Medicare Permission to Contact: Referral, Phone, Text, Event, and Social-Media Rules

“Can I contact this Medicare lead?” sounds like one question. In practice, an agent may need to answer three separate questions:

1. Permission to Contact: Do CMS rules permit me to initiate this contact?
2. TCPA and Do-Not-Call: May I use this particular calling or texting method?
3. Scope of Appointment: What Medicare Advantage or Part D products may I discuss once the conversation becomes a personal marketing appointment?

CMS beneficiary-contact requirements appear in 42 C.F.R. § 422.2264 for Medicare Advantage and the parallel Part D rule. Telephone and text-message requirements are separately governed by the TCPA and the FCC’s calling and text-message rules.

A date warning for 2026

CMS finalized important SOA and event changes in the CY 2027 final rule. The regulation became effective June 1, 2026, but CMS says that the new marketing and communications policies apply to CY 2027 marketing beginning October 1, 2026. The current eCFR can display amended text before a CY 2027 marketing workflow begins, so the applicability date belongs in every current training discussion.

For the timing details, use the 48-hour SOA rule guide for Medicare agents alongside the CY 2027 final-rule text and current carrier and agency procedures.

What is Medicare Permission to Contact?

Permission to Contact, usually shortened to PTC, is industry shorthand for the beneficiary’s consent or request that makes an agent’s outreach solicited rather than unsolicited. CMS does not establish one universal form called a PTC form. Instead, the Medicare Advantage beneficiary-contact rule and parallel Part D rule explain when a call is not unsolicited, including when the beneficiary initiates contact, gives consent, returns an agent’s call, or completes a Business Reply Card or similar contact request.

That is why carriers, FMOs, agencies, lead platforms, and compliance vendors can use different forms or electronic workflows. The title at the top of the form is not the core question. The record needs to show that the beneficiary requested or consented to the contact.

How long does Medicare PTC last?

The 12-month language in the CMS beneficiary-contact rule applies to the product scope documented through an SOA, Business Reply Card, or request for additional information. Treat that as an outside CMS validity window, not as a 12-month unlimited license to contact someone in any manner about any product.

Permission can end earlier when the beneficiary withdraws consent, the requested purpose is completed, the contact channel changes, another seller wants to use the record, the discussion moves outside the documented product scope, the TCPA requires a separate written agreement, or a carrier, FMO, agency, or state imposes a shorter period. CMS also requires a new SOA before marketing additional health-related product lines that were not previously identified. For the product-scope question, review how long an SOA remains valid.

PTC vs. TCPA vs. SOA

A well-designed electronic workflow can collect more than one record at the same time, but the disclosures and affirmative actions must satisfy each applicable rule. Simply labeling a checkbox “PTC and SOA” does not make it sufficient.

The Medicare PTC decision tree

Step 1: Did the beneficiary initiate contact or personally give permission?

Under the CMS beneficiary-contact rule, unsolicited direct contact is generally limited to conventional mail, print media, and email when the email includes an opt-out option. Compliant public advertising is different from a private message directed to a particular beneficiary. Preserve the evidence and make it answer who gave permission, when it was given, which agent or organization may contact the person, the requested channel, the number or address, the requested subject, and the exact disclosure shown or heard.

Step 2: Is this a referral?

A client’s referral does not give an agent permission to call the referred person. The CMS rule prohibits unsolicited calls based on referrals. A client cannot consent on a friend’s, neighbor’s, sibling’s, or parent’s behalf merely by giving the agent that person’s telephone number.

1. Give the existing client your business card, phone number, website, or secure contact form.
2. Ask the client to give that information to the referred person.
3. Have the referred person call, text, complete the form, or otherwise personally request contact.
4. Document that beneficiary-initiated request before beginning outbound follow-up.

Step 3: What channel will the agent use?

Permission to make contact is not necessarily permission to use every communication method.

Manual telephone call

For a live, manually placed call, the file should show the beneficiary’s CMS permission or request. The agent must also address the FCC’s calling and Do-Not-Call rule and applicable state requirements. The FCC generally restricts telephone solicitations before 8 a.m. or after 9 p.m. at the called party’s location, and a number on the National Do-Not-Call Registry ordinarily cannot be called for solicitation unless an exception applies. Do not treat a telephone-law exception or an established business relationship as a blanket substitute for CMS permission to solicit Medicare business.

Automated or prerecorded call

If a telemarketing call uses an automatic telephone dialing system, artificial voice, or prerecorded voice, the FCC’s codified rule generally requires prior express written consent. Under 47 C.F.R. § 64.1200, the agreement must clearly authorize the seller to deliver covered calls to the specified number and disclose that signing is not a condition of buying goods or services. Electronic signatures can qualify.

Use carrier- and counsel-approved consent language for dialers, prerecorded messages, artificial voice, or automated texting.

