Medicare Sales Call Rules: What Agencies Must Follow

Medicare sales calls sit under two sets of rules at once: CMS marketing rules for Medicare Advantage and Part D, and federal telemarketing law (TCPA, FTC and FCC). The short version: no cold calls, record every call between your agency and a beneficiary, end the call if the beneficiary refuses recording, call only between 8 a.m. and 9 p.m. in the beneficiary’s time zone, and keep proof of consent and recordings for the required period. This guide walks through each rule and how to build it into a call floor.

TL;DR

• No unsolicited outreach. CMS bars cold calls, robocalls, texts and voicemails to beneficiaries unless an exception such as consent or beneficiary-initiated contact applies.
• Record every call. Inbound, outbound and virtual-meeting calls between a third-party marketing organization (TPMO) and a beneficiary must be recorded. In-person meetings are not covered by that requirement.
• Recording refused means the call ends. You cannot complete a phone sale without the recording.
• Layer federal rules on top. Calling hours, the National Do Not Call Registry, TCPA consent and internal DNC lists all still apply.
• Retention is changing. The CY2027 final rule sets a six-year clock for marketing and sales call recordings. Confirm the current text with your carriers.

Table of Contents

• Who the CMS rules apply to
• Permission to contact: the rule that shapes your lead strategy
• Call recording: what CMS requires
• How long to keep recordings
• Calling hours, Do Not Call and TCPA
• Rules that loosened for CY2027
• Penalties and carrier consequences
• Building the rules into your call floor
• Perspective
• Run Medicare calling on one compliant platform
• FAQ
• Sources

Who the CMS rules apply to

CMS calls anyone who markets Medicare plans on behalf of a plan sponsor a TPMO. That covers independent agents and brokers, captive agents, agencies, call centers and lead-gen operations that handle beneficiary data. CMS’s own FAQ says the call-recording requirement applies to all organizations and individuals that fall under the TPMO definition, which includes independent and captive agents and call centers.

So if your floor dials Medicare-eligible prospects, assume the rules below reach you, whether you contract directly with carriers or through an IMO or FMO. Your upline and your carriers will also hold you to them contractually.

The practical split looks like this:

CMS rules are stricter than general telemarketing in one big way: general telemarketing allows cold calls to numbers that are not on a DNC list. Medicare Advantage and Part D marketing largely does not.

Permission to contact: the rule that shapes your lead strategy

Under 42 CFR 422.2264, Medicare Advantage organizations may not use unsolicited telephone solicitation, robocalls, text messages or voicemail messages. The regulation spells out that this includes:

• Calls based on referrals.
• Calls to former enrollees who have disenrolled.
• Calls to beneficiaries who attended a sales event, unless they gave express permission.
• Calls to confirm receipt of mailed information.

The same section says a call is not unsolicited when the beneficiary gives consent or starts the contact, for example by returning a call or by completing a business reply card that asks for contact. That exception is where almost every compliant outbound Medicare program lives.

What this means day to day

• Referrals are not permission. A client giving you a neighbor’s number does not let you dial it.
• Old leads need a consent trail. If you cannot show when and how the beneficiary asked to be contacted, treat the lead as unsolicited.
• Voicemails and texts count. A “just following up” voicemail to a prospect who never asked for contact is covered by the same restriction.
• Returning a call is fine. If the beneficiary reached out first, your callback is not unsolicited.

One-to-one consent for shared leads

If you buy leads or take live transfers, the rules on sharing personal data matter. A compliance guide from a Medicare agent platform describes the one-to-one consent rule effective October 1, 2024: a beneficiary’s data collected by a TPMO can be shared with another TPMO only with prior express written consent, given through a clear disclosure that names each receiving entity and lets the beneficiary accept or reject each one. Ask every lead vendor how consent is captured and for the record that ties each lead to it.

At the floor level, store consent records on the lead itself: timestamp, source, disclosure text and the entities named. If your lead data lives in a CRM, make consent a required field before a lead can enter a dialing campaign. Our guide to consent management for texting covers how to keep that record clean.

Call recording: what CMS requires

The answer to what CMS requires is simple. Per CMS’s Agent Broker Marketing FAQs, a plan must ensure all calls between a TPMO and a beneficiary are recorded. That means:

• Inbound and outbound calls.
• Calls on virtual platforms such as Zoom.
• Marketing, sales and enrollment calls.

