What CMS's New Call Recording Rule Requires Before AEP

What changed on October 1

Right now you're probably deep in carrier certifications, getting your marketing materials approved, and lining up whatever's left before phones start ringing for AEP. Somewhere in that stack of things to check off is a question almost nobody is asking: did the rules for how you record and store your own sales calls change this year? They did. On April 6, 2026, CMS published a final rule in the Federal Register that rewrites the record retention requirement for Medicare Advantage and Part D marketing and sales call recordings, and it takes effect October 1, 2026, which is two weeks before this year's Annual Enrollment Period opens¹².

Two things changed. First, the retention window for a marketing or sales call recording drops from 10 years to 6, with a specific split: the first 3 years have to be kept as audio, and the last 3 can be audio or a written transcript¹. Second, the standardized disclaimer every Third-Party Marketing Organization has to read on a sales call no longer has to happen within the first minute. It now has to happen before you discuss any plan benefits, whenever that is in the call, and the required language no longer has to mention State Health Insurance Assistance Programs¹.

Neither change is a rumor from a compliance newsletter. Both are quoted directly, with section numbers, from the rule's own text: 42 CFR 422.2274(g)(2) and 423.2274(g)(2) for the retention change, and 422.2267(e)(41) and 423.2267(e)(41) for the disclaimer change¹. The rule's own citation is CMS-4208-F3 and CMS-4212-F, published at 91 FR 17384 through 17602¹.

Why CMS requires recorded calls at all

This didn't start in 2026. CMS first required a Third-Party Marketing Organization, a TPMO, to verbally convey a standardized disclaimer during Medicare sales calls in a final rule that appeared in the Federal Register on May 9, 2022¹. A TPMO, in CMS's own framing, is any organization or individual compensated to perform marketing, sales, or enrollment functions on behalf of an MA organization or Part D sponsor, a definition broad enough to cover independent agents and brokers, not just call centers and national marketing firms.

CMS's stated reason for requiring the disclaimer, and for requiring calls to be recorded at all, was straightforward: after listening to TPMO-based sales calls, CMS heard firsthand beneficiary confusion about what a given TPMO actually represented, and found cases where the information conveyed could lead a beneficiary into a plan that wasn't contrary to their intention or their actual health care needs¹. The recording requirement exists so that what actually got said on a call is a matter of record, not a matter of who remembers it differently after the fact.

A second final rule, in April 2023, tightened things further. It revised the disclaimer to require TPMOs representing more than one but not all MA organizations to state how many organizations and plans they represented, added a separate disclaimer for TPMOs that represented every organization in a service area, added SHIPs as a required source of information in both versions, and set the "within the first minute" timing¹. That's the rule most agents were trained on. The 2026 final rule is the third revision in this same lineage, not a first-time rule showing up out of nowhere.

"In CMS's review of hundreds of sales, marketing, and enrollment audio calls, CMS found that only one plan option from one MA organization was discussed in over 80 percent of the calls reviewed."¹

That finding, straight from CMS's own monitoring, is the actual reason the disclaimer exists in the first place: even when a TPMO had researched other plans, that information rarely made it to the beneficiary on the call. The recording requirement is how CMS checks whether that's still happening, and it's the same underlying mechanism whether you're a two-person agency or a national call center.

What actually has to be recorded

The scope hasn't changed in 2026: marketing, sales, and enrollment calls with a beneficiary have to be recorded in their entirety¹. That's a specific category, not every phone call your agency makes. A pure appointment-setting call that never touches plan benefits, a service call about a claim on an already enrolled member, or an educational event with no one-on-one plan discussion generally fall outside that scope under CMS's existing marketing and communications framework.

Where agents get this wrong isn't usually the clear cases. It's the call that starts as a callback to schedule a follow-up and drifts into "well, since I've got you, let me walk you through what this plan actually covers." The moment a call touches plan benefits with a beneficiary, it's a marketing or sales call for recording purposes, regardless of what it was scheduled as on your calendar. If your recording setup only triggers on calls you've manually flagged as sales calls ahead of time, that's a gap, not a compliant system.

The new six-year retention window

Here's the mechanism in exact terms, quoted from the rule. CMS "is reducing the overall retention time from 10 to 6 years. Years 1 through 3 must be audio recordings, and years 4 through 6 can be either audio recordings or transcripts"¹. A transcript only satisfies the requirement if it's complete and accurate, meaning it documents the full recording and reflects everything both parties actually said, not a summary or a cleaned-up version¹.

