ACA Consumer Consent vs. Application Review: What Agents Must Document and Store for 10 Years

Reviewed October 20, 2026. Includes CMS’s October 19, 2026 issuer guidance.

A consumer’s permission to help with Marketplace coverage and the consumer’s confirmation that an application is accurate happen at different points in the enrollment process.

Consumer consent authorizes your assistance. Eligibility application review documents the consumer’s review and confirmation before submission. Both require evidence you can maintain and produce later.

For agents working through the federal Marketplace platform, the federal rules require both documentation steps and at least 10 years of retention. The core provisions are 45 C.F.R. § 155.220(j)(2)(ii)–(iii). ecfr.gov

There is also a timely recording update for the 2027 enrollment season. Agents should check their insurers’ instructions before assuming that signed consent and application-review records settle every phone-documentation requirement.

This guide covers Federally-facilitated Marketplaces and State-based Marketplaces using the federal platform. If a state operates its own enrollment platform, check that Marketplace’s requirements.

In this guide

• Consent and application review: the quick comparison
• The October 2026 call-recording update
• What consumer consent must document
• What application review must document
• A practical phone-enrollment workflow
• Keeping records for 10 years
• Renewals, updates and NPN changes
• The separate PY2028 form requirement
• A checklist for your next enrollment
• Frequently asked questions

Consent and application review: the quick comparison

The first two checkpoints are the federal documentation obligations addressed in section 155.220. The recording questions require a separate check of applicable law and carrier instructions. ecfr.gov

You need evidence of two events; you do not necessarily need two separate files. One recording or electronic workflow can document both consent and application review if it captures the required information and preserves the sequence.

A signature collected before an application is completed cannot, by itself, show that the consumer later reviewed the completed information.

The October 2026 call-recording update

On October 19, 2026, CMS recommended that QHP issuers on the federal platform, including State-based Exchanges on that platform, direct their appointed agents and brokers to record calls involving new and existing Marketplace consumers.

The guidance covers plan comparison and selection, enrollment, sales and marketing interactions.

This is an issuer-directed recommendation, not a blanket new federal call-recording mandate for every ACA agent. Read CMS’s October 19 guidance, pages 1, 3–4. cms.gov

What to confirm with each insurer

The practical question is whether an issuer has adopted recording requirements that apply to your appointment and business. Issuers already have responsibility for applicable Exchange compliance by their downstream and delegated entities under 45 C.F.R. § 156.340. ecfr.gov

Before your next affected enrollment call, obtain the insurer’s written instructions and confirm:

• Your classification and start date. Ask how the insurer counts policies, identifies the parent organization, handles agency versus individual NPNs and applies the PY2027 threshold. Do not substitute a count of covered family members.
• The conversations covered. Ask about follow-up calls, transfers, multiple agents and comparisons involving more than one insurer.
• Recording procedures. Confirm the required disclosures, recording-consent process and instructions when a consumer declines recording.
• Storage and production. Confirm retention, accepted formats, retrieval deadlines, approved delivery methods and access after an agency or vendor change.

Keep the applicable bulletin with your procedures. Give staff a clear way to identify which instructions apply before a call begins.

What consumer consent must document

An ACA consumer consent record should identify the authorization the consumer actually gave. The required elements include:

• The consumer’s or authorized representative’s name.
• The agent, broker, web-broker or agency receiving consent.
• The date consent was given.
• The scope, purpose and duration of the authorization.
• A process for rescinding consent.
• A consumer action that produces a maintainable record of that authorization.

See 45 C.F.R. § 155.220(j)(2)(iii)(A)–(B). ecfr.gov

For current pre-PY2028 workflows, documentation methods can include a signed paper or electronic document, a suitable consumer email or text response, or recorded verbal consent. The method must capture the required information. CMS’s model consent materials include written examples and verbal scripts. cms.gov

A practical consent request should make the work understandable. For example, identify whether you are seeking permission to search for an existing application, help apply for coverage and financial assistance, make authorized updates or provide ongoing account assistance. Use a clear duration and a usable revocation method.

