What Is a TPMO Under CMS Rules?

CMS defines a Third Party Marketing Organization (TPMO) as any organization or individual compensated to perform lead generation, marketing, sales, or enrollment functions as part of the Medicare enrollment chain.

That definition is broad by design. It includes:

• Lead generation companies running ads targeting Medicare beneficiaries
• Agents who purchase those leads and follow up
• Organizations that transfer beneficiary contact information between agents
• Call centers and marketing firms operating in the Medicare space

If you are an independent Medicare agent who buys leads, you are a TPMO. CMS TPMO rules for Medicare agents apply to how you collect, use, and share beneficiary data.

Why CMS Expanded the TPMO Definition

CMS expanded the TPMO definition in recent rulemaking because of documented harm to Medicare beneficiaries from aggressive marketing practices. Beneficiaries were receiving calls from multiple agents they had not contacted, based on their information being resold through lead aggregators without their knowledge.

The rules are designed to protect beneficiaries from being contacted by agents they never agreed to hear from.

The Prior Express Written Consent Requirement

The most impactful CMS TPMO rule for Medicare agents is the Prior Express Written Consent (PEWC) requirement, which took effect October 1, 2024.

Under PEWC, a TPMO cannot share a Medicare beneficiary's personal information with another TPMO for marketing or enrollment purposes without first obtaining the beneficiary's written consent -- naming each entity that will receive the information.

What this means in practice:

A beneficiary fills out a form on a lead generation website. Under the old rules, that lead could be sold to five agents without any additional consent from the beneficiary. Under PEWC, each agent must be specifically named in the consent the beneficiary signs before their information can be shared.

Blanket consent language -- "I agree to be contacted by insurance agents" -- is no longer sufficient. The consent must name each specific organization that will contact the beneficiary.

The One-to-One Consent Rule

CMS requires one-to-one consent for Medicare marketing contact. This means the beneficiary must specifically authorize each individual or organization that will reach out.

This is stricter than the previous standard, which allowed broad consent for categories of contact. Under the current CMS TPMO rules, Medicare agents receiving a transferred lead must have been specifically named in the consent the beneficiary provided.

The Real-Time Transfer Exception

CMS carved out one exception to the PEWC requirement. If a beneficiary can be connected to another TPMO in real time -- during the same call, without hanging up -- the transfer may proceed without additional written consent.

This exception applies to warm call transfers where the beneficiary is actively on the line and the transfer happens immediately. It does not apply to situations where the lead was collected earlier and the agent follows up later.

What the 2026 CMS Rules Added

The CY 2026 Final Rule (published April 15, 2025, effective June 3, 2025) continued CMS's direction of strengthening beneficiary protections.

For 2026 plan year marketing and communications -- which began September 30, 2025 -- CMS added a requirement that all MA organization marketing and communication materials include a Notice of Availability of Language Assistance Services and Auxiliary Aids and Services.

This requirement applies to marketing materials used by TPMOs, including ads, landing pages, and enrollment materials.

How CMS TPMO Rules Affect Medicare Lead Buying

The PEWC requirement changed the economics and risk profile of buying third-party Medicare leads.

Before PEWC, agents could purchase leads from aggregators without asking how consent was obtained. After PEWC, purchasing a lead does not insulate an agent from compliance exposure if the lead was generated without proper one-to-one consent.

Agents who buy Medicare leads should ask their vendors:

1. Was one-to-one written consent obtained from each beneficiary?
2. Is the agent's name or organization specifically listed in the consent document?
3. What documentation is available showing consent was obtained?

Vendors who cannot answer these questions clearly represent compliance risk.

Why Owned Lead Generation Reduces TPMO Compliance Risk

When you run your own Meta campaign, the beneficiary fills out your form, names your organization, and consents to contact from you specifically. You are the only agent in the chain.

There is no lead resale. No shared consent document naming five other agents. No ambiguity about who the beneficiary agreed to hear from.

CMS TPMO rules for Medicare agents become far simpler to comply with when you own the lead source. The consent chain is direct, documented, and unambiguous.

The Required TPMO Disclaimer

Every Medicare agent who markets to beneficiaries must include the CMS-required TPMO disclaimer in their marketing materials. This includes ads, landing pages, and enrollment-adjacent communications.

The required language reads:

*"We do not offer every plan available in your area. Currently we represent [X] organizations which offer [Y] products in your area. Please contact Medicare.gov, 1-800-MEDICARE, or your local State Health Insurance Program (SHIP) to get information on all of your options."*

This disclaimer must appear on all ads that reference specific Medicare plans or benefits. Agents running Meta campaigns should include this language on landing pages and in ad disclosures.

What Medicare Agents Should Do Now

CMS TPMO rules are not going to become less strict. The direction of regulation has been consistent: more protection for beneficiaries, more accountability for lead generators and agents.

Here is a practical checklist for compliance:

• Audit your lead sources. Ask every vendor whether PEWC-compliant consent was obtained and whether your name is on the consent document.
• Update your landing pages. Make sure your forms collect express written consent from each beneficiary before they are added to your follow-up sequence.
• Add the TPMO disclaimer. Every ad and landing page touching Medicare beneficiaries should include the required language.
• Document everything. Keep records of consent for any lead you follow up on. If CMS or a carrier audits, documentation is your protection.

The agents most exposed under current CMS TPMO rules for Medicare agents are those buying shared leads from vendors who have not updated their consent collection process since PEWC took effect.

The agents least exposed are those running owned campaigns where they control the consent process from the first click.

If you want to understand what your current lead setup looks like from a compliance and performance standpoint, take the free 60-second assessment and get your personalized Medicare Lead Gen Roadmap. It shows you what to fix first -- free, no pitch.

[Get Your Free Medicare Lead Gen Roadmap -> https://sixtyfive-leads.lovable.app/roadmap]

Frequently Asked Questions

Q: What are CMS TPMO rules for Medicare agents? A: CMS TPMO rules apply to any independent Medicare agent compensated to perform lead generation, marketing, sales, or enrollment functions. The key requirement added in 2024 is Prior Express Written Consent (PEWC): agents cannot use leads where the beneficiary has not specifically named them in a written consent document. Blanket consent for categories of agents is no longer permitted.

Q: What is Prior Express Written Consent (PEWC) for Medicare? A: Prior Express Written Consent is the CMS requirement, effective October 1, 2024, that a Medicare beneficiary must specifically name each TPMO that will contact them before their information can be shared or used for marketing. A beneficiary consenting to be contacted by "insurance agents" generally is not sufficient -- the consent must name specific organizations. Real-time call transfers are the one exception to this requirement.

Q: Do CMS TPMO rules apply to independent Medicare agents? A: Yes. CMS defines TPMOs broadly to include individuals -- not just companies -- compensated to perform lead generation, marketing, sales, or enrollment functions. An independent Medicare agent who purchases leads and follows up with beneficiaries is operating as a TPMO and must comply with PEWC requirements and marketing guidelines.

Q: How can Medicare agents stay compliant when buying leads? A: Agents buying third-party Medicare leads should ask vendors whether PEWC-compliant one-to-one consent was obtained and whether the agent's name appears in the consent document. Any vendor who cannot confirm this represents compliance risk. Agents who run their own lead campaigns control the consent process directly and have a simpler compliance chain to document and maintain.