Work an actual date through it. A sales call you record on October 5, 2026 has to stay in full audio form through October 5, 2029. From October 6, 2029 through October 5, 2032, you can either keep the audio or replace it with a complete transcript. After October 5, 2032, six years out, you're no longer required to retain it under this provision at all.

One distinction matters here and it's easy to miss: this only changes the retention period for the marketing and sales portion of a call. CMS explicitly kept the separate 10-year retention requirement for enrollment records, meaning the actual enrollment documentation and forms, unchanged, citing 422.504(e)(1)(iv) and 423.505(e)¹. If a call includes both a sales conversation and the actual enrollment, the enrollment paperwork side of that record still sits on the old 10-year clock even though the recording of the sales conversation itself moved to 6.

CMS didn't land on 6 years by default. Commenters on the proposed rule pushed for a shorter window, somewhere between 2 and 5 years, citing storage costs and administrative burden on independent agents. CMS agreed a shorter window would cut cost and burden, but held the line at 6, stating plainly that a 2 to 5 year window "is too limited to adequately address" CMS's and the Department of Justice's oversight, investigative, and litigation needs, while 6 years still "fulfills the Agency's and DOJ's oversight, investigative, and litigation requirements"¹. That's worth knowing if you're tempted to treat 6 years as a soft target rather than a floor.

The disclaimer timing change

The second change is about when, not how long. Since the April 2023 rule, the TPMO disclaimer had to be conveyed within the first minute of a sales call, on a fixed clock regardless of how the conversation actually opened. CMS heard from the industry that a strict 60-second timer created its own problems: calls often start with basic demographic questions to confirm the beneficiary even has a valid election period, and a TPMO representing many plans found the full disclaimer too long to fit inside a minute without talking over the beneficiary¹.

The finalized fix replaces the clock with a checkpoint: the disclaimer now has to be read "prior to the discussion of any benefits" during the call, whenever that actually happens¹. If a call ends before benefits ever come up, because the beneficiary doesn't have a valid election period, the disclaimer becomes unnecessary. The second change in the same provision drops the requirement to name State Health Insurance Assistance Programs as a source of information inside the required disclaimer language¹.

Practically, this gives a live conversation more room to breathe before you're legally required to interrupt it with disclaimer language. It also means a script built around "read the disclaimer at 0:60" is now out of date, and needs to be rebuilt around a content trigger instead of a time trigger, which is a harder thing to enforce consistently across a team of agents without something automated checking for it.

What CMS heard when it listened to the calls

It's worth sitting with why CMS kept the audio requirement for the first 3 years instead of allowing transcripts the whole way through, since a few commenters pushed for exactly that, citing storage savings and the fact that transcripts are easier for AI systems to review¹. CMS agreed transcripts are cheaper and lighter to store, but held that recordings carry something a transcript strips out: tone. CMS's stated reasoning is that a recording shows "the tone of both the beneficiary and the agent, including if the beneficiary is pressured into enrolling in a plan," and that most complaints about a sales call get raised within the first few years after enrollment¹. Audio stays mandatory exactly through the window where a complaint is most likely to land, then the requirement loosens once that window has mostly closed.

That's a useful thing to internalize if you're the one deciding what tooling to buy. This isn't a rule written to reduce documentation. It's a rule written to keep the documentation that actually catches a pressured or misleading sale, for as long as a complaint is realistically going to surface, while cutting the cost of holding onto material that, by CMS's own admission, stops earning its keep after that.

What compliant recording actually costs

CMS didn't just change the rule, it published its own math for what compliance costs an agent, as part of the regulatory impact analysis inside the same rule. CMS estimates approximately 100,000 licensed and appointed agents sell Medicare Advantage and Part D products nationwide¹. For those agents, CMS used an average cost of $35 a month, or $420 a year, for a call recording tool, based on the median of the published pricing it was able to identify across the market¹.

CMS broke that $35 down further: roughly 60 percent, about $21 a month, covers the recording function itself, and the remaining 40 percent, $14 a month, covers storage¹. Cutting the retention window by 4 of the original 10 years, a 40 percent reduction, gets you a proportional 40 percent cut to that storage share: $5.60 a month, or $67.20 a year, per agent¹. Multiply that across CMS's own estimate of 100,000 licensed agents and brokers, and CMS projects roughly $6.72 million a year in industry-wide savings, or $67.2 million over a 10-year horizon¹.