For agency workflows, identify who receives the authorization and who will assist the consumer. Recording the writing agent’s NPN can help connect the file to the transaction; distinguish useful identifying fields from the regulation’s minimum list.

When should consent be obtained?

Obtain it before providing the relevant Marketplace assistance, including collecting or using identifiable consumer information for an individualized quote, searching for an application or making authorized changes.

CMS distinguishes that activity from providing an anonymous estimate using general information that is not linked or linkable to a particular person. cms.gov

A useful workflow is to send the consent request before the appointment. Check that it was completed, remains valid and covers the assistance before opening the consumer’s application.

Is a lead form or website checkbox enough?

A request for information does not automatically establish authorization for Marketplace assistance.

CMS warns that simply checking a box on an online lead form would likely be insufficient. Agents receiving purchased leads must still satisfy the applicable consent and application-review requirements. cms.gov

When reviewing a lead record, ask what the consumer actually saw and authorized. Does the evidence identify the relevant agent or agency, describe the assistance, include the required terms and show the consumer’s action?

Keep these questions separate:

What application review must document

Application review is the consumer’s opportunity to check what will be submitted. It should occur after the relevant information is ready for review and before submission.

The documentation must include the review date, the consumer’s or authorized representative’s name, an explanation of the end-of-application attestations and the assisting agent’s, broker’s or web-broker’s name. It must show the consumer’s review and confirmation of accuracy. See 45 C.F.R. § 155.220(j)(2)(ii)(A). ecfr.gov

Make the review specific enough to be useful

Walk through the actual application information and explain the attestations presented for that consumer. Give the consumer an opportunity to ask questions and correct mistakes.

Useful review topics include household members, the projected income entered, relevant coverage information and other answers affecting the application. Tailor the discussion to the completed application rather than reading a generic list that overlooks the consumer’s circumstances.

A practical confirmation question, after that review, is:

“We have reviewed the information that will be submitted and discussed the application attestations. What needs to be corrected? If nothing needs to be changed, do you confirm that the information is accurate?”

This is an example closing question, not a complete CMS script. Use the complete required process and your applicable Marketplace, platform and issuer instructions.

CMS’s model application-review form and verbal script provide a useful starting point. cms.gov

Connect the confirmation to the submission

As a recordkeeping practice, retain an application reference, version or permitted snapshot that helps identify what the consumer reviewed. Save the confirmation time and the submission record.

If the consumer corrects an answer, capture confirmation of the corrected information before submitting it. An earlier approval should not become a standing approval for later changes.

For plan-selection and other enrollment actions, also follow the applicable Marketplace, EDE and issuer confirmation procedures. Avoid assuming that a platform’s status label, by itself, proves the underlying review occurred.

A practical phone-enrollment workflow

A telephone workflow needs to address both the documentation of consent and review, and any separate requirement to record the sales or enrollment conversation.

1. Resolve recording procedures before the call

Identify the applicable insurer instructions and recording-law requirements. Establish how staff will handle notice, any required agreement to record, transfers and interrupted calls.

If a consumer declines recording, follow the insurer’s approved alternative or escalation process. Do not promise that an electronic consent form automatically resolves a separate recording requirement.

A useful agency procedure identifies whom the agent should contact and what alternatives, if any, are available before the situation arises.

2. Obtain or verify authorization before assistance

Locate an existing valid consent record that covers the planned assistance, or obtain a new one.

If consent will be documented verbally, use the complete applicable script and capture the consumer’s affirmative response in the required record. Identify the consumer, the agent or agency, the authorization terms and the revocation process.

An agreement to record the conversation is a separate event. Make it easy for a later reviewer to find both.

3. Keep the covered conversation connected

Follow the insurer’s recording instructions during the relevant discussion. If a consumer calls back or moves to another agent, connect those interactions to the same consumer file.

As an operational safeguard, check that recording continues through the required stages and that both sides are audible. A dashboard showing that a call occurred does not establish that a usable recording exists.

