TPMO Compliance for Medicare Lead Generation: 2026 Rules

Most people who generate Medicare leads discover they are a TPMO in one of two ways. Either a carrier's compliance team explains it during onboarding, or a plan partner terminates the relationship and explains it afterwards. The second route is expensive and entirely avoidable.

This is an operator's guide to what the designation means, what it requires you to build, and where the recent rule changes land. It is not legal advice. The authority is 42 CFR Part 422 Subpart V and its Part 423 counterpart, plus each year's Final Rule, and your carrier partners' own contractual requirements frequently go further than the regulation does.

Am I a TPMO?

CMS describes TPMOs as organisations and individuals, including independent agents and brokers, who are compensated to perform lead generation, marketing, sales and enrolment-related functions as part of the chain of enrolment. Read that broadly, because CMS intends it broadly.

The four obligations that matter most

The disclaimer, and what changed

The TPMO disclaimer has been revised repeatedly since it was introduced, and recent rulemaking continues to adjust it. Notably, references to State Health Insurance Assistance Programs as a source of information are being removed from the required disclaimer text, with CMS streamlining the content overall.

Two practical implications for anyone running Medicare marketing pages:

Hardcoded disclaimer text is a liability. If the wording lives inside three hundred blog posts, a CMS revision means three hundred edits, and you will miss some. It belongs in a single versioned template component rendered everywhere.

Old text is worse than no text in an audit. A page carrying a superseded disclaimer demonstrates that you were aware of the requirement and failed to maintain it. Version the component, log the version each page rendered, and diarise a review at each Final Rule.

• Render the disclaimer from one component, never from copy pasted into content
• Store a version number and effective date with the component, and log which version each page served
• Apply it to every marketing surface: web pages, landing pages, emails, ad creative and call scripts
• On calls, deliver it within the first minute, and make it part of the recorded audio
• Set a calendar reminder tied to the annual Final Rule publication to review the text
• Keep dated screenshots of representative pages so you can prove what was live and when

The consent rule that broke shared leads

This is the change with the largest commercial consequence, and the one most often misunderstood by people arriving from other insurance verticals.

CMS has restricted how TPMOs may share beneficiary contact information collected through marketing activity. In broad terms, onward sharing requires prior express written consent from the beneficiary, and that consent must identify the recipient rather than authorise open-ended distribution.

Set that against how shared leads work in auto insurance. A single form fill is distributed to four or five buyers, often through a ping-post auction, with a generic consent naming a long list of "marketing partners". That model does not survive contact with a rule requiring a named recipient.

The strategic consequence is that Medicare lead generation rewards quality over distribution volume, which is a different business to run. Publishers who tried to port a ping-post architecture across found that the architecture itself was the problem, not the configuration. Our explainer on ping post lead distribution describes the model this rule constrains.

Call recording and retention

Sales and enrolment calls with beneficiaries must be recorded in their entirety and retained. Recent rulemaking reduces the retention period from ten years to six, which lowers storage cost and administrative burden but changes nothing about the obligation to capture.

The transfer row is where systems quietly fail. A publisher captures its own call leg, hands off to a licensed partner, and assumes the partner's recording covers the rest. Then an audit asks for a complete call and neither party has one continuous artefact. Agree the recording architecture with your transfer partner in writing before the first call, not during the first audit.

Why plans audit your traffic sources

CMS has been explicit that it is the plan's responsibility to know how and where their TPMOs obtain leads and enrolments. That obligation flows downhill. Your carrier or FMO partner has to be able to answer for your traffic, which means they will ask you, and "we buy from a vendor" is not an answer that satisfies anyone.

This turns provenance tracking from an analytics preference into a compliance control:

• Every lead carries a sub-ID identifying the exact placement, creative and partner that produced it
• Every sub-ID maps to a declared source in a maintained register, reviewed quarterly against actual referrer data
• Consent artefacts are stored with the lead record, not in a separate system that can drift out of sync
• A rendered snapshot of the landing page as it appeared at consent time is retained
• You can kill a single source in one action without disrupting the rest of the operation
• Anything you cannot trace to a declared source is quarantined rather than sold

That last point is the discipline that separates operations that survive audits from ones that do not. Untraceable leads are not a data-quality problem to clean up later. They are inventory you cannot lawfully monetise.

Building compliance into the stack

Common questions

Does the TPMO disclaimer apply to a blog post? It applies to marketing materials. A page whose purpose is to generate Medicare leads is marketing, whatever its format. Purely educational content with no compensation tied to enrolment sits differently, but the boundary is easy to cross without noticing.

Do I need to record calls if I only transfer them? Assume yes for your leg, and agree with the receiving partner in writing who captures what across the handoff. Gaps at the transfer point are a recurring audit finding.

Can I still sell a Medicare lead to more than one buyer? Only where you have consent that names each recipient. Open-ended, partner-list consent is not adequate. In practice this pushes most operations toward one-to-one distribution.

How long do I keep call recordings? Six years under the streamlined rule, but check your carrier contracts, which sometimes require longer, and check the current-year rule before you set a deletion job.

What happens if a plan finds an undisclosed subcontractor? Expect termination of the relationship at minimum. Plans carry the oversight obligation, so an undisclosed downstream partner is their exposure as well as yours, and they resolve it decisively.

Does any of this apply to Medicare Supplement? Medigap is regulated differently, primarily at state level rather than under the CMS MA and Part D marketing rules. Do not assume a single compliance posture covers both.