Medicare Says Keep Calls 6 Years. Enrollment Needs 11.

On October 1, 2026, the rules that govern how Medicare third-party marketing organizations record, retain, and open their sales calls change: marketing and sales call recordings must be kept for 6 years instead of 10, and the required TPMO disclaimer must be read before any benefits are discussed rather than within the first minute. Both changes come from the Contract Year 2027 final rule (91 FR 17384, published April 6, 2026).

The dates are worth getting right, because a lot of published guidance has them muddled. The regulations themselves are effective June 1, 2026 and are already written into the Code of Federal Regulations. October 1, 2026 is the applicability date. In CMS's words, "the new marketing and communications policies in this rule are applicable for all contract year 2027 marketing and communications, beginning October 1, 2026." That date is not arbitrary: 42 CFR § 422.2263(a) is what opens the marketing year, providing that organizations "may begin marketing prospective plan year offerings on October 1 of each year for the following contract year."

So October 1 is the first day you make CY2027 marketing calls, and the first day you make them under these rules. AEP opens two weeks later, on October 15. By then the volume that defines a Medicare seller's entire year is moving through the same dialers, CRMs and quoting tools as last season, under rules that changed in between.

What actually changes on October 1, 2026

Two provisions, both aimed squarely at the phone.

	Through Sept 30, 2026	From Oct 1, 2026
Marketing/sales call retention	10 years	6 years — audio for years 1-3, audio or complete and accurate transcript for years 4-6
TPMO disclaimer timing	"within the first minute of a sales call"	"prior to the discussion of any benefits"
Enrollment records	Current contract period + 10 prior periods	Unchanged
How a recording gets pulled	Complaint-triggered	Unchanged

The retention change is codified at 42 CFR § 422.2274(g)(2)(ii), which now reads: "All marketing and sales calls, including the audio portion of calls conducted via web-based technology, must be recorded and retained in their entirety for a minimum period of 6 years. For the first 3 years of the retention period, records must be maintained in audio format. For years 4, 5, and 6, records may be maintained in either audio format or as complete and accurate transcript recordings."

CMS states the change plainly in the rule: "As finalized, CMS is reducing the overall retention time from 10 to 6 years. Years 1 through 3 must be audio recordings, and years 4 through 6 can be either audio recordings or transcripts. This will take effect on October 1, 2026, to coincide with the beginning of the 2027 plan year marketing."

Read that as relief and you will miss the part that costs money.

One call, two retention clocks

This is the part nobody has solved, and it needs stating precisely.

The marketing and sales portion of a call now has a 6-year obligation. The enrollment portion does not. Enrollment records are governed separately by 42 CFR § 422.504(e)(1)(iv), which requires an organization to retain "the enrollment and disenrollment records for the current contract period and 10 prior periods." CMS is explicit that a phone enrollment's recording is that record: "plans are still required to record the enrollment portion of the call, as the recording in this instance serves as the enrollment form and provides proof that the beneficiary attested to their intent to enroll."

Now the part that makes it hard. CMS defines exactly where that portion begins:

The boundary between the two obligations is a sentence spoken in the middle of a conversation. Not a separate call. Not a transfer. Not a field in your dialer. A moment in a WAV file where an agent tells a beneficiary they are now completing an enrollment request.

No dialer segments one recording into two retention classes. Dialers store a call as a call. Which means that on October 1, every enrollment call your floor makes becomes a single audio file carrying two different legal obligations with a boundary that only exists in the words.

You cannot find that boundary without a transcript of the call. And you cannot rely on a transcript you cannot prove is complete.

The cleanup that deletes your enrollment form

Here is how this goes wrong, and it goes wrong quietly.

Somebody reads the headline everybody else read, retention drops from ten years to six, and updates the retention policy on the recording archive. Six years, then purge. It looks like housekeeping, and it is the cheapest-looking line on the compliance budget.

Then a carrier opens an audit on a policy written in 2027 and asks for proof the beneficiary attested to their intent to enroll. CMS has already told you what that proof is: for a phone enrollment, the recording of the enrollment portion is the enrollment form. It was sitting inside the file that got purged at year six, because nothing in that file marked where the marketing stopped and the enrollment started.

At that point you are not arguing about a disclaimer. You are explaining to a carrier why you cannot produce the enrollment form for policies you were already paid on, and that conversation has one ending. The commission goes back.

