CMS's Unsolicited Contact Rule: 2027 Agent Guide

Which Medicare leads can you actually call in 2027? The honest answer is fewer than most agencies think, and the test isn’t about where the number came from, it’s about whether that specific beneficiary asked you to call. CMS’s unsolicited contact rule, codified at 42 CFR 422.2264(a), doesn’t ban calling Medicare beneficiaries. It bans telephone solicitation, robocalls, text messages, and voicemail messages when the contact is unsolicited, and it treats contact as unsolicited by default unless the beneficiary consented to it or started it themselves. A beneficiary who filled out a form asking for a callback clears that bar. A sales event attendee who never gave phone permission doesn’t, even though their name is sitting right there in your CRM. The marketing and communications provisions that carry this rule into the current plan year took effect October 1, 2026, a little over three weeks before this article, and they apply to every piece of CY2027 marketing contact agents and agencies make from here through the rest of Annual Enrollment Period, which runs October 15 through December 7 this year under 42 CFR 422.62(a)(2). This article works through exactly what counts as solicited, what doesn’t, why that’s a separate question from TCPA consent, and what a violation actually costs, all verified against CMS’s and the FCC’s own regulatory text this session, on October 23, 2026.

What “Unsolicited” Actually Means Under CMS’s Own Rule

CMS defines unsolicited by what it isn’t, not by a specific list of contact sources. Per 42 CFR 422.2264(a), the rule’s scope covers “materials or activities” given or supplied to a beneficiary or their caregiver “without prior request.” There’s no separate glossary definition of “solicited” sitting elsewhere in the regulation. The line is drawn entirely by subsection (a)(3): “Calls are not considered unsolicited if the beneficiary provides consent or initiates contact with the plan.” Everything else defaults to unsolicited.

That default matters more than it looks like on first read. Most agencies think about their lead list in terms of source quality, exclusive versus shared, aged versus fresh, digital versus referral, and assume a “good” lead is a callable one. CMS’s rule doesn’t care about lead quality. It cares about one binary fact: did this specific beneficiary ask to be contacted, or didn’t they. A hot, expensive, exclusive lead that nobody asked you to call is still, under this rule, an unsolicited contact. A cheap, aged lead who filled out a form eight months ago asking for a callback is still, under this rule, solicited, assuming that consent hasn’t gone stale in some other way.

A few terms do real work here, so define them once. A Medicare Advantage organization (MAO) is the entity CMS directly regulates under this part; agents and brokers marketing a plan’s products are covered by the same rule as the MAO’s representatives. Telephone solicitation, as the rule uses it, is described parenthetically in the text itself as “cold calling,” meaning a call initiated by the agent or plan rather than the beneficiary. A robocall is an automated or prerecorded-voice call, the same category the FCC regulates separately under the TCPA, discussed below. Consent, in this specific CMS context, is simpler than the TCPA’s written-consent standard: the regulation’s own examples are a beneficiary returning a call or completing a business reply card requesting contact, no signature requirement stated in this particular provision.

The Four Specific Call Types CMS Names as Prohibited

What does the rule actually ban, in concrete terms an agent would recognize from a Tuesday afternoon call list? 42 CFR 422.2264(a)(2)(iv) lists telephone solicitation, robocalls, text messages, and voicemail messages as prohibited when unsolicited, then gives four named examples that make the abstract rule concrete.

Calls based on referrals, under (a)(2)(iv)(A), are prohibited. A current client giving you their neighbor’s name and number doesn’t make that neighbor a solicited contact. The neighbor hasn’t consented to anything or initiated any contact with you; your client did the initiating, on someone else’s behalf, which the rule doesn’t treat as the same thing.

Calls to former enrollees who have disenrolled, or those in the process of disenrolling, under (a)(2)(iv)(B), are prohibited, with a specific carve-out for disenrollment surveys conducted for quality improvement purposes. A member who just left your book of business for a competing plan isn’t a re-enrollment call target by default, regardless of how recently they were a client.

