Medicare Advantage outreach rules: CMS and TCPA basics

What to take away

The CMS Medicare Communications and Marketing Guidelines in plain terms

CMS splits everything a plan says to a member into two buckets: communications and marketing. Communications cover plan operations, like a formulary change or a provider termination notice. Marketing covers anything meant to draw a beneficiary toward a plan or a supplemental product. The bucket decides the review path, the filing requirement, and the disclaimers.

The CMS Managed Care Marketing page is the anchor for these rules and links to the current guidance. It applies to Medicare Advantage, Medicare Advantage Prescription Drug plans, stand-alone Part D, and Medicaid managed care. If your outreach touches any of those products, the guidelines apply.

Certain words are restricted in marketing material. CMS prohibits the use of "free," "no cost," and similar phrasing unless the benefit is truly without condition. It also bars claims that a plan is endorsed by Medicare or by the federal government. Those restrictions apply to texts, scripts, direct mail, and social posts.

Marketing material also has to carry required disclaimers, including the plan name and a statement that the plan contracts with Medicare. The disclaimer cannot be buried in a link or a landing page.

For a text message, that means the message itself has to carry the required elements or the recipient has to be able to reach them without a login.

CMS updates the guidelines through transmittals and sub-regulatory guidance, not only through formal rulemaking. The CMS Transmittals library is where operational changes appear first. A plan that only reads the annual rule can miss a mid-year change to call scripts or disclaimers.

For anyone running senior outreach across several product lines, a single healthcare marketing compliance guide that maps CMS, TCPA, and HIPAA together saves repeated legal review. The rules overlap, and a message that passes one test can fail another.

Communications versus marketing: a quick table

Filing marketing materials before sending

Materials filing before send is the rule most often missed by lean marketing teams. CMS requires plans to submit marketing materials to the appropriate CMS regional office or through the Health Plan Management System before the material is used. The review window is not a formality; distribution before filing is a compliance finding.

The filing package includes the material itself, the intended audience, the distribution channel, and the dates it will run. Text messages count. So do scripts used by agents and call centers, because a script is a marketing material when it pitches a plan.

CMS reviews filed material for required elements, prohibited terms, and accuracy. If a plan changes a message after filing, the change may need a new filing. A minor edit to a text message can turn a cleared material into an unfiled one.

Federal Register notices are where larger changes to marketing rules surface before they bind. The Federal Register documents on Medicare and Medicaid programs collect CMS payment and program notices, and plan compliance teams watch them for marketing rule changes that affect filing timelines.

A practical marketing compliance filing checklist helps here. It forces the filing date, the material ID, and the reviewer name into one record, which is exactly what CMS asks for during an audit.

TCPA consent: prior express written consent and its limits

TCPA prior express written consent is a higher bar than most plans assume. It applies to autodialed calls, prerecorded calls, and text messages sent with an autodialer to cell phones. A signature, electronic or written, plus clear disclosure of the sender and the opt-out, is the core of it.

The consent has to identify the entity that will call or text. A generic "our marketing partners" clause is not enough. It also has to state that the consumer is not required to consent as a condition of any purchase, and that consent can be revoked at any time.

The FCC's Stop Unwanted Robocalls and Texts page lays out the federal baseline. The FCC treats a text message as a call for TCPA purposes, so the same consent standard applies to SMS and MMS.

Consent obtained for one plan does not automatically cover another. A beneficiary who agreed to hear from a Medicare Advantage plan has not agreed to hear from a dental supplemental product or a third-party agency. Each sender needs its own consent, or the consent language has to name all of them.

Business-to-business exemptions do not rescue member outreach. Beneficiaries are consumers, and the calls and texts go to personal cell phones. There is no B2B carve-out for a text to a member's mobile number.

Consent also has a shelf life in practice. The TCPA does not set a fixed expiration, but the FTC and courts look at whether the consent is still reasonable given the time passed and the relationship. A consent collected three years ago for a different plan year invites a challenge.

The consent and opt-out rules for patient texting overlap with these TCPA standards, and the two should be documented in one place. A single consent record that satisfies both is easier to defend than two partial ones.

Call recording rules and two-party consent states

Call recording requirements are a state law problem layered on top of federal rules. Federal law allows one-party consent, meaning the person recording can consent for everyone. Several states require all parties to consent, and those states include California, Illinois, Massachusetts, and Washington.

That list matters for plans with national dialing. A call center in Texas recording a member in California has to meet California's two-party standard, not Texas's one-party rule. The strictest state on the line usually controls.

The same logic applies to a plan that records every call by default. A default recording practice that is lawful in Florida can be unlawful in Illinois. Connecticut, Pennsylvania, and Nevada have also been treated as all-party states in various contexts, so the map is not stable.

