Your Medicare Website's TPMO Disclaimer Changed for 2027

What CMS actually changed

On a two-page document with the unglamorous title "Partner Tip Sheet," CMS confirmed a change that touches almost every Medicare marketing page on the internet. Product No. 12237-P, dated September 2026, lists six changes to the Medicare Advantage and Part D marketing guidelines for Contract Year 2027, and two of them land directly on the disclaimer text required on every TPMO website¹. The tip sheet summarizes the marketing provisions of CMS's broader CY2027 Medicare Advantage and Part D final rule, published in the Federal Register on April 6, 2026⁶.

The first change: CMS removed "State Health Insurance Assistance Programs (SHIPs)" as a listed resource in the disclaimer. CMS's own explanation is that the SHIP reference was "intended to direct people back to 1-800-MEDICARE," so the separate mention became redundant¹. The second change: plans and TPMOs must now give the disclaimer verbally "before benefits are discussed," rather than within the first minute of a call, a timing rule CMS had used for several years¹.

Neither change is dramatic on its own. Removing three words and moving a timing requirement sounds like the kind of update a compliance officer files and forgets. But the disclaimer is not just spoken once on a phone call. Under 42 CFR 422.2267(e)(41), the same standardized text has to be prominently displayed on TPMO websites, electronically conveyed for email and online chat, and included in print and television marketing materials². Every one of those surfaces that currently quotes the SHIP line is now carrying language CMS has moved past.

Source: CMS, "Changes to the Medicare Advantage Organization and Medicare Drug Plan Sponsors Marketing Guidelines," Product No. 12237-P, September 2026¹. Fetched 2026-09-24.

It is worth being precise about what stayed the same, because plenty of the disclaimer survives untouched. The core statement, that a TPMO does not offer every plan available in the area, is unchanged. The requirement to state how many organizations and how many products the TPMO represents is unchanged. The requirement to display the disclaimer on a website at all is unchanged, it was already there under 42 CFR 422.2267², and it will keep being there after this update. What changed is three words removed from the resource list and a timing rule for spoken delivery. Small edits, required everywhere the text appears.

Are you a TPMO? Probably.

A lot of independent agents read the letters TPMO and assume it means someone else, a call center, a lead aggregator, a big national brokerage. The actual definition is broader than that. Under 42 CFR 422.2260, a Third-Party Marketing Organization is "organizations and individuals, including independent agents and brokers, who are compensated to perform lead generation, marketing, sales, and enrollment related functions as a part of the chain of enrollment"⁷. If you write Medicare Advantage or Part D business for more than one carrier and you get paid to do it, that definition almost certainly includes you, your agency, and your downline, not just the FMO above you.

That matters for FMOs and IMOs running multiple downline agencies in particular, since the disclaimer obligation does not stop at the top of the org chart. Every downline agent who markets more than one carrier's plans is independently a TPMO under the same definition, which means a wording gap on the FMO's own materials rarely stays contained to the FMO. If the FMO's marketing library, the templates, scripts, and landing page copy every downline agency inherits, still carries the SHIP reference after October 1, that gap gets copied downstream to every agency that pulled from it, multiplying one mistake across an entire network instead of one office.

The same regulation draws a line that explains why CMS moved the disclaimer's timing to "before benefits are discussed" instead of a fixed clock. It defines "communications" as any activity or material an MA organization or downstream entity uses to inform current or prospective enrollees, and it defines "marketing" as a narrower subset: communications intended to draw attention to a plan, influence a selection decision, or support retention, that also address plan benefits, cost sharing, star ratings, or rewards and incentives⁷. Every marketing interaction is a communication, but not every communication is marketing. A general "thanks for calling, how can I help" is a communication. The moment you start discussing what a specific plan covers or what it costs, you have crossed into marketing, and that is precisely the moment CMS now wants the disclaimer to have already been given.

That distinction matters for a website too, not only for a phone call. A page that names your agency and lists a phone number is a communication. A page that compares plan benefits, states a premium, or walks through star ratings is marketing, and marketing pages are exactly where 42 CFR 422.2267 requires the disclaimer to be prominently displayed². If your site has pages that discuss specific plan benefits or costs and none of them carry the disclaimer, that gap is worth closing before this one.

Two questions follow from that, and both come up often enough to answer directly. First, does the single-carrier-only rule change anything for a captive agent who represents exactly one carrier? The definition in 42 CFR 422.2260 does not set a minimum carrier count, but the disclaimer's own content, stating how many organizations and plans you represent, is written for someone selling more than one, so a captive agent should confirm the applicable requirement with that carrier's own compliance team rather than assume this guide's wording carries over unchanged. Second, does every page need the disclaimer, or only some of them? Only the ones that cross into marketing under the definition above. A general About page or a bare contact form that names no specific plan is a communication, not marketing, though many agencies choose to display the disclaimer site-wide anyway rather than adjudicate that line page by page.

