Are You Sure All Medicare Calls Are Compliant?
Are all your Medicare calls compliant with CMS guidelines? Non-compliance can result in audits, sanctions, or warnings from carriers due to errors in recording, consent, and documentation.
As new marketing guidelines come into effect on October 1, 2026, agencies need to be prepared for the Annual Election Period.
This guide will take you through all CMS requirements regarding call recordings, compliance responsibilities, potential sanctions, and more.
What Are CMS Call Recording Requirements?
Under 42 CFR § 422.2274(g)(2)(ii) and 42 CFR § 423.2274(g)(2)(ii), the call recording requirement for cms is the responsibility of CMS for Medicare Advantage organizations and Part D organizations, respectively. It consists of recording all calls related to marketing, sales, and the enrollment process in its totality. The new rule has been made part of CY 2027 Final Rule, issued on April 7, 2026.
The rule applies to landlines, mobile applications and VoIP phones, and applies to the audio component of web video meetings. Video does not have to be recorded; however, the audio has to be recorded from start to finish.
CMS added the recording rule to protect people because complaints about high-pressure sales calls had grown. A recording gives plans and regulators a way to check what was said, so if a caller claims an agent made a false promise, the file settles the matter and protects the agent as well.
Who Must Comply: TPMOs Explained
The reach of the cms call recording requirements is broad. CMS defines a TPMO as any person or group that receives pay for lead generation, marketing, sales, or enrollment work in the chain of enrollment, which means the following groups all fall under the rule:
- Independent agents and brokers must comply, and even a solo practitioner counts as a TPMO because there is no small business exemption.
- Captive agents who work for a single carrier must follow the same recording standards as everyone else.
- FMOs and agencies must provide the tools and oversight that keep their downstream agents compliant.
- Lead vendors that collect beneficiary data to sell to an agent must record the first contact that gave permission to call.
When the Requirements Apply
The content of the conversation triggers the rule, and the intent to enroll does not. If your talk could sway a choice about a Medicare Advantage or Part D plan, the cms call recording requirements apply to that call.
- Marketing and education calls, such as explaining plan features, star ratings, or the difference between two plans, must be recorded.
- Needs assessments, where you ask about doctors, drugs, or monthly budget, must be recorded.
- Enrollment calls, where you take the telephone application, must be recorded.
- Retention calls that try to persuade a client to stay with a current plan must be recorded as well.
Purely administrative calls, such as booking an in-person visit or confirming a mailing address, do not strictly require recording. Even so, I suggest that you record every call, because a simple scheduling call can turn quickly when a client asks whether a doctor still takes a plan.
At that moment the cms call recording requirements switch on, and if you are not recording, you are in violation.
What Calls Must Be Recorded
You must capture every remote conversation that touches the chain of enrollment, and the cms call recording requirements cover both inbound questions and outbound sales calls.
If a call about a plan card delivery shifts into plan choices or benefit details, you must start recording at once, because that shift is exactly what the rule is built to catch.
What Changed in 2026 and When
Dates matter this year, so here is the timeline in short form.
- On April 7, 2026, CMS published the CY 2027 Final Rule in the Federal Register.
- On June 1, 2026, the rule took effect.
- On October 1, 2026, most marketing and communications changes begin to apply, and the Annual Election Period starts.
- On January 1, 2027, the plan benefits for the new year begin.
Three changes matter most for your calls. The disclaimer moves from a 60-second trigger to a trigger that fires before you discuss benefits, the 48-hour SOA wait disappears so you can take an SOA and begin the appointment on the same call, and marketing recordings need six years of storage instead of ten.
Do not misread the SOA change in the cms call recording requirements. CMS removed the waiting period but not the form, so you still need a clean SOA before any personal marketing appointment, and same-day appointments demand same-day paperwork.
Why CMS Call Recording Compliance Matters More Than Ever
The market for Medicare Advantage keeps growing, and the cms call recording requirements keep tightening with it, and millions of beneficiaries rely on agents and brokers to help them work through the details of each plan. More enrollment brings more regulation, and CMS now looks harder at marketing practices, beneficiary communications, TPMO activity, enrollment conduct, and documentation.
If an auditor asks for proof of what happened during a sales call, your organization must produce it quickly, and auditors will test your process for the cms call recording requirements. Compliance is no longer a back-office task, and it has become a business survival need.
Retention Periods: 6 Years vs. 10 Years
- Retention is the hot topic in the cms call recording requirements this year. Older guidance set one ten-year rule for all recordings, but the CY 2027 Final Rule split that rule into two tracks, and CMS said that long storage for marketing calls was costly and gave little value for enforcement.
