The short version: a TPMO — third-party marketing organization — is anyone who markets or enrolls Medicare beneficiaries on behalf of a plan. CMS holds TPMOs (and the agents under them) to strict documentation rules: Scope of Appointment before every appointment, full call recording, permission-to-contact, and TPMO disclaimers. Miss one and a sale becomes a finding.
What a TPMO is
TPMO includes agents, agencies, lead generators, and marketing organizations that sell or market Medicare Advantage and Part D plans. If you're compensated for marketing or enrollment, you are a TPMO under CMS rules (42 CFR §422.2260).
The core TPMO rules
- Scope of Appointment (SOA). Documented before every marketing appointment. The 48-hour wait was eliminated in the CY2027 Final Rule — but the SOA itself is still mandatory.
- Call recording. Record every sales and enrollment call in full. If the beneficiary declines, end the call.
- Permission-to-contact (PTC). Obtain consent before outbound contact, and keep the evidence.
- TPMO disclaimer. Include the required disclaimer on TPMO-developed materials.
- 10-year retention. Enrollment records (including audio) must be retained for 10 years.
Where agents fall short
The rules are not the hard part — the evidence is. Most agents have the SOA somewhere, the recording somewhere else, and the disclosure nowhere. Under a market-conduct exam, that scattered documentation is the same as no documentation.
How Aegis helps
Aegis gives every client file a live CMS-Compliance-Defense Score and links the SOA, recording, disclosure, and certification to that file — so the audit trail is built at the moment of sale, not reconstructed under pressure.