Why the old wording is still on your site

Nobody leaves a stale disclaimer up on purpose. It happens for the same reason the Part D deductible ends up frozen at last year's number on a lot of agency sites: the text got typed in once, and nothing about the page ever asks anyone to check it again.

A TPMO disclaimer is not a one-line footer most agencies write once and forget. It shows up on the homepage footer, on every county or city landing page, at the bottom of every blog post that discusses plan benefits, inside PDF rate sheets, in the fine print of a Facebook ad, in a chatbot's opening message, and read aloud at the top of every outbound call script. A single-office agency with a dozen location pages, a rate flyer, and a call script easily has this exact sentence living in fifteen or twenty separate places, on five or six different platforms.

On a page-builder platform, GoHighLevel, WordPress, Wix, or Squarespace, that text usually lives inside a content editor block on each page individually, not in one file a developer can search and fix in a single pass. Updating it means opening every page, finding the block that holds the sentence, editing it, and republishing, one page at a time. On a static site built from a single shared component, the same fix is one edit in one file, and every page that includes it inherits the correction the next time the site builds. The platform does not change whether the fix is required. It changes how many separate places you have to find and correct it.

Put a number on it. An agency running a homepage, a services page, twelve county landing pages, a rate flyer PDF, and a call script has the disclaimer living in at least fifteen separate places already. Add a chatbot greeting and a couple of saved email templates and it is closer to twenty. A CMS wording change like this one does not touch one sentence. It touches twenty copies of one sentence, spread across a website builder, a PDF, a script binder, and whatever tool runs the chat widget, each requiring its own find, edit, and republish.

What a stale disclaimer actually risks

Start with what CMS itself does not say. The Partner Tip Sheet does not publish a fine schedule for a disclaimer that still mentions SHIP after October 1¹, and a stale required disclosure is a smaller problem than a missing one entirely. This is not the kind of item that shuts down a business overnight. It is worth saying that plainly rather than manufacturing urgency that is not there.

What it does risk is smaller and more specific: an accuracy problem on a page CMS expects to be accurate. CMS's marketing guidance is built around beneficiaries getting correct, current information, and a required disclosure that points to a resource CMS itself just removed is exactly the kind of drift that shows up in a routine marketing materials review. It is not a dramatic risk. It is a real one, on a document CMS revisits at least once a year and sometimes more.

There is a second, quieter cost that has nothing to do with CMS. This disclaimer exists to build trust with a beneficiary who is choosing between agents. A prospect who reads a disclosure referencing a state program that no longer belongs in the text is unlikely to notice or care. But the underlying pattern, a website carrying compliance language nobody has touched since the day it launched, tends to show up in more places than just this one sentence. If the disclaimer is stale, the deductible figure on the same site is worth checking too.

It is also worth seeing this change in its actual context rather than in isolation. CMS's same Partner Tip Sheet describes five other changes for CY2027: removing the separate Notice of Availability requirement, relaxing the timing and manner of outreach around educational and marketing events, relaxing the documentation required behind advertising superlatives, rescinding the mid-year supplemental benefits notice, and cutting call recording retention from 10 years to 6¹. Read together, the pattern is a broader loosening of Medicare marketing paperwork, not a crackdown. The disclaimer change fits that pattern, a smaller, cleaner requirement rather than a stricter one. That context does not make the fix optional. It does mean the honest framing is "keep this current," not "brace for an audit."

Scale matters here even if the individual risk is modest. Medicare Advantage enrollment is projected at 34 million people for 2026, roughly 48 percent of everyone on Medicare, according to CMS's own September 2025 projection⁴. That is 34 million people a TPMO disclaimer is designed to protect, arriving at agency websites in the highest-traffic weeks of the year, right as Medicare's Annual Enrollment Period runs October 15 through December 7³. A compliance detail that sits quietly wrong for most of the year becomes visible to the most people during exactly the window that matters most for a Medicare agency's business.

How to check every place it lives

This takes longer than the five-minute check for a stale cost figure, because the disclaimer legitimately appears in more places. Budget half an hour and work through every channel 42 CFR 422.2267 actually names².

A plain text search will not catch everything on its own. Agencies write this sentence in more than one way: some spell out "State Health Insurance Assistance Program," some abbreviate to "SHIP," some use the older phrasing "your local State Health Insurance Program." Run the search for all three, and check any page where the disclaimer was rewritten in someone's own words rather than pasted verbatim, since a paraphrase can carry the same outdated reference without using any of your search terms at all. If your site was built or last touched by an outside developer or agency, ask them directly whether the disclaimer text was hand-typed per page or pulled from one shared source, because that answer determines how long this check should take you.