- For marketing and sales calls, you must keep the record for six years. During years one to three, you must keep the full audio, and during years four to six, you may keep either the audio or a complete and accurate transcript that shows every word each person said.
- For telephonic enrollment calls, you must keep the record for ten years. CMS treats the enrollment recording as the enrollment form and as proof that the person chose to enroll, and you can find the rule at 42 CFR section 422.504(e)(1)(iv) and 42 CFR section 423.505(e)(1)(iv).
How to Handle a Call With Both Parts
Some calls hold both parts. A call may begin with a plan discussion, move into an SOA, and end with an enrollment, and that single call then sits in two record types.
The safe path is simple: keep the whole call for ten years. Splitting the file is risky because a bad cut can destroy part of the legal enrollment record, and storing too much costs a little money while storing too little can cost a contract. This approach keeps you safe under the cms call recording requirements.
Required TPMO Disclaimer Script (Copy-Ready)
Compliance with the cms call recording requirements demands exact wording. Under the CY 2027 Final Rule, you must read the disclaimer before you discuss plan benefits, and you no longer need to read it in the first 60 seconds. Do not change the words, much like the mini-Miranda that debt collectors must recite.
Standard National TPMO Disclaimer:
"We do not offer every plan available in your area. Currently we represent [insert number of organizations] organizations which offer [insert number of plans] products in your area. Please contact Medicare.gov or 1-800-MEDICARE to get information on all of your options."
Check your carrier's current approved wording. Some scripts still name your local State Health Insurance Program (SHIP), but the new rule drops that reference from the required text.
Inbound Call Script Variant:
"Thank you for calling. This call is recorded for quality and compliance. Before we discuss plan options, please note: we do not offer every plan available in your area. We represent [X] organizations offering [Y] products locally. You can contact Medicare.gov or 1-800-MEDICARE to review all coverage choices."
Outbound Call Script Variant:
"Hello, this call is on a recorded line about Medicare plan options. Before we review benefits, please note: we do not offer every plan available in your area. We represent [X] organizations offering [Y] products locally. You can learn about all options at Medicare.gov or by calling 1-800-MEDICARE."
Voicemail Script Variant:
"This message is from a licensed agent on a recorded line about your Medicare inquiry. We do not represent all plans in your area. Please call back at [Phone Number] or visit Medicare.gov to compare all local plans."
What to Do If a Beneficiary Refuses Recording
Under the cms call recording requirements, there is no opt-out for phone sales, so you cannot market or sell by phone without an active recording. If a caller refuses, you must end the sales call politely and guide the person toward another route:
- Book an in-person appointment, where the cms call recording requirements do not apply to the meeting itself.
- Send the caller a direct link to an online enrollment portal.
- Send a paper form to the address of the person who will receive the benefits.
- Connect the caller to 1-800-MEDICARE or the local SHIP office.
Also, add a note to your CRM with the date and time the call was concluded, because this is what proves your actions were correct if the complaint comes later.
State Call-Recording Consent Laws vs. CMS Rules
You need to observe the state’s privacy laws. The federal law requires only one-party consent, while more than ten states require the consent of all persons on the call.
In all-party jurisdictions, the automated announcement or oral message will inform the caller that they can provide their consent to be recorded by remaining on the line, and this procedure protects you against any civil actions, since it satisfies the call recording requirements for cms. Federal laws do not supersede state privacy laws.
Storage, Security and Access Requirements
- Secure storage plays a crucial role in cms call recording requirements. The recordings contain health information, prescription information, and personal details, so you must comply with the HIPAA Security Rule 45 CFR Part 164, Subpart C. You must encrypt all your data with an encryption method like AES-256 at rest and TLS in transit.
- According to 42 CFR section 422.504, Medicare plans can audit your records; therefore, you must create an index for every file you have based on the date, beneficiary’s name, agent’s National Producer Number, phone number, and plan sponsor. You should be able to access the file in 24 to 48 hours.
- Agents tend to lose files, as they spread out their files between their personal phones, VoIP dashboard, FMO portal, carrier portal, and desktop. The file may exist, yet no one can locate it; therefore, you need to pick one location for your recordings and associate each file with the beneficiary record from your CRM.
Penalties for Non-Compliance
Missing the cms call recording requirements brings swift action, because plan sponsors answer for their downstream partners and carriers watch agent behavior closely.
- Carriers can end your contract, which revokes your agent appointments and cancels your marketing agreements.
