TIPS: MAPD/PDP Marketing Compliance
Staying Compliant on Every Call,
Appointment, and Email
Appointment, and Email
Seven CMS communication and marketing rules every MAPD and PDP agent needs to follow before making the next call, sending the next email, or booking the next appointment. The 48-hour, 100%, and 5% thresholds below are where CMS audits and secret-shopper reviews find gaps most often, treat them as fixed operating rules, not general guidance.
48 hrs
SOA Advance Notice
Minimum notice required before collecting a Scope of Appointment for a scheduled individual marketing appointment, per CMS CY2025 Medicare Communications and Marketing Guidelines.
CMS CY2025 MCMG
100%
Calls Must Be Recorded
Of marketing, sales, and enrollment calls (including web-based audio) must be recorded in their entirety, from greeting to close, without exception.
CMS CY2025 MCMG
5%
Translation Threshold
Population share speaking a non-English language that triggers the duty to translate required materials, per 42 CFR 422.2267.
Quick Summary
CMS regulates how Medicare Advantage (MAPD) and Prescription Drug Plan (PDP) agents and brokers may communicate with beneficiaries, from the first cold-call restriction to the disclaimer read on a recorded sales call. Medicare marketing compliance rules sit primarily in 42 CFR 422.2264 and 42 CFR 422.2267, with operational detail in the CMS annual Medicare Communications and Marketing Guidelines. The seven tips below cover the requirements that trigger the most frequent compliance findings.
1
Collect the Scope of Appointment at least 48 hours in advance
2
Record 100% of marketing, sales, and enrollment calls in their entirety
3
Lead with the required TPMO disclaimer before discussing benefits
4
Never cold-call or robocall without prior express consent
5
Include a working opt-out link on every unsolicited marketing email
6
Match every Star Ratings claim to CMS’s required disclaimer language
7
Translate required materials once a language crosses the 5% threshold
7 Medicare Marketing Compliance Tips
1
Collect the Scope of Appointment at least 48 hours in advance
Why It Matters
The SOA documents exactly which products a beneficiary agreed to discuss. Collecting it late, or after the appointment, is a standalone compliance violation, separate from whether the appointment itself was properly conducted. CMS audits and secret-shopper programmes specifically check SOA timing.
What To Do
Build the 48-hour window into your scheduling platform so appointments cannot be booked with less notice than the rule requires. The main exceptions are walk-ins the beneficiary initiates and appointments made during the final four days of a valid election period, where the SOA can be collected on the day of the appointment instead.
Common Mistake
Treating every appointment as a walk-in to avoid the 48-hour window. CMS considers a “walk-in” to be an appointment the beneficiary initiates without prior scheduling, not an appointment the agent arranged and the beneficiary agreed to. Misclassifying scheduled appointments as walk-ins is a high-risk audit finding.
Pro Tip
Set your scheduling system to block same-day and next-day slots automatically for individual marketing appointments. Document the exception rule separately for walk-in and election-period-end cases so agents have written guidance on when it applies. Source: CMS CY2025 Medicare Communications and Marketing Guidelines
2
Record 100% of marketing, sales, and enrollment calls in their entirety
Why It Matters
CMS and plan sponsors can request call recordings during audits and complaint investigations. A partial recording, or no recording at all, does not just fail the specific requirement, it eliminates your ability to demonstrate compliance with every other rule discussed on that call.
What To Do
Confirm that your dialer or softphone platform captures the full call automatically, from the moment the connection is established, not after the agent presses a button. This applies to all marketing, sales, and enrollment calls including web-based enrollment audio. Test the recording system regularly rather than assuming it is working.
Common Mistake
Recordings that start after the greeting or stop once benefits have been discussed. CMS requires recording the entire call, so a recording that captures only the benefits discussion but not the opening (where the TPMO disclaimer should appear) is non-compliant even if everything said was accurate.
Pro Tip
Run a monthly audit of a random sample of recordings, at least 5% of total calls, to confirm recording coverage, disclaimer delivery, and SOA compliance. Source: CMS CY2025 Medicare Communications and Marketing Guidelines
3
Lead with the required TPMO disclaimer before discussing benefits
Why It Matters
Third-Party Marketing Organisations (TPMOs), including independent agents and brokers, must identify themselves, disclose the number of plans they represent, and direct beneficiaries to Medicare.gov, 1-800-MEDICARE, or SHIP. Failing to deliver this before discussing plan benefits is a direct violation of 42 CFR 422.2264.
What To Do
Read the disclaimer from a fixed script before any plan benefit is discussed on every call and in marketing materials. A fixed script ensures the wording is exact and consistent call to call, paraphrasing the disclaimer is not acceptable, as CMS prescribes the required language precisely.
Common Mistake
Reading a paraphrased or shortened version of the disclaimer rather than the exact CMS-prescribed language. CMS publishes the required wording in the annual Medicare Communications and Marketing Guidelines. Using an older-year version that has since been updated is also a common finding during secret-shopper audits.
