Medicare TPMO Call Rules: What Changes October 1, 2026

On October 1, 2026, the rules that govern how Medicare third-party marketing organizations record, retain, and open their sales calls change: marketing and sales call recordings must be kept for 6 years instead of 10, and the required TPMO disclaimer must be read before any benefits are discussed rather than within the first minute. Both changes come from the Contract Year 2027 final rule (91 FR 17384, published April 6, 2026).

The dates are worth getting right, because a lot of published guidance has them muddled. The regulations themselves are effective June 1, 2026 and are already written into the Code of Federal Regulations. October 1, 2026 is the applicability date. In CMS's words, "the new marketing and communications policies in this rule are applicable for all contract year 2027 marketing and communications, beginning October 1, 2026." That date is not arbitrary: 42 CFR § 422.2263(a) is what opens the marketing year, providing that organizations "may begin marketing prospective plan year offerings on October 1 of each year for the following contract year."

So October 1 is the first day you make CY2027 marketing calls, and the first day you make them under these rules. AEP opens two weeks later, on October 15. By then the volume that defines a Medicare seller's entire year is moving through the same dialers, CRMs and quoting tools as last season, under rules that changed in between.

What actually changes on October 1, 2026

Two provisions, both aimed squarely at the phone.

The retention change is codified at 42 CFR § 422.2274(g)(2)(ii), which now reads: "All marketing and sales calls, including the audio portion of calls conducted via web-based technology, must be recorded and retained in their entirety for a minimum period of 6 years. For the first 3 years of the retention period, records must be maintained in audio format. For years 4, 5, and 6, records may be maintained in either audio format or as complete and accurate transcript recordings."

CMS states the change plainly in the rule: "As finalized, CMS is reducing the overall retention time from 10 to 6 years. Years 1 through 3 must be audio recordings, and years 4 through 6 can be either audio recordings or transcripts. This will take effect on October 1, 2026, to coincide with the beginning of the 2027 plan year marketing."

Read that as relief and you will miss the part that costs money.

One call, two retention clocks

This is the part nobody has solved, and it needs stating precisely.

The marketing and sales portion of a call now has a 6-year obligation. The enrollment portion does not. Enrollment records are governed separately by 42 CFR § 422.504(e)(1)(iv), which requires an organization to retain "the enrollment and disenrollment records for the current contract period and 10 prior periods." CMS is explicit that a phone enrollment's recording is that record: "plans are still required to record the enrollment portion of the call, as the recording in this instance serves as the enrollment form and provides proof that the beneficiary attested to their intent to enroll."

Now the part that makes it hard. CMS defines exactly where that portion begins:

The boundary between the two obligations is a sentence spoken in the middle of a conversation. Not a separate call. Not a transfer. Not a field in your dialer. A moment in a WAV file where an agent tells a beneficiary they are now completing an enrollment request.

No dialer segments one recording into two retention classes. Dialers store a call as a call. Which means that on October 1, every enrollment call your floor makes becomes a single audio file carrying two different legal obligations with a boundary that only exists in the words.

You cannot find that boundary without a transcript of the call. And you cannot rely on a transcript you cannot prove is complete.

The disclaimer moved from a timestamp to a sequence

The second change is smaller in wording and larger in consequence.

Until September 30, the required TPMO disclaimer had to be conveyed "within the first minute of a sales call." From October 1, 42 CFR § 422.2267(e)(41)(ii) requires it to be "verbally conveyed during sales calls prior to the discussion of any benefits."

CMS explained why it proposed the change: requiring the disclaimer in the first minute "is not always the appropriate time to notify the beneficiary," because calls frequently open with demographic questions, and sometimes those questions establish that the conversation should not proceed to benefits at all.

Here is what that does to your evidence. Under the old rule, compliance was a timestamp: the disclaimer landed inside 0:60 or it did not, and you could check that mechanically. Under the new rule, compliance is an ordering: did the disclaimer come before the first mention of a benefit? Answering that requires knowing what was said, in what order, on that specific call.

Compliance just moved from a storage problem to a quality-assurance problem. Storage you can buy. Knowing what was said on every call is a different thing entirely.

How a recording actually gets pulled

There is a persistent myth that CMS reviews marketing calls during a scheduled program audit. That is not how it works, and the reality is less predictable.

CMS describes its own process in the rule: "CMS has requested call recordings based on complaints from CMS's Complaint Tracking Module (CTM). The requested recordings were chosen based on the severity of the allegations in the complaint." And CMS is not the only party asking: "In addition to CMS, other governmental entities, such as the Department of Justice (DOJ) have relied on call recordings for investigations."

So the trigger is a complaint, which means it is undated. A call your floor made five weeks ago can surface at any point in the retention window, chosen specifically because someone alleged something serious about it.

It also matters who is on the hook. Under 42 CFR § 422.504(i)(1), regardless of any relationship with first tier, downstream, and related entities, "the MA organization maintains ultimate responsibility for adhering to and otherwise fully complying with all terms and conditions of its contract with CMS." The carrier carries it. Which is exactly why the carrier pushes the requirement down to everyone dialing on its behalf.

And CMS has already listened at scale. In its review of hundreds of sales, marketing, and enrollment audio calls, CMS found that only one plan option from one MA organization was discussed in over 80 percent of the calls reviewed. That is not a warning that reviews might happen. It is a published finding from reviews that already did.