Two things worth flagging about that number before you take it as gospel for your own agency. First, it's CMS's estimate of a median tool cost across the market it surveyed, not a rate any specific vendor is required to charge, and free or bundled recording options exist below it. Second, and more relevant to what most independent agents actually get wrong: $420 a year assumes you already have a compliant tool running. Plenty of agents are recording calls on a phone's built-in voicemail feature, a personal Zoom account, or not at all, and none of those are the same thing as a system built to hold years of audio, tag it to the right beneficiary, and produce it on request.

The real risk of getting this wrong

None of this is abstract housekeeping. CMS retains its existing authority to access MA organization, Part D sponsor, and TPMO records, including the marketing and sales call recordings this rule governs, under 422.504(d) and 423.505(d)¹. The retention requirement only matters because CMS and the Department of Justice can ask for a specific recording, and a gap in your archive at that point isn't a paperwork issue, it's the thing an audit is built to find.

There's a compliance layer sitting underneath the CMS retention rule that's easy to overlook: almost every Medicare sales call touches something health-adjacent, a condition, a prescription, a plan question tied to a diagnosis. That makes the recording itself something closer to protected health information the moment it's captured, which means where it's stored and who can access it is a HIPAA question, not just a CMS retention question. A tool that satisfies CMS's 6-year retention rule on paper but stores the recording on a vendor's general-purpose infrastructure with no Business Associate Agreement behind it has solved one compliance problem while leaving a second one wide open.

How to check your own setup before October 1

You can run this check yourself, without a vendor call, before the new rule takes effect.

How we build this into Ambrose

This section sticks to what's documented on our own live pages, verified this session. Ambrose, our AI platform, integrates directly with the voice tools agencies already run, GoHighLevel, Twilio, VAPI, and Retell among them⁴, which means call recording and retention aren't a separate app bolted on after the fact, they sit inside the same system already handling your calls, texts, and CRM notes.

The HIPAA question and the CMS retention question get solved by the same underlying mechanism. Ambrose's documentation describes a PHI Rail that "aliases identifiers before any non-BAA destination sees them, and re-hydrates real values on the way back"⁴, so protected health information that touches a recorded call doesn't land on infrastructure outside a signed Business Associate Agreement in the first place. On our custom builds, that means call recordings and transcripts store inside infrastructure built for exactly this, with retention and disclaimer logic built around the current rule rather than the one you were trained on two years ago³.

Custom builds like this are scoped and priced on a call rather than sold as a fixed package, covering voice AI, HIPAA compliant automations, and compliance systems built on accounts you own, not ours³. You describe what your agency actually needs recorded, retained, and produced on request, and that's what gets built, rather than a generic tool retrofitted to your workflow.

What you get

Concretely, closing this gap before October 1 gets you three things. A recording and retention setup that matches the actual current rule, 6 years with the correct audio and transcript split, instead of a policy still written around the old 10-year requirement. A disclaimer script your team can follow consistently, built around a content trigger instead of a clock nobody actually watches mid-call. And a storage location you can answer for in a HIPAA review, not just a CMS retention review, because those are two separate questions and only one of them gets solved by picking a retention setting.

None of that is a promise about audit outcomes, enrollment numbers, or commission. It's an infrastructure and documentation question, and it's the kind of thing that's far cheaper to fix in August than to discover mid-AEP when call volume has already tripled and nobody has time to rebuild a script from scratch.

When your current setup is already fine

Say this plainly: if your agency already runs a dedicated call recording tool with a 6-year-or-longer retention setting, a signed BAA covering wherever those recordings live, and a disclaimer script your team has actually been retrained on, you don't need to rebuild anything. The rule didn't add new obligations on top of what you're already doing well, it loosened the retention window and moved a disclaimer trigger. Confirm the five checks above, update the script language, and you're done.

Where this actually matters is the more common case: a solo agent or small team using whatever recording feature came bundled with a phone system or a CRM, never having checked the retention setting, the storage location, or the BAA status, because nobody flagged it as something to check. That's not a judgment, it's just where most compliance gaps like this one actually live, and it's worth 20 minutes to find out which category your agency is in before AEP call volume makes that harder to check.

Questions agencies ask