Pro Tip
Pull the current-year CMS MCMG at the start of each contract year and update your call script immediately. Store the old version with its effective date for audit purposes. Source: 42 CFR 422.2264
4
Never cold-call or robocall without prior express consent
Why It Matters
Unsolicited direct contact, including cold calls, texts, and pre-recorded messages, is prohibited unless the beneficiary gave prior express permission or the contact is a response to a beneficiary-initiated inquiry. Violations are among the highest-volume complaint categories CMS tracks for TPMOs.
What To Do
Keep a dated, documented record of how and when each lead gave consent before loading the number into an outbound campaign. Consent must be plan-specific, a general marketing opt-in does not substitute for express consent to contact about a specific plan. Review your lead acquisition process at least annually against the current CMS rules.
Common Mistake
Treating a purchased lead list or a referral name as documented consent. Purchasing or receiving a list of beneficiary contact details does not create the prior express consent CMS requires. Every lead on an outbound list must have a documented, plan-specific opt-in before contact is made.
Pro Tip
Maintain a consent log with the lead’s name, date of consent, method of consent (web form, inbound call, etc.), and the plan(s) they consented to be contacted about. Keep this for audit purposes regardless of whether the lead enrolled. Source: 42 CFR 422.2264
5
Include a working opt-out link on every unsolicited marketing email
Why It Matters
Unsolicited marketing emails must give the recipient a clear, functioning way to opt out of future contact, and that request must be honoured going forward. A broken opt-out link or a suppression list that is not consistently applied across all outbound channels is a recurring CMS audit finding.
What To Do
Test the opt-out link on every campaign before it sends. Route opt-out requests into a central suppression list that both your dialer and email platform check before any outbound contact is made. Process opt-out requests within the timeframe required and do not contact those individuals again absent a new beneficiary-initiated inquiry.
Common Mistake
Maintaining separate suppression lists for email and phone outreach rather than a single unified list. A beneficiary who opts out of email contact but is then called by the same organisation faces a legitimate complaint, and the organisation cannot demonstrate that opt-out requests are being honoured across all channels.
Pro Tip
Build a single suppression file that is cross-checked by every outbound channel, email, dialer, and text. Run a monthly test of the opt-out link in a live send to confirm it remains functional. Source: 42 CFR 422.2264
6
Match every Star Ratings claim to CMS’s required disclaimer language
Why It Matters
CMS Star Ratings are a regulated marketing claim. Using a plan’s rating without the prescribed disclaimer language, or using the correct disclaimer with an incorrect or outdated rating, is a materials violation. CMS updates disclaimer requirements each year, and the rating itself changes annually.
What To Do
Any Star Ratings copy, in call scripts, printed materials, or digital ads, must be reviewed against the current CMS Communications and Marketing Guidelines for that plan year before it goes to print or use. Do not carry forward disclaimer language from the prior year without confirming it is unchanged.
Common Mistake
Using last year’s Star Rating disclaimer on this year’s materials, or referencing a plan’s rating from the previous contract year without verifying the current rating. Both the rating and the required disclaimer wording must reflect the current contract year.
Pro Tip
Treat all Star Ratings references as materials requiring formal annual review at the start of each contract year, alongside your TPMO disclaimer update. Source: CMS CY2025 Medicare Communications and Marketing Guidelines
7
Translate required materials once a language crosses the 5% threshold
Why It Matters
When a non-English language is the primary language of at least 5% of individuals in a plan benefit package’s service area, the organisation must translate required materials into that language and make them available on a standing basis, not only on request. Service area demographics shift annually, so this threshold must be re-evaluated each contract year.
What To Do
Run current service-area language data at the start of each contract year. Do not assume that last year’s translated-language list still applies, the 5% threshold must be calculated using current-year service-area demographics. Where the threshold is met, translated materials must be available on the plan’s website and upon request.
Common Mistake
Carrying forward the prior year’s translated-language determination without re-running the calculation against current service-area data. Plans that fail to add a newly-qualifying language, or that continue providing translation for a language that has fallen below the threshold, are both exposed to compliance findings.
Pro Tip
Build the 5% language check into your annual contract-year readiness checklist alongside your TPMO disclaimer and Star Ratings review. Source: 42 CFR 422.2267 | Federal Register CY2024 MA and Part D Final Rule
Pre-Call and Pre-Send Checklist
SOA collected and dated at least 48 hours before a scheduled individual appointment (or walk-in or election-period exception documented)
Call recording confirmed active before the greeting, configured to capture the entire call
TPMO disclaimer script current-year version loaded and to be read before any plan benefit is discussed
Lead source has documented, dated, plan-specific consent to be contacted, not a purchased list only
Outbound email contains a tested, functioning opt-out link connected to the unified suppression list
Any Star Ratings reference paired with current contract-year required disclaimer language
Service-area language data checked against the 5% translation threshold for the current contract year
Key Takeaways
The three numbers that matter: 48, 100, and 5
48 hours for SOA notice, 100% call recording coverage, and 5% language threshold for translation. These are the specific thresholds CMS audits against, treat them as fixed operating rules, not estimates.