What most published guidance still gets wrong

If you are checking your vendors' compliance content this month, three errors keep showing up, and each one is now a live liability:

1. "Marketing and sales calls must be kept 10 years." Wrong from October 1. It is 6.
2. "CMS audits your marketing calls." Marketing is not a scheduled program-audit area. Recordings are requested off complaints, which is harder to prepare for, not easier.
3. "The disclaimer must be in the first minute." Replaced. It is now before any benefits are discussed.

There is no self-executing per-call fine for a missed disclaimer. The consequence arrives through the carrier relationship, not a penalty notice, which is why the exposure is commercial rather than administrative.

What this means for the floor, in practice

Strip the regulation away and October 1 leaves a Medicare seller with four concrete requirements:

• Record every marketing and sales call in its entirety, and keep it 6 years.
• Be able to show the disclaimer was spoken before any benefit was mentioned, on the specific call being questioned.
• Be able to locate the enrollment boundary inside a single recording, because the portion after it carries a longer obligation.
• If you use transcripts for years 4 through 6, be able to show they are complete and accurate.

That last requirement is the one almost nobody has thought through. CMS permits a transcript instead of audio in years 4, 5 and 6, but only a "complete and accurate" one. A transcript is a text file. Anyone can edit a text file. If a transcript is the only thing standing between you and a complaint from four years ago, the obvious question is how you prove it is the same transcript you produced back then, and that it faithfully represents the call.

Asserting it is not proving it.

Where a signed record fits

That is the specific gap Klariqo closes. Klariqo runs on the dialer you already have, including VICIdial, and turns each call into a Klariqo Call Record (KCR): quality review applied to 100 percent of calls rather than a sample, with a full transcript, sealed into a signed, tamper-evident record. Every record is witnessed on JLINC and carries an independent RFC 3161 trusted timestamp (DigiCert), the standard behind legal e-signatures.

Mapped against the four requirements above:

• Disclaimer ordering. Scoring 100 percent of calls against your own rulebook answers "was the disclaimer spoken before any benefit" on every call, not on the two per hundred a QA analyst has time to open.
• The enrollment boundary. CMS defines it as a spoken sentence, so finding it means reading the words. A KCR produces a transcript of every call, so the boundary is locatable rather than guessed at.
• Complete and accurate transcripts. The transcript ships inside a signed record with an independent timestamp. Change one byte and the signature breaks. That turns "our transcript is accurate" from a claim into something a third party can check.
• Handing it over. Anyone can verify a KCR at verify.klariqo.com with no account and no login, or run the open-source verifier themselves. A carrier, an auditor, or opposing counsel does not have to trust you, and does not have to trust us.

A KCR does not make a call compliant, and it will not tell you whether a given call was lawful. What it removes is the guessing. When a complaint surfaces about a call from three years ago, you either have a provable record of what was said or you have a story about it.

Compliance scoring runs at $0.02 per minute, about ten cents on a five-minute call, and new accounts start with $5 in free credits. If you want to see the record before you talk to anyone, upload one of your own calls at klariqo.com/try and get a signed KCR back in about a minute. No account, no sales call.

FAQ

What changes for Medicare TPMOs on October 1, 2026? Two things. Marketing and sales call recordings must be retained 6 years instead of 10, with audio required for the first 3 years. And the TPMO disclaimer must be spoken prior to the discussion of any benefits, rather than within the first minute of the call.

How long must Medicare marketing and sales calls be retained in 2026? Six years, under 42 CFR § 422.2274(g)(2)(ii) as amended by the CY2027 final rule. The first three years must be kept in audio format. Years four, five and six may be audio or complete and accurate transcript recordings. The prior requirement was ten years.

Does the enrollment portion of a Medicare call have a different retention period? Yes. Enrollment and disenrollment records must be retained for the current contract period plus ten prior periods under 42 CFR § 422.504(e)(1)(iv), and CMS states the recording of the enrollment portion serves as the enrollment form. One call can therefore carry two different obligations.

Where does the enrollment portion of a call begin? CMS defines it as beginning "when the beneficiary is advised that they are completing an enrollment request, after which they provide the information as required by the enrollment form and attest to their intention to enroll." The boundary is a spoken sentence inside the recording.

When must the TPMO disclaimer be read on a sales call? Prior to the discussion of any benefits, under 42 CFR § 422.2267(e)(41)(ii). This replaced the earlier requirement to convey it within the first minute of the call, and applies to contract year 2027 marketing beginning October 1, 2026.

Does CMS audit Medicare marketing calls? Not on a schedule. CMS requests specific recordings based on complaints in its Complaint Tracking Module, selected by the severity of the allegation. The Department of Justice has also relied on call recordings for investigations.

Is the October 1, 2026 date the effective date of the rule? No. The CY2027 final rule regulations are effective June 1, 2026 and are already in the Code of Federal Regulations. October 1, 2026 is the applicability date for contract year 2027 marketing and communications, matching the marketing year start under 42 CFR § 422.2263(a).

Sources: CY2027 Medicare Advantage and Part D final rule, 91 FR 17384 (published April 6, 2026) · 42 CFR § 422.2274 · 42 CFR § 422.2267 · 42 CFR § 422.2263 · 42 CFR § 422.504

This article describes federal regulations as published and is not legal advice. Confirm application to your organization with your compliance counsel.