CMS does not require recording in-person interactions. If a meeting happens at a kitchen table, the recording rule does not reach it, but anything you do by phone or video afterward does.

If the beneficiary refuses to be recorded

This is the question agents ask most. CMS’s FAQ states that if a beneficiary declines to be recorded, the call must end, and the agent cannot complete a sale over the phone. Do not negotiate, do not offer to “just answer a few questions” off the record, and do not move the conversation to an unrecorded line.

A clean approach for your script:

1. Give the recording notice at the start of the call, before anything substantive.
2. If the beneficiary objects, say once that the call cannot continue without recording.
3. Offer an in-person appointment or a callback on a recorded line if they change their mind.
4. Disposition the lead with a “declined recording” code so nobody redials it the next day.

State recording laws add a second layer. In all-party consent states, you need every participant’s consent to record. Our write-ups on two-party consent states and call recording laws in the U.S. break down how to handle notices across state lines.

The TPMO disclaimer on calls

TPMOs must also give CMS’s standardized disclaimer, which says you do not offer every plan available in your area. Per one industry summary of the CY2027 change, the disclaimer must be spoken before plan benefits are discussed rather than within the first minute, for marketing starting October 1, 2026. Build it into the opening of every script and confirm the exact wording with your carriers’ current guidance.

How long to keep recordings

Retention has been a moving target. CMS’s CY2027 final rule (91 FR 17384, published April 6, 2026) revised 42 CFR 422.2274(g)(2)(ii) and 423.2274(g)(2)(ii). According to a summary of the rule, marketing and sales call recordings must be kept for at least six years: audio for years one to three, then either audio or a complete and accurate transcript for years four to six. The same summary notes that enrollment and disenrollment records remain on a ten-year retention period.

What to do with that:

• Set storage rules by record type. Sales call audio, enrollment records and consent logs may each have a different clock.
• If you plan to convert older recordings to transcripts, make sure the transcript is complete and accurate, and keep the audio for the first three years.
• If your carriers or IMO require longer, follow the longer period. Contract terms can exceed the regulation.
• Keep recordings searchable by agent, date, lead ID and disposition. When a carrier asks for a specific call, you want minutes, not days.

Calling hours, Do Not Call and TCPA

CMS rules sit on top of general telemarketing law, and those rules still apply to every dial.

Calling hours. Federal rules do not allow telemarketers to call before 8 a.m. or after 9 p.m. CMS has long reminded plans and their representatives to comply with the National Do-Not-Call Registry and honor “do not call again” requests, along with federal and state calling hours. The window is measured in the called person’s local time, so a floor in Phoenix calling New York has to track the East Coast clock. Some states set narrower hours.

TCPA consent. Consumer Action’s 2025 guide notes that the TCPA requires prior express written consent for autodialed or prerecorded marketing calls and texts to cell phones, and for robocalls to landlines. Businesses must also keep consent records, maintain an internal do-not-call list and honor do-not-call and consent-revocation requests within 10 business days.

Treat that 10-business-day figure as an outer limit. The practical standard on a floor is to suppress the number the moment the request is logged.

Where the rules stack

Most Medicare floors get in trouble in the gaps between rule sets. A lead can have TCPA consent and still fall outside CMS permission to contact. A number can be off the DNC registry and still be a cold call under CMS rules. Check each dial against both tests:

1. Does this beneficiary have documented permission to be contacted by us, for Medicare?
2. Is the number clear of the National DNC Registry, our internal list and any revocation?
3. Is it inside the legal calling window for the beneficiary’s time zone and state?
4. Is the call going to a recorded line with the notice and disclaimer in place?

If any answer is no, the call does not go out.

Rules that loosened for CY2027

Not everything got tighter. A law-firm summary of the CY2027 final rule reports that CMS eliminated the 48-hour waiting period between completing a Scope of Appointment and a personal marketing appointment, effective October 1, 2026. It also dropped the 12-hour gap between educational and marketing events at the same location, provided beneficiaries are told about the transition and can leave.

That helps agents who book appointments from inbound calls, but the Scope of Appointment itself still has to be documented. See our notes on insurance appointment setting and compliant scripts for handoff structure.