Documentation is the compliance programme, not just a record of it
SOA timing, consent records, call recordings, and opt-out suppression lists are all forms of documentation. Without them, an otherwise compliant call or appointment cannot be demonstrated to be compliant during an audit or investigation.
Annual contract-year review is not optional, three of these seven tips change each year
TPMO disclaimer wording, Star Ratings references, and the translation threshold calculation all must be reviewed and updated at the start of each contract year. Plans and agents who carry forward prior-year materials without review are exposed to findings on the exact compliance items CMS verifies through its annual secret-shopper and audit programme.
Frequently Asked Questions
What is a Scope of Appointment, and when is it required?
A Scope of Appointment is a record of the specific products a beneficiary has agreed to discuss at a marketing appointment. It must generally be documented at least 48 hours before a scheduled individual appointment, per the CMS CY2025 Medicare Communications and Marketing Guidelines.
Are walk-in appointments exempt from the 48-hour SOA rule?
Yes. A beneficiary who initiates an unscheduled, in-person meeting, and appointments booked during the final four days of a valid election period, can have the SOA completed on the day of the meeting instead of 48 hours in advance. Both exceptions require documentation confirming which exception applies.
Does the call recording requirement apply to web-based enrollment?
Yes. The requirement to record 100% of marketing, sales, and enrollment calls in their entirety extends to web-based enrollment audio, not only traditional phone calls. The recording must cover the entire interaction from the start of the connection.
What must the TPMO disclaimer include?
It must identify the caller or material as coming from a Third-Party Marketing Organisation, disclose that the organisation represents a limited number of plans or organisations, and direct the beneficiary to Medicare.gov, 1-800-MEDICARE, or the State Health Insurance Assistance Program. The exact required wording is published in the current-year CMS MCMG, per 42 CFR 422.2264.
Can an agent contact a purchased lead list without documented consent?
No. Outbound contact generally requires the beneficiary’s prior express permission or a beneficiary-initiated inquiry. A purchased or referred list does not by itself establish that consent. Consent must be plan-specific and documented with a date and method before the number is loaded into any outbound campaign.
How is the 5% translation threshold calculated?
It is based on the share of individuals in a plan benefit package’s service area whose primary language is a given non-English language, per 42 CFR 422.2267 and confirmed in the Federal Register CY2024 MA and Part D Final Rule. The calculation must be run using current-year service-area data at the start of each contract year.
Where can an agent find the current-year required disclaimer wording?
CMS publishes the current Medicare Communications and Marketing Guidelines, including required disclaimer language, in its annual agent and broker training and testing materials available at CMS Agent and Broker Resources. This page is updated each contract year.
Do these rules apply equally to MAPD and standalone PDP marketing?
42 CFR 422.2264 and 42 CFR 422.2267 apply to Medicare Advantage organisations, cost plans, and Part D sponsors alike. PDP-only marketing is held to the same communication and materials standards as MAPD marketing.
Sources
Government and Regulatory Sources
- 42 CFR 422.2264: Communication and Marketing Requirements: primary federal regulation governing TPMO disclaimers, unsolicited contact prohibitions, opt-out requirements, and call recording obligations for Medicare Advantage and Part D marketing.
- 42 CFR 422.2260: Definitions: regulatory definitions for Third-Party Marketing Organisation (TPMO), marketing, communication, and related terms used throughout Subpart V.
- 42 CFR 422.2267: Required Materials and Content: federal standard establishing the 5% language threshold that triggers the duty to translate required materials into non-English languages.
- CMS CY2025 Medicare Communications and Marketing Guidelines (MCMG): annual CMS operational guidance published for each contract year, specifying SOA timing requirements, required TPMO disclaimer language, call recording standards, and Star Ratings disclaimer requirements.
- Federal Register: CY2024 MA and Part D Final Rule: formal rulemaking confirming the 5% language threshold for translation obligations under 42 CFR 422.2267.
Related VelSafe Articles
Guides
MAPD Enrollment: What CMS Requires and When to Enrol
Election period requirements, eligibility rules, enrollment process, and the compliance checklist for MA and Part D plan sponsors and agents.
Insights
MAPD Disenrollment: What Plans Most Often Get Wrong
The six involuntary disenrollment grounds under 42 CFR 422.74, CMP exposure, and the notice failures most compliance programmes miss.
Law
MAO/PDP Compliance Programs: What CMS Requires
CMS compliance programme requirements for Medicare Advantage organisations and Part D plan sponsors, the full seven-element framework with regulatory citations.
MAPD/PDP COMPLIANCE LIBRARY
Building Out Your MAPD Compliance Programme?
Read the enrollment guide, disenrollment analysis, and compliance programme law articles linked above to cover the full agent and plan sponsor workflow.
Explore More Compliance Tips