- Carriers can claw back commissions, so you can lose both initial and renewal pay on non-compliant enrollments.
- CMS can assess civil monetary penalties per violation under 42 CFR Part 422, Subpart O.
- Carriers can suspend marketing, which blocks you from processing new plan enrollments.
- Cases can go to state insurance departments, which may review or sanction your professional license.
CMS Call Recording Compliance Checklist
Use this list before every Medicare sales or enrollment call to help you meet the cms call recording requirements.
✅Confirm that the call is Medicare-related and must be recorded.
✅ Turn on automatic recording before the first greeting.
✅ State that the line is recorded right at the start of the call.
✅ Read the TPMO disclaimer before you discuss any plan benefits.
✅ Make sure the person understands that you are not the government.
✅ Keep the recording on for the full marketing, sales, or enrollment conversation.
✅ Save the audio from web-based calls as well as phone calls.
✅ Attach the recording to the beneficiary record in your CRM.
✅ Store the file securely with strong access controls.
✅ Keep marketing calls for six years and enrollment calls for ten years.
✅ Make each file easy to retrieve for audits or complaints.
✅Review missed-call reports and fix gaps fast.
✅ Stop the sales call at once if a person refuses to be recorded.
Read our comprehensive call audit guide to build an internal review program that meets federal standards.
How to Audit Recording Compliance at Scale
Old-style quality programs sample only 1% to 3% of calls, which leaves most conversations unseen, and one missing disclaimer can cost you a carrier contract. Manual sampling simply cannot prove the cms call recording requirements.
Thunai reviews 100% of calls with speech recognition and language models, and it checks that you read the disclaimer, tracks consent, and flags missing disclosures in real time.
Learn what call scoring software is and how Thunai's tool cuts post-call auditing work by over 70%. Contact center managers say it turns hard QA duties into clear, automated steps, and when every call receives a score, you can prove that every call meets the cms call recording requirements.
CMS Recording vs HIPAA
CMS rules and HIPAA do different jobs. CMS covers Medicare marketing, sales, and enrollment conduct, while HIPAA covers the privacy and security of health data and the cms call recording requirements, and HIPAA often applies to the same call.
If a call includes health details, both sets of rules apply, so you should handle storage, access, and retention as part of one compliance workflow.
How Thunai Helps
Thunai automates compliance so that agents do not have to rely on manual follow-up, and it makes cms call recording requirements compliance easier in four ways.
- Thunai Reflect monitors calls in real time and flags missed disclosures before they become audit issues.
- Thunai Brain gives agents verified plan facts during the conversation, which lowers the risk of wrong benefit details.
- The recording tools include transcription and searchable call reviews, so finding evidence becomes simple.
- The multilingual option helps your team manage calls in more than 200 languages.
Book your Thunai demo today and see how easy cms call recording requirements compliance can be.
FAQs on CMS Call Recording Requirements
Does CMS require call recording for all Medicare agents?
CMS requires recording of all marketing and sales calls for Medicare Advantage and Part D, including calls by TPMOs acting for a plan, while calls outside those topics do not need to be recorded.
How long must Medicare call recordings be kept?
Marketing and sales calls must be kept for six years, with audio for three years and then either audio or a full transcript for three more, while telephonic enrollment calls must be kept for ten years.
What happens if a Medicare agent does not record calls?
You may face discipline, contract termination, reporting duties, and other contract penalties.
Do I need to tell callers that I am recording?
Yes, you should say so at the start of the call, and in all-party consent states this step is vital.
Can I store recorded calls in the cloud?
Yes, as long as the storage is secure and your process meets HIPAA and carrier rules.
What are the core cms call recording requirements for independent brokers?
Independent brokers must record every call about Medicare Advantage and Part D marketing, sales, and enrollment, and they must keep marketing files for six years and enrollment files for ten years.
Must I record in-person sales appointments?
No, since CMS does not require recording of face-to-face meetings, but you must still record the calls that come before and after the visit.
What if a beneficiary declines recording?
You must end the sales call, and you may offer an in-person visit, a paper form, or a link to an online portal.
Why do telephonic enrollments have a ten-year retention period?
The recording acts as the legal enrollment application and proves that the person chose to enroll, as 42 CFR section 422.504(e)(1)(iv) explains.
Are routine administrative calls recorded?
No, because general service calls that do not touch plan benefits or enrollment need no recording.
Do standalone Medigap policies trigger recording rules?
No, since standalone Medicare Supplement calls fall outside the rule, but if you bundle a Part D plan into the discussion, you must record the whole call.
.webp)
