Prior express consent for TPMOs: CMS Medicare issues new rules

The Centers for Medicare & Medicaid Services (CMS) has recently taken steps to enhance consumer safeguards within the Medicare Advantage (MA), Medicare Part D, and Medicare Supplement plans market. Through a newly issued ruling, CMS has established additional requirements for Medicare Third-Party Marketing Organizations (TPMOs) involved in the marketing and individuals’ annual enrollment in these Medicare plans.

This guide is designed to provide you with a better understanding of this ruling’s impact and how it can influence the choices and privacy of the healthcare industry. We will examine how the rules impact lead generation and TPMOs in Medicare marketing, and offer guidance on maintaining compliance with the revised standards.

What is TPMO Medicare?

TPMO in Medicare stands for Third-Party Marketing Organization. These organizations are entities that Medicare Advantage (MA) and Medicare Part D plan administrators may use to perform marketing and outreach activities regarding annual plan enrollment. These organizations include a wide range of entities such as brokers, agents, and other marketing firms that help promote Medicare plans and assist beneficiaries in enrolling.

By providing marketing expertise and direct beneficiary support, TPMOs can help contribute to the effective dissemination of Medicare plan information and facilitate informed enrollment decisions.

CMS issues new ruling on Medicare TPMO requirements

Half of Medicare beneficiaries are enrolled in Medicare Advantage (MA) plans, a number that has doubled since 2010. This growth is partly due to the extensive network of insurance agents, brokers, field marketing organizations, and lead generators that help beneficiaries choose and enroll in plans. However, some marketing practices in this sector have drawn regulatory scrutiny for potentially misleading or confusing beneficiaries.

In response, the CMS issued a final rule update on April 4 that imposes significant restrictions regarding prior express written consent requirements on TPMOs, including lead generators. This ruling underscores CMS’s commitment to ensuring that Medicare beneficiaries are fully informed about their options and choices when selecting Medicare plans.

Key changes to prior express written consent requirements

TPMOs for Medicare will now face stricter controls on how they handle leads. Starting October 1, 2024, TPMOs must obtain prior express written consent from beneficiaries before sharing their data with other TPMOs for marketing or enrollment purposes.

Each sharing of data requires one-to-one consent through a clear and conspicuous disclosure, and blanket consent for redistributing contact information is no longer allowed. Additionally, TPMOs cannot condition access to information on a beneficiary’s agreement to have their contact information sold or shared.

Some view this rule update as an opportunity to more clearly connect existing privacy protections under the Health Insurance Portability and Accountability Act (HIPAA) to TPMOs. TPMOs that are HIPAA-covered entities (CE) or business associates (BA) must adhere to the HIPAA Privacy Rule, which includes limitations on using protected health information (PHI) for marketing.

Moreover, TPMOs must comply with the Telephone Consumer Protection Act (TCPA) and related Federal Communications Commission (FCC) regulations when performing telephone or text message outreach. These include obtaining prior express written consent for telemarketing via robocalls or robotexts, with new amendments effective January 27, 2025, requiring one-to-one consent for each seller. In their rule update, CMS specifically referenced the exact language the FCC used in their TCPA rule update regarding one-to-one consent requirements.

Thus, TPMOs should be cautious when contacting Medicare leads, whether using automated or manual dialing methods, to ensure compliance with these stringent new requirements.

In addition, TPMOs must keep a record of the opt-out request and honor it within 10 business days. This requirement ensures that beneficiaries are not bombarded with unwanted marketing messages, and helps to ensure that marketing preferences are respected in the marketplace.

This requirement is designed to ensure that Medicare beneficiaries are fully aware of the implications of their decision. By promoting transparency, the ruling aims to equip beneficiaries to make well-informed choices about their Medicare coverage.

Staying compliant with the updated TPMO guidelines

In today’s landscape, with a spotlight on data privacy and consumer safeguards, TPMOs are called to unwaveringly uphold these compliance measures. By doing so, they earn the trust of Medicare beneficiaries, showcase a dedication to principled marketing, and contribute to a healthcare environment that respects the rights of beneficiaries, ensuring their healthcare choices are made with the fullest consent and responsible sharing of personal information.

To ensure that beneficiaries are fully informed and in control, TPMOs must keep a record of all prior express written consents obtained. These records must be maintained and made available for CMS review upon request. Failure to maintain these records can result in significant civil monetary penalties and other enforcement actions.

The new rules are a significant step in protecting Medicare beneficiaries and promoting ethical behavior in Medicare marketing. By requiring prior express written consent and promoting transparency, CMS aims to create a more secure and trustworthy Medicare marketplace that benefits Medicare beneficiaries, health insurance issuers, and TPMOs.

By adapting to these new requirements and operating transparently, TPMOs can continue to serve the Medicare market and build trust with beneficiaries. This collective effort will lead to a more ethical and sustainable Medicare marketing environment that benefits all involved.

Provide documentation of consent with TrustedForm

Although the journey to one-to-one consent is still an ongoing one, ActiveProspect can help with a small yet crucial step at its beginning: Documenting proof of consent with TrustedForm.

TrustedForm is the ultimate compliance solution for documenting TCPA consent on digital lead capture forms, offering a number of products:

• TrustedForm Certify reduces compliance risk by documenting proof of TCPA consent and ensures your certified contacts have requested communication.
• TrustedForm Retain guarantees certificate availability for up to five years.
• TrustedForm Insights allows you to make informed decisions to optimize lead-buying strategies and maximize your ROI.
• TrustedForm Verify optimizes the consent capture process by enabling users to identify and categorize TCPA consent language for different lead vendors.

Key takeaways

The updated CMS rules for TPMOs underscore the importance of transparency, informed consent, and responsible data sharing. By following these guidelines closely, TPMOs can demonstrate their commitment to protecting the privacy of Medicare beneficiaries, building trust in the healthcare marketplace, and contributing to a more secure and efficient system that benefits everyone.

ActiveProspect is here to support your journey to one-to-one consent with a small yet crucial step towards TCPA compliance. If you’d like to see how TrustedForm works, book a free demo now!