4. Complete the application and conduct the review

Review the actual eligibility information with the consumer, explain the applicable attestations, address questions and make any corrections.

Keep the review connected to the information you are about to submit. Avoid a workflow in which an early consent signature is reused as evidence of a later application review.

5. Capture the consumer’s confirmation before submission

Save the consumer’s confirmation through the applicable record-producing method. Check that the record identifies who confirmed, what was reviewed and when.

If the call disconnects before confirmation, reconnect or complete another permitted confirmation process before submission.

6. Save and check the evidence

Connect the consent record, review confirmation, relevant recordings and submission reference. Spot-check the files for completeness, playback and correct consumer association.

A transcript or summary can help staff find an important passage. Keep the source recording when the recording itself is required or serves as the evidence.

Can an unrecorded call still support consent or review documentation?

The federal documentation rules have not made audio recording the only possible method for current pre-PY2028 workflows.

CMS’s FAQ explains that verbal consent must be documented in an audio recording or other compliant documentation. It also recognizes a written transcript of an unrecorded application-review conversation only when the transcript meets the regulatory requirements. A bare note saying “client agreed” is insufficient. cms.gov

As a practical choice, a complete consumer-signed or consumer-returned record can make the affirmative action easier to demonstrate than an agent’s brief internal note.

If an issuer requires a recorded enrollment conversation, a signature or transcript alone does not replace that recording. Likewise, a recording does not establish consent or application review unless it contains the required information and consumer responses.

Three situations to check in your own workflow

Keeping records for 10 years

Maintain consent and application-review documentation for at least 10 years and produce it when CMS requests it for monitoring, audit or enforcement.

CMS explains that retention continues for 10 years following the enrollment or application submission, including when consent expires or is revoked, the consumer changes agents or the agent leaves an employer. cms.gov

When an audio recording serves as your consent or application-review evidence, preserve that evidence for the applicable retention period.

For other issuer-required recordings, confirm the applicable retention instructions. The October 19 guidance calls for retrievable, securely maintained recordings that comply with applicable recording-consent laws; it does not specify a new numerical retention period for every recording. cms.gov

Organize the file around the transaction

Recommended filing fields include:

• Consumer identifier and applicable plan year.
• Agent or agency and relevant NPN.
• Consent date, scope, duration and evidence location.
• Application-review date and evidence location.
• Application or submission reference.
• Associated recordings and call dates.
• Relevant issuer instructions, correspondence and authorized changes.

These are practical organization recommendations, not a claim that CMS mandates a particular database design or storage vendor.

Preserve the record of each transaction instead of overwriting older evidence when something changes.

Test retrieval before you need it

Pick a completed case and ask another authorized staff member to retrieve the evidence. Can that person identify the correct application, find the consumer’s authorization, locate the review confirmation and play the relevant recording?

Before changing agencies, CRMs, phone providers or enrollment platforms, confirm how you will preserve lawful access and export the records. Check that an export contains the actual evidence and usable files, not just links to an account that will close.

For additional guidance, see our ACA consent and 10-year recordkeeping guide.

Renewals, updates and NPN changes

For current workflows, CMS distinguishes a passive automatic renewal with no agent-made changes from an update or active assistance beyond existing consent. Do not treat the older passive-renewal guidance as a permanent exception to the separate PY2028 rules below.

For an authorized application update, document review of the updated information before submission. If an NPN change appears unauthorized, confirm the consumer’s instructions before attempting a correction; earlier consent does not justify automatically reversing another agent’s changes. cms.gov

If you are not associated with the enrollment, follow the required consumer-involvement pathway. CMS’s published safeguards include a three-way call with the consumer and Marketplace Call Center, or a consumer-submitted change through HealthCare.gov or an approved direct-enrollment consumer pathway. Documented consent alone does not bypass the safeguard. CMS

A useful renewal checklist asks:

1. Am I providing assistance, changing information or making a submission?
2. Does the consent on file still cover that work?
3. What information must the consumer review and confirm for this transaction?
4. Which issuer recording instructions apply to the conversation?
5. Have I preserved the new records without replacing the older ones?