The six-year number is real and it is in the regulation. It just does not cover the whole recording, and nothing in the audio tells you where it stops covering it.

The retention rule is only half of what changed that morning. The other half quietly broke the way most floors currently prove they read the disclaimer.

The disclaimer moved from a timestamp to a sequence

The second change is smaller in wording and larger in consequence.

Until September 30, the required TPMO disclaimer had to be conveyed "within the first minute of a sales call." From October 1, 42 CFR § 422.2267(e)(41)(ii) requires it to be "verbally conveyed during sales calls prior to the discussion of any benefits."

CMS explained why it proposed the change: requiring the disclaimer in the first minute "is not always the appropriate time to notify the beneficiary," because calls frequently open with demographic questions, and sometimes those questions establish that the conversation should not proceed to benefits at all.

Here is what that does to your evidence. Under the old rule, compliance was a timestamp: the disclaimer landed inside 0:60 or it did not, and you could check that mechanically. Under the new rule, compliance is an ordering: did the disclaimer come before the first mention of a benefit? Answering that requires knowing what was said, in what order, on that specific call.

Compliance just moved from a storage problem to a quality-assurance problem. Storage you can buy. Knowing what was said on every call is a different thing entirely.

How a recording actually gets pulled

There is a persistent myth that CMS reviews marketing calls during a scheduled program audit. That is not how it works, and the reality is less predictable.

CMS describes its own process in the rule: "CMS has requested call recordings based on complaints from CMS's Complaint Tracking Module (CTM). The requested recordings were chosen based on the severity of the allegations in the complaint." And CMS is not the only party asking: "In addition to CMS, other governmental entities, such as the Department of Justice (DOJ) have relied on call recordings for investigations."

So the trigger is a complaint, which means it is undated. A call your floor made five weeks ago can surface at any point in the retention window, chosen specifically because someone alleged something serious about it.

It also matters who is on the hook. Under 42 CFR § 422.504(i)(1), regardless of any relationship with first tier, downstream, and related entities, "the MA organization maintains ultimate responsibility for adhering to and otherwise fully complying with all terms and conditions of its contract with CMS." The carrier carries it. Which is exactly why the carrier pushes the requirement down to everyone dialing on its behalf.

And CMS has already listened at scale. In its review of hundreds of sales, marketing, and enrollment audio calls, CMS found that only one plan option from one MA organization was discussed in over 80 percent of the calls reviewed. That is not a warning that reviews might happen. It is a published finding from reviews that already did.

What most published guidance still gets wrong

If you are checking your vendors' compliance content this month, three errors keep showing up, and each one is now a live liability:

1. "Marketing and sales calls must be kept 10 years." Wrong from October 1. It is 6.
2. "CMS audits your marketing calls." Marketing is not a scheduled program-audit area. Recordings are requested off complaints, which is harder to prepare for, not easier.
3. "The disclaimer must be in the first minute." Replaced. It is now before any benefits are discussed.

There is no self-executing per-call fine for a missed disclaimer. The consequence arrives through the carrier relationship, not a penalty notice, which is why the exposure is commercial rather than administrative.

What this means for the floor, in practice

Strip the regulation away and October 1 leaves a Medicare seller with four concrete requirements:

• Record every marketing and sales call in its entirety, and keep it 6 years.
• Be able to show the disclaimer was spoken before any benefit was mentioned, on the specific call being questioned.
• Be able to locate the enrollment boundary inside a single recording, because the portion after it carries a longer obligation.
• If you use transcripts for years 4 through 6, be able to show they are complete and accurate.

That last requirement is the one almost nobody has thought through. CMS permits a transcript instead of audio in years 4, 5 and 6, but only a "complete and accurate" one. A transcript is a text file. Anyone can edit a text file. If a transcript is the only thing standing between you and a complaint from four years ago, the obvious question is how you prove it is the same transcript you produced back then, and that it faithfully represents the call.

Asserting it is not proving it.

Where a signed record fits

Medicare sellers already pay for this idea in another form. A TrustedForm certificate proves the web form a lead arrived on, and nobody in this industry argues about whether that is worth the money. Nothing in the stack does the same job for the conversation that follows it.