Calls to beneficiaries who attended a sales event, under (a)(2)(iv)(C), are prohibited “unless the beneficiary gave express permission to be contacted.” This is the one that trips up the most agencies, because attending a seminar, a dinner event, or a plan presentation feels like an invitation to follow up. It isn’t, on its own. Attendance is not permission. The permission has to be separate, explicit, and specific to phone contact, captured at the event itself.

Calls to prospective enrollees to confirm receipt of mailed information, under (a)(2)(iv)(D), are prohibited. CMS allows unsolicited direct mail outright, under 422.2264(a)(1). It does not allow using the mail as a bridge to an otherwise-unsolicited phone call. Sending a brochure doesn’t earn you a follow-up call to check if it arrived.

Why Clearing This Rule Doesn’t Clear the TCPA Too

A beneficiary who requested a call is a solicited lead under CMS’s rule. That fact alone doesn’t finish the compliance check, because a second, entirely separate federal law also governs how that same phone call can be placed.

The Telephone Consumer Protection Act, specifically 47 CFR 64.1200(a)(2), requires prior express written consent before an automated telephone dialing system or an artificial or prerecorded voice, which includes an AI voice agent, can call a wireless number for a call that includes an advertisement or constitutes telemarketing. That written-consent standard is defined under 47 CFR 64.1200(f)(9) as a signed agreement, electronic signature acceptable, that specifically authorizes automated calls or texts from a named party to a specific number. CMS’s “beneficiary consented or initiated contact” standard, by contrast, doesn’t require that level of documentation; its own examples are a returned call or a completed reply card.

Put those two standards side by side and the gap is obvious. A beneficiary who calls your office, listens to a hold message, and hangs up before reaching anyone has arguably “initiated contact” in a way that could satisfy CMS’s standard for a callback. That same beneficiary has not signed anything authorizing an automated or AI-placed call back to their number, which means an AI voice agent calling them back could clear the CMS bar and still violate the TCPA, if that AI call is treated as telemarketing and the beneficiary’s documented consent doesn’t cover automated contact.

A human agent manually dialing one number at a time, with no autodialer and no prerecorded script, isn’t subject to that same written-consent trigger under 47 CFR 64.1200(a)(2), because the heightened standard is triggered by the dialing method, not by who eventually talks to the beneficiary. That’s why a manually dialed call to a CMS-solicited lead with a thin TCPA consent record is often the safer move than an automated one, until the written consent is actually on file.

What Getting This Wrong Costs

Put real numbers against the mistake, because “probably fine” is not a compliance strategy and the agreements most agents sign with their carriers make them financially responsible for marketing conduct that traces back to their own calls.

Under 42 CFR 1003.410, the Medicare Advantage organization’s civil monetary penalty for failing to comply with marketing restrictions, or CMS’s implementing regulations and guidance governing those restrictions, tops out at $48,833 per determination, per the Federal Register’s 2025 inflation-adjusted figures published January 28, 2026. A related, higher penalty applies to practices that discourage enrollment, which the same table lists alongside misrepresenting or falsifying information to an individual or entity: up to $195,335 per determination. Both figures are statutory maximums the Medicare Advantage organization faces under federal law, not a court’s prediction of what any specific agent will personally owe, and HHS adjusts these amounts for inflation on its own schedule separate from CMS’s marketing rule itself.

Run the arithmetic against what’s actually sitting in most agency lead lists during AEP. An agency working 40 sales-event attendees from a single seminar, none of whom signed a separate phone-contact authorization, and automatically dialing all 40 the following week because they’re sitting right there in the CRM, has generated 40 unsolicited contacts under 422.2264(a)(2)(iv)(C) before a single one of them answers the phone. That’s exposure math at the plan-sponsor level, not a claim that 40 calls automatically trigger a $195,335 penalty; the point is that the violation count scales with the list size, the same way a bulk text blast’s TCPA exposure scales with the number of unconsented numbers on it.