Text message, voicemail, and home visit

The CMS beneficiary-contact rule specifically prohibits unsolicited text messages. A beneficiary who texts first, affirmatively requests a text, or selects a properly disclosed text option may create permission for a response within the requested purpose. A mobile number by itself is not a request for marketing texts. Identify the sender, stay within the requested subject, provide a practical opt-out, promptly process revocations, and stop after the beneficiary withdraws consent.

Do not treat “I only left a voicemail” as a workaround for the cold-call rule. A callback voicemail may be within a beneficiary’s request for a return call, but its content and any prerecorded-delivery technology must remain within that permission and the applicable TCPA requirements.

A general request for information is not permission to show up at a home. Under the same CMS beneficiary-contact rule, a home visit is unsolicited door-to-door contact unless an appointment at the beneficiary’s home was previously scheduled for the applicable date and time.

Step 4: Is the contact becoming a personal marketing appointment?

An initial contact can begin as scheduling or education and later become a personal marketing appointment. A personalized telephone call, web meeting, chat, office visit, home visit, or face-to-face meeting can qualify when it is tailored to an individual or small group for marketing discussion.

Before personalized MA or Part D marketing begins, the agent needs the applicable SOA. The SOA determines the product types that may be discussed. A request to “call me about Medicare” can provide PTC but be too general to establish product scope. Permission to discuss Part D does not automatically authorize a Medicare Advantage or MA-PD presentation, and permission to contact does not authorize an annuity, life-insurance, or other non-health-product presentation during the Medicare appointment.

Beginning October 1, 2026, the CY 2027 final rule requires the SOA to be agreed upon and recorded before the appointment without a fixed waiting period. For an in-person personal marketing appointment, the SOA must be in writing. For the face-to-face documentation requirement, use the written SOA for an in-person appointment guide.

Referral rules: common situations

Medicare event rules

Attendance is not permission to contact

The CMS event-contact rule prohibits calls to beneficiaries merely because they attended a sales event unless they gave express permission to be contacted. Attendance, registration, a name tag, a badge scan, or sitting through a presentation does not automatically create PTC. An organization may not require event attendees to sign in or provide contact information as a condition of attending.

Information collected for a raffle or drawing may be used only for that raffle or drawing. Do not export a raffle list into a CRM, call entrants, send marketing texts, or treat a raffle entry as PTC unless the person separately completed an appropriate contact-permission record.

Educational events through September 30, 2026

Through September 30, agents may distribute communications materials and business cards, answer beneficiary-initiated questions, and make available or receive Business Reply Cards and other contact information. They may not collect SOAs at the educational event, conduct a sales or marketing presentation, or accept plan applications. The CY 2026 CMS training guidance also applies a 12-hour separation rule for a marketing event in the same or adjacent building.

Educational events beginning October 1, 2026

For CY 2027 marketing beginning October 1, the final rule permits SOAs to be made available and collected at educational events. The educational portion still may not include a sales or marketing presentation, and applications still may not be distributed or accepted during that portion. A marketing event may directly follow only after attendees are told the educational event is ending and receive a sufficient opportunity to leave. Collecting an SOA does not turn the educational presentation into a sales presentation. See collecting an SOA at a Medicare educational event for the event workflow.

Medicare social-media rules

Public post or advertisement

CMS’s solicitation prohibition is directed at unsolicited direct messages, not every public social-media post. A compliant public communication or approved advertisement can invite beneficiaries to call, message, or complete a form. A post discussing plan benefits, premiums, cost sharing, plan comparisons, or similar subjects can still be Medicare marketing based on its content, audience, timing, and purpose. It must not be misleading or materially inaccurate.

Unsolicited and beneficiary-initiated direct messages

Do not send an unsolicited Facebook Messenger message, Instagram DM, LinkedIn message, or similar private message to a beneficiary. The same CMS contact rule does not turn a like, follow, reaction, page visit, video view, or event RSVP into permission to DM the person.

When a beneficiary initiates a private message and requests assistance, preserve the original message and date, confirm the preferred contact channel, avoid collecting sensitive information in a public comment, and move to an approved channel when appropriate. Obtain the SOA before personalized MA or Part D marketing, and obtain separate TCPA consent if automated calls or texts will be used. When the request is vague, ask the beneficiary to complete an approved contact form instead of stretching the meaning of a social interaction.

Website forms, lead vendors, and purchased leads

A spreadsheet marked “consented leads” is not evidence of consent. Before calling or texting a vendor-generated lead, the agency should be able to retrieve the original page or form, exact disclosure version, beneficiary action, submission date and time, supplied phone number, identified seller, authorized channels, Medicare-related purpose, automation disclosure, data-sharing disclosure, and any later revocation.

A generic statement that a lead is “TCPA compliant” does not answer whether it satisfies CMS beneficiary-contact requirements. CMS has a separate TPMO data-sharing requirement at 42 C.F.R. § 422.2274. Do not confuse it with a vendor’s description of the FCC’s one-to-one TCPA consent developments; the CMS requirement remains a separate Medicare-specific question.