Penalties and carrier consequences

The federal exposure is real. One summary of the CMS penalty schedule puts the 2025 inflation-adjusted maximum civil monetary penalty at $48,833 per violation for a Medicare Advantage organization that fails to comply with marketing restrictions. Plans carry that exposure directly, and they pass the pressure down through contracts.

For an agency, the more immediate consequences are usually:

• Carrier audits that request specific call recordings and consent records.
• Corrective action plans, suspended contracting or terminated appointments.
• TCPA class actions, which are a separate risk from CMS enforcement.

The agencies that stay out of trouble are the ones that can pull any call, with its consent record, within minutes.

Building the rules into your call floor

Policy documents do not stop a bad dial. Controls inside the dialer and CRM do. A workable setup:

• Permission gate. No lead enters a campaign without a consent source and timestamp.
• Pre-dial checks. DNC, litigator and time-zone checks run before every call, not once a week on a list upload.
• Automatic recording. Every call to a beneficiary records by default, with the notice played or read at the start.
• Scoring and review. Review calls for the disclaimer, recording notice and compliant language, not just for sales skill. AI call scoring lets a manager cover far more calls than manual sampling.
• Retention schedule. Storage rules match the longest clock your carriers require.
• Lead vendor audit. Ask for consent records on every purchased lead and live transfer.

Automated oversight also helps with audits. AI call handling and oversight tools can help document regulated conversations and flag gaps, so that review does not depend on a manager listening to a sample. For more on rule-by-rule monitoring, see our guide on AI compliance monitoring.

Perspective

Most compliance failures on Medicare floors are workflow failures, not bad intent. An agent dials a lead nobody checked, or a manager cannot find the consent record when a carrier asks for it.

We build compliance into the dial itself. DNC and litigator checks, calling-hours rules by time zone, TCPA consent records and recording notices all run before and during the call, so agents work leads instead of policing a spreadsheet. Pair that with AI call scoring and a manager can see which calls missed the disclaimer without listening to hundreds of hours.

Our view: the agencies that grow on Medicare are the ones that make the compliant path the easy path. Keep the CRM, dialer, texting and consent records in one place and the audit becomes a report, not a scramble.

Marc

Run Medicare calling on one compliant platform

If you want these controls in the same system your agents dial from, RevRing.com offers a Medicare CRM and dialer for agents and agencies with pre-call DNC and litigator checks, time-zone calling-hours rules, consent records and recording notices. You can run on RevRing CRM or connect the CRM you already use. Pricing is on the RevRing.com pricing page.

For higher-volume floors, look at the predictive dialer and power dialer, and if you buy leads, the lead marketplace is built for that workflow.

FAQ

Can Medicare agents make cold calls?

No. CMS rules bar unsolicited telephone solicitation, robocalls, texts and voicemails to beneficiaries, including calls based on referrals. A call is not unsolicited when the beneficiary consents or initiates contact, so documented permission is what makes outbound calling possible.

Do all Medicare sales calls have to be recorded?

All calls between a TPMO and a beneficiary must be recorded, inbound or outbound, including video calls on platforms like Zoom. CMS does not require recording of in-person interactions. If a beneficiary refuses recording, the call must end.

What hours can I call Medicare prospects?

Federal rules allow telemarketing calls only between 8 a.m. and 9 p.m. in the called person’s local time. Some states are stricter, and you must also check the National Do Not Call Registry and your internal DNC list.

How long do I keep Medicare call recordings?

Under the CY2027 final rule, marketing and sales call recordings must be retained for at least six years, with audio for years one to three and audio or a full transcript after that. Enrollment records have a longer ten-year period. Confirm current requirements with your carriers.

Sources

• CMS Agent Broker Marketing FAQs (October 19, 2022)
• eCFR: 42 CFR 422.2264, Beneficiary contact
• CMS marketing rules fact sheet for plans offering Medicare coverage
• Consumer Action: What you can and can’t do under the TCPA (2025)
• Medicare Agent Compliance Guide PY2025
• Medicare Call Recording Retention: What Changed for 2027
• Medicare TPMO disclaimer changes for 2027
• CMS finalizes CY 2027 Medicare Advantage and Part D rule