Treat this the same way you would treat a Part D cost figure that stopped updating: the honest short-term fix is manual, page by page, with the date you made the change noted somewhere you will remember. That works, once. The harder question is what happens the next time CMS touches this disclaimer, which it has now done more than once in recent years, and whether next year's version of this same half-hour audit finds the same scattered problem again.

The fix that survives next year too

The manual fix and the structural fix solve different problems. The manual fix gets today's wording correct today. The structural fix makes sure the next wording change, whenever CMS makes one, only has to be made once.

The mechanism is the same one that fixes a stale cost figure: stop typing the disclaimer into each page separately, and instead hold it in exactly one place the rest of the site references. On a site built with a component-based framework, that is literally a single component, a shared include, rendered wherever the disclaimer needs to appear. Change the text once, rebuild, and every page that includes the component picks up the correction automatically. No page has its own private copy to forget.

The same principle extends past the website itself. A call script that pulls its disclaimer language from the same source document as the website, rather than a separately maintained script nobody cross-checks against the site, closes the gap between what your agents say and what your pages show. It will not stop CMS from changing the wording again. It stops that change from turning into a scavenger hunt across a dozen platforms every time it happens.

In practice this comes in three tiers, and which one an agency needs depends on how much the disclaimer actually varies from page to page. The simplest tier is a single static include, the exact current wording in one file, rendered identically everywhere it is required. It costs almost nothing to build and covers an agency whose organization and plan counts do not change page to page. The middle tier is a templated version, the same wording with the organization count and product count filled in as variables, useful for a multi-market agency where those numbers genuinely differ by service area and need to stay accurate per page rather than copy-pasted from whichever market someone edited last. The top tier adds a build-time check, a script that fails the deploy if a page's disclaimer text does not match the canonical wording byte for byte, which catches the one page someone edited by hand before anyone else finds it.

Most agency sites do not need the third tier to close this gap. They need the first one, done once, done correctly, and referenced everywhere instead of retyped anywhere.

How we build this into every site

Every site we build on Digital Foundation ships on Astro, which renders finished HTML at build time rather than assembling the page in the browser. That is the speed story. The compliance story runs on the same discipline: required text like a TPMO disclaimer lives in one component, not copy-pasted across every page that needs it.

When a wording change like this one lands, we update the one component and rebuild, and the fix reaches every page, every location page, every blog post, on the same deploy. That is the identical mechanism behind the sitemap and llms.txt files every Digital Foundation site ships with, which regenerate themselves with the full absolute URL the moment a new page publishes, instead of depending on someone remembering to update a file by hand.

This is not a promise we are making in the abstract. Our own pre-publish checklist, the one we run against every site before it ships and again on a recurring schedule after, checks for the TPMO disclaimer by name, confirms the wording matches the current CY2027 text, and flags a page discussing specific plan benefits or costs that is missing it entirely. A checklist item is only worth something if it checks the exact wording, not just whether some disclaimer-shaped text exists on the page, and that distinction is the whole reason this guide exists.

What you get

A disclaimer that carries CMS's current wording everywhere it is required to appear, updated once instead of hunted down page by page. One fewer compliance detail competing for attention during the seven weeks a year your site gets the most traffic. And a structure that treats the next wording change, whenever CMS makes one, as a single edit instead of a fresh audit across every page, PDF, and script you own.

None of that changes what you are allowed to say or who you are allowed to sell. It changes how long it takes to say the right, current thing everywhere you are required to say it, and how confident you can be that you actually have. For an agency that measures its year by AEP, that confidence is worth more in October than in any other month, because that is when the highest volume of prospects, and the highest scrutiny, both arrive at once.

On our live pricing page, Digital Foundation's Starter tier is $247 a month and includes a complete, compliant website with required disclaimers built as shared components from the start⁵. Pro, at $497 a month, adds a weekly blog post and location page plus a 24/7 AI receptionist. Scale, at $997 a month, moves that publishing cadence to daily. All three tiers include a free, limited setup and a 14-day trial before billing starts⁵. A build with a more specific compliance workflow, multiple downline sites, or a call-script integration is the kind of project we scope on a call through AI Expert rather than price off a menu.

What to do before October 1

The deadline here is closer than most compliance updates get. CMS's changes apply to CY2027 marketing materials starting October 1, 2026¹, and Medicare's Annual Enrollment Period opens two weeks after that, on October 15³. Here is the order that actually gets a site and its supporting materials current before that window opens.

None of these five steps require a full site rebuild by themselves, and none of them require waiting on anyone's calendar but your own. The honest constraint is not the work itself, it is finding the time on a calendar that is about to fill up with AEP prep, carrier certifications, and the first wave of client calls. Doing this now, while the fix is still a quiet half day rather than a scramble the week enrollment opens, is the entire difference between a compliance update and a compliance incident.

Questions agents ask