS says the new marketing policies apply to contract year 2027 marketing beginning October 1, 2026. Before that date, contract year 2026 marketing is still underway, and carriers may hold agents to their existing guidance. The safer course is to follow the carrier’s written instructions until October 1 and to keep the Scope of Appointment record either way, since it’s useful evidence in any later dispute over whether the call was requested.
Do the same changes apply to Part D plans?
Yes. The final rule made parallel changes to the Part D marketing rules at 42 C.F.R. §§ 423.2264, 423.2267, and 423.2274. The Part D versions use the same wording for stand-alone prescription drug plans. A TPMO that sells both kinds of coverage can run one set of procedures, and it should update the call scripts to the new disclaimer timing for both.
Does the new disclaimer timing affect TCPA claims?
Not directly. The disclaimer is a CMS requirement, and the TCPA doesn’t care when it’s read. But moving it later means the first part of many calls is now basic information gathering. If a recorded or synthetic voice handles that opening before a live agent joins, the call may be treated as a prerecorded-voice call under the TCPA, and that needs written consent for telemarketing.
Do CMS violations create TCPA liability?
No. The TCPA’s private claims come from its own provisions, § 227(b)(3) for robocalls and § 227(c)(5) for Do Not Call violations. A CMS violation can still hurt a defense, though. A call that breaks the cold-calling ban is hard to defend as one the beneficiary asked for, and plaintiffs’ lawyers know to request the recordings CMS requires.
Defending claims over Medicare sales calls
If your agency or marketing organization is accused of calling or texting Medicare beneficiaries without consent, the call recordings and the consent screens behind each lead usually decide the case. Rosenberger + Kawabata represents businesses defending TCPA lawsuits and class actions through its business litigation practice, including claims involving calls to purchased Medicare leads. Contact Rosenberger + Kawabata online for a confidential consultation, or call (310) 894-6921.
Sources
The CMS rule is the contract year 2027 final rule, 91 FR 17384 (Apr. 6, 2026). The Medicare marketing regulations are 42 C.F.R. § 422.2264, § 422.2267, and § 422.2274, with the earlier versions of § 422.2264 and § 422.2267. The TCPA is 47 U.S.C. § 227, and the FCC’s rules are at 47 C.F.R. § 64.1200.
This post is general information about the Telephone Consumer Protection Act and related laws as of June 21, 2026. It is not legal advice, and reading it does not create an attorney-client relationship. Courts and the FCC change the rules in this area often, and the outcome of any claim depends on its facts. Past results do not guarantee future outcomes.