That is the specific gap Klariqo closes. Klariqo runs on the dialer you already have, including VICIdial, and turns each call into a Klariqo Call Record (KCR): quality review applied to 100 percent of calls rather than a sample, with a full transcript, sealed into a signed, tamper-evident record. Every record is witnessed on JLINC and carries an independent RFC 3161 trusted timestamp (DigiCert), the standard behind legal e-signatures.

Mapped against the four requirements above:

• Disclaimer ordering. Scoring 100 percent of calls against your own rulebook answers "was the disclaimer spoken before any benefit" on every call, not on the two per hundred a QA analyst has time to open.
• The enrollment boundary. CMS defines it as a spoken sentence, so finding it means reading the words. A KCR produces a transcript of every call, so the boundary is locatable rather than guessed at.
• Complete and accurate transcripts. The transcript ships inside a signed record with an independent timestamp. Change one byte and the signature breaks. That turns "our transcript is accurate" from a claim into something a third party can check.
• Handing it over. Anyone can verify a KCR at verify.klariqo.com with no account and no login, or run the open-source verifier themselves. A carrier, an auditor, or opposing counsel does not have to trust you, and does not have to trust us.

A KCR does not make a call compliant, and it will not tell you whether a given call was lawful. What it removes is the guessing. When a complaint surfaces about a call from three years ago, you either have a provable record of what was said or you have a story about it.

The signed record of every call is free for your first 10,000 recorded calls. QA scoring runs at $0.02 per minute, about ten cents on a five-minute call. If you want to see the record before you talk to anyone, upload one of your own calls at klariqo.com/try and get a signed KCR back in about a minute. No account, no sales call.

FAQ

What changes for Medicare TPMOs on October 1, 2026? Two things. Marketing and sales call recordings must be retained 6 years instead of 10, with audio required for the first 3 years. And the TPMO disclaimer must be spoken prior to the discussion of any benefits, rather than within the first minute of the call.

How long must Medicare marketing and sales calls be retained in 2026? Six years, under 42 CFR § 422.2274(g)(2)(ii) as amended by the CY2027 final rule. The first three years must be kept in audio format. Years four, five and six may be audio or complete and accurate transcript recordings. The prior requirement was ten years.

Does the enrollment portion of a Medicare call have a different retention period? Yes. Enrollment and disenrollment records must be retained for the current contract period plus ten prior periods under 42 CFR § 422.504(e)(1)(iv), and CMS states the recording of the enrollment portion serves as the enrollment form. One call can therefore carry two different obligations.

Where does the enrollment portion of a call begin? CMS defines it as beginning "when the beneficiary is advised that they are completing an enrollment request, after which they provide the information as required by the enrollment form and attest to their intention to enroll." The boundary is a spoken sentence inside the recording.

When must the TPMO disclaimer be read on a sales call? Prior to the discussion of any benefits, under 42 CFR § 422.2267(e)(41)(ii). This replaced the earlier requirement to convey it within the first minute of the call, and applies to contract year 2027 marketing beginning October 1, 2026.

Can an audio file timestamp prove the TPMO disclaimer was read in time? No. The old rule was a duration, so a timestamp settled it. From October 1 the disclaimer must come before any benefit is discussed, which makes compliance a question of sequence rather than clock time. Proving it means showing what was said and in what order on that specific call.

What happens if I delete Medicare call recordings at six years? The marketing and sales obligation is satisfied. The enrollment obligation is not. CMS treats the recording of the enrollment portion as the enrollment form, and 42 CFR § 422.504(e)(1)(iv) requires enrollment records for the current contract period plus ten prior periods, so a six-year purge can destroy evidence you are still required to hold.

Does CMS audit Medicare marketing calls? Not on a schedule. CMS requests specific recordings based on complaints in its Complaint Tracking Module, selected by the severity of the allegation. The Department of Justice has also relied on call recordings for investigations.

Is the October 1, 2026 date the effective date of the rule? No. The CY2027 final rule regulations are effective June 1, 2026 and are already in the Code of Federal Regulations. October 1, 2026 is the applicability date for contract year 2027 marketing and communications, matching the marketing year start under 42 CFR § 422.2263(a).

---

Sources: CY2027 Medicare Advantage and Part D final rule, 91 FR 17384 (published April 6, 2026) · 42 CFR § 422.2274 · 42 CFR § 422.2267 · 42 CFR § 422.2263 · 42 CFR § 422.504

This article describes federal regulations as published and is not legal advice. Confirm application to your organization with your compliance counsel.