Why October 1, 2026 Matters Right Now

CMS finalized the Contract Year 2027 Medicare Advantage and Part D rule in the Federal Register on April 6, 2026, with the broader rule effective June 1, 2026. The marketing and communications provisions, the part that carries 422.2264’s current language into this plan year, apply specifically to “all contract year 2027 marketing and communications” starting October 1, 2026, per the rule’s own applicability text published on govinfo.gov. That’s roughly three weeks before this article, which means every Medicare marketing call an agent has placed since October 1 is already operating under this exact version of the unsolicited contact standard, not under whatever informal understanding of the old rule the agency carried over from last AEP.

The timing lands inside the highest-volume stretch of the year on purpose, or at least with full knowledge of the overlap. The Annual Election Period runs October 15 through December 7 every year, fixed by 42 CFR 422.62(a)(2) since 2011, and 35.2 million people, 55% of the 64.2 million Americans with Medicare Parts A and B, were already enrolled in a Medicare Advantage plan as of CMS’s own 2026 enrollment data, reported by KFF using March 2026 figures. Every one of those 35.2 million, plus everyone newly eligible and shopping for the first time, has exactly one fixed window a year to act, and this specific AEP is the first one running entirely under the new marketing applicability date.

That overlap is exactly why a sloppy consent-tracking habit from a slower season gets expensive fast once AEP volume hits. A agency dialing 15 leads a day in July can often eyeball which ones are solicited. The same agency dialing 150 leads a day in late October, pulling from three or four different sources at once, a web form here, a referral list there, a sales-event sign-in sheet from last Tuesday, is the exact situation where an unsolicited contact slips through because nobody built a check for it into the workflow.

How to Build the Solicited-or-Not Check Yourself

None of this requires buying a platform. It requires tagging every lead’s consent basis at intake and routing the call channel off that tag, before volume makes manual judgment calls unreliable.

1. Capture the specific basis for contact at the moment the lead enters your system, not after. “Web form, requested a callback, timestamp 10/23/2026” is a usable tag. “Medicare lead” with no source field is not.
2. Treat sales-event attendance as a separate category from phone-contact permission. A sign-in sheet proves attendance. It doesn’t prove a phone opt-in. Build a distinct checkbox, physical or digital, at the event itself, specifically authorizing a follow-up call, and only tag someone “solicited” if that box is checked.
3. Exclude referral-only names from your automated call queue entirely. A name with no independent initiation on record from that person isn’t a solicited contact under 422.2264(a)(2)(iv)(A), no matter how warm the referral felt.
4. Separate your CMS solicited/unsolicited tag from your TCPA consent tag. They answer different questions and a lead can be one without the other. A lead tagged “CMS solicited, TCPA consent unclear” should route to a manual, non-autodialed call rather than an automated one, until the written consent is actually documented.
5. Route disenrolling or recently disenrolled members out of your general re-engagement list, unless the specific contact is a quality-improvement disenrollment survey, which carries its own documented purpose under 422.2264(a)(2)(iv)(B).
6. Log which exception applied to every call you make to a lead without a clean web-form or callback record. If you’re relying on the sales-event express-permission exception or the beneficiary-initiated exception, write down what the beneficiary actually did, not just that you believe they’re fine to call.
7. Review this tagging logic against CMS’s current guidance before each AEP, since marketing and communications rules have changed on an annual cycle for several years running and this year’s version took effect only weeks ago.

An agency that reads this and builds a required “contact basis” field into its CRM intake form, with a short list of valid values, has built the real fix. That’s a spreadsheet column and a staff habit, not a technology purchase. What doesn’t scale by hand is applying that check consistently across 150 leads a day from four different sources during the six busiest weeks of the year, every single time, without someone eventually grabbing the referral list because the queue is backed up and the sales-event sheet is sitting right there.