For a disputed change, retain the consumer’s request, relevant messages, the authorized correction and the resulting submission record together.

The separate PY2028 form requirement

The recording rollout and the standardized-form requirement have different timelines.

CMS’s 2027 Payment Notice final rule requires an HHS-approved and HHS-created form for consumer consent and eligibility application-review documentation beginning with enrollments for plan years starting January 1, 2028. CMS

The published rule explains that:

• The requirement includes PY2028 enrollments and reenrollments, including those under 45 C.F.R. § 155.335(j).
• Older consent and review documents will not satisfy the new requirements for those enrollments.
• Permitted recorded-phone and email workflows must communicate or contain the complete HHS-approved form language.
• After the new consent is properly obtained, valid, unrevoked consent can continue to cover later assistance within its scope; it need not be re-executed for every interaction.

See the 2027 final rule, 91 Fed.Reg. 29526, 29591–29594 (May 20, 2026). govinfo.gov

Prepare the relevant forms, scripts, renewal outreach and staff procedures before the fall 2027 enrollment season. Follow CMS’s implementation instructions, including for reenrollments.

Use CMS’s designated PY2028 materials when applicable. Do not assume that an older customizable model form, or its printed OMB expiration date, determines compliance with the new standardized-form requirement.

A checklist for your next enrollment

Use this as an internal workflow checklist. Completing it does not substitute for the consumer’s actual authorization, review or confirmation.

Before providing assistance

• Identify the consumer or authorized representative.
• Locate valid consent covering the work, or obtain and document it.
• Check the required consent elements and the consumer’s record-producing action.
• Identify the applicable issuer recording instructions and start date.
• Follow the required recording notice and consent procedure.

Before submitting information

• Review the completed eligibility information with the consumer.
• Explain the applicable attestations and address questions.
• Correct errors and capture confirmation of the final information.
• Check applicable Marketplace, EDE and issuer submission procedures.
• Verify that any required recording covers the relevant interaction.

After submission

• Link consent, review, recordings and the submission reference.
• Check that files are complete, correctly associated and retrievable.
• Apply the appropriate retention settings.
• Preserve later updates and revocations alongside the historical record.

Save or print this checklist with the issuer instructions your team actually uses.

Download the ACA Consent + Application Review Checklist PDF.

Keep ACA consent, review and call records together

Informed + Choice helps licensed agents organize consumer consent, eligibility application-review records, uploaded recordings, historical documents and exportable files around their existing Marketplace workflow. Informed + Choice

Explore our ACA consumer consent and eligibility-review tools to discuss an Essentials demo or agency access.

For a demo, bring a sample workflow: how you obtain authorization, document review, handle recording and retrieve a completed file. That makes it easier to evaluate the tools against your agency’s procedures and issuer requirements.

For broader follow-up work, see ACA compliance and Marketplace operations for agents.

Frequently asked questions

Does every ACA agent have to record calls starting November 1, 2026?

The October 19 document is a recommendation to issuers, with the phased timing shown above. Determine which recording instructions your appointed insurers have adopted and when those instructions apply to you. cms.gov

Can one form or recording document consent and application review?

Yes, if it captures both events with their required information and timing. Structure the workflow so authorization precedes assistance and confirmation follows review of the actual application information. cms.gov

Does permission to record authorize Marketplace assistance?

Do not treat it that way. Design the process to establish recording permission when required, authorization for assistance and confirmation of application accuracy as distinct events.

Do I need a new consent form for every call?

Check the existing consent’s validity, duration and scope, and whether it has been revoked. Application-review documentation remains a separate checkpoint for a submission. Build the PY2028 form transition into that process rather than assuming an older authorization can be used indefinitely. govinfo.gov

Does CMS require a particular vault or CRM?

The cited documentation rules require maintainable, producible records; they do not designate a commercial vault or CRM. Evaluate any system by whether your records remain complete, protected, accessible and exportable for the applicable period. ecfr.gov