Practical scenarios

What Permission to Contact does not do

PTC does not automatically satisfy TCPA prior express written consent, override the National Do-Not-Call Registry, authorize robocalls or automated texts, permit a social-media DM when the beneficiary did not initiate, turn event attendance into a sales lead, permit use of raffle information, establish every product category for the SOA, authorize another seller or TPMO to use the information, or continue after the beneficiary revokes consent.

A practical PTC documentation checklist

Where the CMS TPMO call-recording requirement applies, individual marketing, sales, and enrollment calls must also be recorded under the applicable plan and TPMO procedures. Permission to place the call does not remove the separate recording requirement.

Bottom line

Use this order every time:

1. CMS PTC: Did this beneficiary initiate or personally authorize the contact?
2. TCPA and DNC: May this agent use this phone or text channel, with this technology, at this time?
3. SOA: Before personalized MA or Part D marketing begins, which product types did the beneficiary agree to discuss?

For referrals, the referred person must initiate or consent. For events, attendance and raffle entries are not permission. For social media, a compliant public post can invite a response, but a like or follow is not permission to send a private sales message. Permission to have a conversation is not permission to discuss every product. That is the SOA’s job.

Sources

• 42 C.F.R. 422.2264 - Medicare Advantage beneficiary contact: Electronic Code of Federal Regulations
• 42 C.F.R. 423.2264 - Part D beneficiary contact: Electronic Code of Federal Regulations
• 42 C.F.R. 422.2274 - agent, broker, and TPMO requirements: Electronic Code of Federal Regulations
• 47 C.F.R. 64.1200 - FCC calling and text-message restrictions: Electronic Code of Federal Regulations
• CMS Contract Year 2027 final rule, 91 FR 17384: Federal Register
• CMS CY 2026 Agent and Broker Training and Testing Guidelines: Centers for Medicare & Medicaid Services
• CMS CY 2027 Agent and Broker Training and Testing Guidelines: Centers for Medicare & Medicaid Services
• Medicare.gov health-plan marketing rules: Medicare.gov

Frequently Asked Questions

Can Medicare agents cold call?

No. CMS generally prohibits unsolicited telephone solicitation, including robocalls, unsolicited texts, solicitation voicemails, and calls based only on a referral. Limited plan-business and existing-client provisions can apply in particular situations, but they are not a general cold-calling exception.

Can a Medicare agent call a referral?

Not solely because someone supplied the referral. The referred person should personally initiate contact or give the agent permission to contact them. Retain the record of that request before beginning outbound follow-up.

Is Permission to Contact the same as an SOA?

No. Permission to Contact addresses whether the agent may initiate contact. The Scope of Appointment identifies the MA or Part D product categories that may be discussed in a personal marketing appointment. A properly designed workflow can capture both, but it must satisfy each requirement.

Does a Medicare PTC form satisfy the TCPA?

Not automatically. TCPA consent is channel- and technology-specific. A generic PTC form may not supply the written agreement needed for covered automated, artificial-voice, prerecorded, or telemarketing communications. Use approved consent language for the communication method involved.

How long is Medicare Permission to Contact valid?

CMS generally recognizes a 12-month validity period for product scope documented in an SOA, Business Reply Card, or request for information. That is not an unlimited 12-month license to contact a person through every channel, about every product, or on behalf of every seller. Permission can end earlier through revocation or a more restrictive rule.

Does attending a Medicare event give an agent permission to call?

No. Event attendance alone is not permission to contact. A voluntary, properly documented request for follow-up can support contact within the requested purpose, subject to the applicable CMS, TCPA, Do-Not-Call, carrier, agency, and state rules.

Can an agent collect an SOA at a Medicare educational event?

Through September 30, 2026, use the CY 2026 event rules and do not collect SOAs at educational events. For CY 2027 marketing beginning October 1, 2026, CMS permits SOAs to be made available and collected at an educational event, while the educational presentation itself must remain educational.

Can Medicare agents send social-media direct messages?

Agents should not send an unsolicited direct social-media message. When a beneficiary initiates a private message or clearly requests contact, preserve that request, confirm the desired channel, and obtain the SOA before a personalized MA or Part D marketing appointment.

Does a website form count as Permission to Contact?

It can, depending on what the beneficiary affirmatively requested and what the retained record shows. A form that identifies the agent or agency, requested channel, number, Medicare-related purpose, and applicable disclosures is more useful than a form that only collects a phone number.

Do these CMS PTC rules apply to Medicare Supplement appointments?

The federal beneficiary-contact and SOA provisions discussed here principally address Medicare Advantage and Part D. A purely Medigap discussion has a different federal and state framework, although telephone, text, Do-Not-Call, carrier, agency, and state requirements can still apply.