A Worked Example: One Seminar, Three Weeks Into AEP

An agency runs a Medicare Advantage sales event on October 20, 2026, five days into this year’s AEP. Sixty people attend. Forty sign the general sign-in sheet only. The other twenty also check a separate box reading “Yes, you may call me to follow up on what we discussed,” initialed and dated.

Run it with no contact-basis distinction: all sixty names go into the CRM as “event leads” and the automated dialer works the full list starting the next morning. The twenty who checked the follow-up box are solicited contacts, cleanly inside 422.2264(a)(3)‘s express-permission exception. The other forty are unsolicited contacts under 422.2264(a)(2)(iv)(C), each one a separate potential violation the moment the automated system dials it, regardless of how engaged they seemed in the room.

Run it with the contact-basis tag built in: the CRM only loads the twenty checked-box names into the automated queue. The other forty get a different, much shorter list: a single piece of compliant follow-up mail under 422.2264(a)(1), which doesn’t require solicited status, and nothing by phone unless and until one of them calls in or submits a web form on their own. Same seminar, same sixty attendees, a third of the follow-up calling volume, and zero unsolicited contacts generated by the event instead of forty.

How We Solve It

TheAffordableAI is a managed AI caller, not a Medicare compliance platform, and it doesn’t replace the work of tagging a lead’s actual contact basis at intake. What it does, per TheAffordableAI’s own Features page: fires outbound within seconds of a lead landing in your CRM, so a beneficiary who just submitted a “request a call” web form, the cleanest kind of solicited contact under 422.2264(a)(3), gets reached while they’re still the one who initiated it, not two days later when the moment’s passed. It answers every inbound call the same way, so a returning callback, CMS’s other named example of solicited contact, gets picked up instead of routed to voicemail. And it syncs two-way with HighLevel, writing the disposition, transcript, and call recording back into the contact record, which is exactly where a contact-basis tag belongs if you’re building the routing logic in the steps above.

Pricing, since the math in this article leans on it: Single Account runs $200 a month plus a $500 one-time setup fee, at $0.20 a minute, dropping toward $0.15 at bulk volume. Agency runs $500 a month plus a $1,000 one-time setup fee, at $0.18 a minute, dropping toward $0.16 at bulk volume, and adds routing to 20-plus agents at once, useful during AEP when solicited and unsolicited leads from the same event need to land with different team members handling different follow-up channels. Both plans run month to month with no long-term commitment, per TheAffordableAI’s pricing page, fetched for this article on October 23, 2026. You can build the contact-basis tagging and routing logic yourself with a CRM custom field and a disciplined intake process; plenty of agencies do. It’s worth pricing that build against a managed option before the rest of this AEP forces the sequencing decision for you.

Where This Doesn’t Fix Anything

Say it plainly: no calling platform, AI or human, turns an unsolicited contact into a solicited one. If forty people signed a general attendance sheet with no separate phone opt-in, the fix is capturing that opt-in at the next event or following up by mail instead, not routing those forty names through faster software. A speed advantage only helps once a lead has already cleared the solicited bar; it does nothing for the ones that haven’t. And if your agency’s Medicare volume is small enough that one person can manually tag every lead’s contact basis and route the calls by hand inside a few minutes a day, the automation in this article may not move the needle much for you specifically. Run your own lead volume and sourcing mix against the rule above before assuming otherwise.

What You Get When the Tagging Is Right

A beneficiary’s own documented request decides what you’re allowed to do by phone before cost, speed, or lead quality enters the picture at all. Get that backwards, treating every name in the CRM as equally callable, and an agency can build an efficient, fast, well-funded calling operation that’s still generating unsolicited contacts by the dozen every AEP without anyone noticing until a complaint or an audit surfaces it. Get it right, and the two goals most agencies think trade off against each other, speed and compliance, stop competing: a solicited lead, the beneficiary’s own request sitting right there in the record, is exactly the lead worth calling fastest, and it’s also the one the rule never restricted in the first place. The seminar example above didn’t cost this agency speed. It cost them two-thirds of a call list that was never legally theirs to dial automatically, and left them faster on the third that was.