CMS Call Recording Requirements: Scope, Retention, and Penalties

CMS call recording requirements obligate every Third-Party Marketing Organization (TPMO) to record all Medicare Advantage and Part D marketing, sales, and enrollment calls in their entirety, including the audio portion of video meetings, and to retain those recordings for at least 10 years. The rule sits at 42 CFR § 422.2274 for Medicare Advantage and 42 CFR § 423.2274 for Part D, and it covers the call from greeting to goodbye, not just the enrollment segment.¹

Who the Rule Applies To

A TPMO is any organization or individual compensated to perform lead generation, marketing, sales, or enrollment on behalf of a Medicare Advantage organization or Part D sponsor. A solo agent working from home is a TPMO. So is a national call center, and so is a lead-generation firm. If you get paid to help someone choose or enroll in a Medicare plan, the recording rule reaches you.¹

The carrier does not get to hand the problem off. Medicare Advantage organizations and Part D sponsors must build the recording obligation into their TPMO contracts, and CMS holds the sponsor accountable when a downstream agent’s recordings are missing or incomplete. Pointing at an independent broker does not shield the plan.²

Which Calls You Have To Record

The regulation says record “all marketing, sales, and enrollment calls, including the audio portion of calls via web-based technology, in their entirety.”¹ In their entirety means every second. Capturing only the sign-up portion does not satisfy the rule. Inbound calls from a beneficiary and outbound calls from you are both covered.

Purely administrative calls generally fall outside the mandate. A beneficiary calling to check claim status, update an address, or confirm a provider is in-network does not need to be recorded. The complication is drift. If an administrative call turns into a discussion about switching plans or comparing benefits, the recording requirement kicks in the moment the conversation shifts, and CMS expects the entire recording of that call to be retained.³ The safer habit is to record any call where a sales topic could reasonably come up.

Video Calls and the In-Person Exemption

Sales presentations on Zoom, FaceTime, Microsoft Teams, or any similar platform are covered. You have to capture the full audio. The video track itself is not required, but the audio is non-negotiable.¹

Face-to-face meetings are the one clear carve-out. CMS does not require recording of in-person interactions.³ That distinction turns out to matter more than it first looks.

When a Beneficiary Refuses To Be Recorded

There is no consent-based exception. If a beneficiary objects to being recorded, you cannot switch the recorder off and keep selling. An unrecorded sales call is inherently out of compliance, so the only proper move is to end the phone conversation.¹

The workable alternative is an in-person appointment. Because face-to-face meetings are exempt, you can still walk a beneficiary through their options at a kitchen table or in an office. Offering that route is often the difference between losing the client and keeping the relationship.

How Long Recordings Must Be Kept

CMS requires retention of all sales and enrollment call recordings for a minimum of 10 years, measured from the date of the recording. The window aligns with the statute of limitations for federal healthcare fraud investigations, which is why an audit or complaint can surface years after the conversation itself.³

Not every recorded call needs the full decade. A recording that never touches sales or enrollment topics is not subject to the 10-year rule. But if any portion of the call drifts into sales territory, the whole file falls under retention. Because the TPMO carries the burden of producing the audio when asked, keeping recordings longer than you think you need is the safer default.³

Retention does not end when an agent changes carriers or closes shop. Whoever held the recording at the time of the call remains responsible for preserving it. If your recordings sit on a carrier-provided platform, get it in writing who keeps custody of those files if your contract with that carrier ends.

Storage, Security, and Retrieval

Medicare call recordings contain protected health information, so storage has to meet HIPAA standards. Practically, that means encryption in transit and at rest, access limited to authorized personnel, and audit logs that show who opened which file and when. HIPAA does not name a specific encryption algorithm; AES-256 or equivalent is the common expectation for data at rest.

Retrievability matters as much as storage. When CMS or a plan sponsor asks for a specific call, you have to find and produce it promptly. A folder full of undifferentiated audio files does not meet the practical standard even if every recording is technically there. Compliant setups tag recordings by date, agent, beneficiary, and call type, and use standard audio formats like MP3 or WAV so government reviewers can open them without friction.

Related Obligations That Travel With the Recording

Recording is one piece of a larger compliance stack. A few adjacent rules trip agents up because they assume the recording alone covers them.

The First-Minute Disclaimer

Any TPMO that sells for more than one Medicare Advantage organization must deliver a standardized verbal disclaimer within the first minute of a sales call, telling the beneficiary how many organizations and products the agent represents and pointing them to Medicare.gov, 1-800-MEDICARE, and their State Health Insurance Program. A slightly different version applies when the agent does represent every plan in the area. The wording is fixed; paraphrasing or burying it two minutes in puts the call out of compliance from the start. The same disclaimer has to appear on TPMO websites, in print and television marketing, and in electronic communications like email and chat.⁴

One-to-One Consent for Lead Sharing

Since October 1, 2024, a TPMO that collects personal beneficiary data for marketing or enrollment purposes can only pass that data to another TPMO with prior express written consent. The consent has to name each entity that will receive the data, and the beneficiary must be able to accept or reject each one separately. The rule is aimed at the old practice of selling a single online form to a dozen agencies.²

Scope of Appointment

Call recording does not replace the Scope of Appointment. Before a sales meeting, agents still have to collect a signed form documenting which product types the beneficiary agreed to discuss. The recording captures what was said; the Scope of Appointment establishes what the agent was authorized to discuss in the first place. Missing either one creates its own compliance problem.

What Happens If You Don’t Comply

CMS has a range of enforcement tools at the carrier level, from warning letters and corrective action plans to civil monetary penalties and suspension of enrollment and marketing activities. Because the plan sponsor is on the hook for TPMO conduct, one agent’s recording failure can pull the whole organization into an enforcement action.¹

For individual agents and brokers, the usual consequence is contract termination. An audit that finds missing or incomplete recordings can cost you the appointment with that carrier, and carriers report TPMO disciplinary actions and compliance violations monthly, so a recording failure at one company can follow you across the industry.²

1
eCFR. 42 CFR 422.2274 – Agent, Broker, and Other Third-Party Requirements
2
eCFR. 42 CFR 423.2274 – Agent, Broker, and Other Third-Party Requirements
3
Centers for Medicare & Medicaid Services. Contract Year 2023 Medicare Advantage Marketing Policies – Frequently Asked Questions
4
GovInfo. 42 CFR 422.2267 – Required Materials and Content