For teams comparing tools, call tracking systems vary widely in whether they capture the disclosure and the response in the same record. A system that records audio but not consent gives you half a defense.

State privacy laws add a second layer. California's CMIA and Washington's My Health My Data Act reach health information that HIPAA may not cover, and both have consent and notice requirements that touch recorded calls about benefits or conditions.

Quiet hours, opt-outs, and revocation handling

Quiet hours under the TCPA restrict calls to between 8 a.m. and 9 p.m. in the recipient's time zone. Texts are treated like calls, so a text at 6 a.m. Pacific to a member in California violates the window even if the sender is on Eastern time.

Plans get this wrong when they batch sends by campaign rather than by time zone. A single national send at 9 a.m. Eastern reaches California members at 6 a.m. The fix is to schedule by recipient time zone, not by headquarters time.

Opt-out rules require a clear and conspicuous way to stop messages. For texts, "reply STOP" is the standard, and the plan must honor it promptly. CMS also requires that marketing material tell beneficiaries how to opt out of future marketing.

Revocation handling is broader than the word STOP. A member who says "stop texting me" in a reply, or tells an agent on a call, has revoked consent. The revocation has to flow to every system that can send a message, including vendor platforms.

An opt-out that lives only in the texting platform is a finding waiting to happen. If the call center does not see it, the next campaign will call a member who already said stop.

Where CMS rules are stricter than the TCPA floor

The TCPA sets a floor. CMS rules often sit above it. Consent that satisfies the TCPA may still fail CMS requirements for marketing to Medicare beneficiaries.

CMS restricts unsolicited contact with beneficiaries more tightly than the TCPA does. It limits when plans may call, what agents may say, and how they may use the Medicare name. A call that is legal under the TCPA can still be a CMS marketing violation.

CMS also requires that marketing materials be filed, which the TCPA does not. And CMS requires specific disclaimers that have no TCPA equivalent. A text can have perfect consent and still fail CMS.

Enrollment-related outreach faces additional timing rules. CMS limits contact around the Annual Enrollment Period and the Open Enrollment Period, and it restricts the use of certain events and prizes. These are marketing rules, not consent rules, and they apply regardless of what the member agreed to.

The two regimes also differ on who is liable. Under the TCPA, the sender and the party on whose behalf the message is sent can both be liable. Under CMS, the plan is responsible for the conduct of its agents and downstream vendors.

For teams that track recurring issues, the patient texting consent and opt-out questions that surface most often are about this gap. People assume TCPA consent covers CMS, and it does not.

Vendor and BAA obligations for plan outreach

BAA obligations for plan vendors follow from HIPAA. Any vendor that creates, receives, maintains, or transmits protected health information on behalf of a plan or practice needs a Business Associate Agreement. That includes texting platforms, call centers, analytics tools, and CRM providers.

A BAA is not a substitute for TCPA consent. It governs the handling of health information, not the permission to contact. A vendor with a signed BAA can still send a text the plan had no consent to send.

Vendors that send on the plan's behalf also inherit CMS filing obligations in practice. If a vendor writes the script or the text copy, that copy is marketing material and has to be filed before use. The plan cannot outsource the filing duty.

Subcontractors matter. A texting vendor that routes messages through a third-party aggregator has created another party that touches the data. The plan's BAA chain has to reach that party, or the plan carries the risk.

The FTC also watches health product claims, and its Health Products Compliance Guidance applies to any plan or practice marketing a health-related product. A claim about a benefit or a health outcome has to be supported, whether it appears in a text, a call script, or a landing page.

Audit trails plans should keep for CMS review

An audit trail is the difference between a plan that can prove compliance and one that can only assert it. CMS reviews look for dated records, not recollections.

Keep the filed material and the CMS submission record together. The record should show what was filed, when, and what version was approved. If the copy changed, keep both versions and the refiling.

Keep consent records with the exact language the member agreed to. A screenshot of the consent form, the timestamp, the IP address, and the source page are the standard package. For paper consent, keep the signed form.

Keep call recordings and the disclosure log. The recording shows what was said; the log shows that the recording was permitted. In a two-party consent state, the log is the defense.

Keep opt-out records with timestamps and the channel used. If a member opted out by replying STOP, the platform log should show the reply and the suppression action.

Keep vendor BAAs and the vendor's consent and opt-out reports. If CMS asks how a vendor handled member data, the plan needs the vendor's records, not just its own.

Retention periods vary by record type and by state. A general rule is to keep marketing, consent, and opt-out records for at least the period CMS can review, plus the state statute of limitations for TCPA claims. When in doubt, keep longer.

Common questions