Well, this shouldn’t come as a surprise to anyone due to the recent increase in marketing regulations imposed on TPMOs. Today the Centers for Medicare and Medicaid Services (“CMS”) issued its 2025 Medicare Advantage and Part D Final Rule where amongst other new rules, it issued heightened marketing rules that align with the FCC’s Second Report and Order requiring “one to one” prior express written consent to transfer personal data to marketing partners.

Specifically, CMS is codifying a provision prohibiting personal beneficiary data collected by Third Party Marketing Organizations (TPMOs), for marketing or enrolling a person into a Medicare Advantage or Part D plan, from being shared with another TPMO unless prior express written consent is given by the Medicare enrollee.

CMS points directly to the FCC’s recent one to one consent order stating: “We are codifying the regulation text in a way that is generally consistent with the one-to-one consent structure announced by the FCC in the Second Report and Order144 (FCC 23-107) in order to make it simple and less arduous for a TPMO to comply with both rules, when applicable. The FCC’s Order amends the definition of prior express written consent at 47 CFR 64.1200 for a person to be called or texted advertisements or telemarketing messages using an automatic telephone dialing system or an artificial or prerecorded voice by requiring an agreement, in writing, that bears the signature of the person called or texted that clearly and conspicuously authorizes no more than one identified seller.”

CMS emphasizes that TPMOs are selling and reselling beneficiary contact information to “skirt existing CMS rules that prohibit cold calling so they can aggressively market A and Part D plans. Beneficiaries are unaware that by placing a call or clicking on a generic-looking web-link they are unwittingly agreeing and providing consent for their personal contact information to be collected and sold to other entities for future marketing activities.”

As a result, CMS is requiring TPMOs to obtain prior express written consent from the Medicare enrollee and is implementing a “one-to-one consent structure where TPMOs must obtain prior express written consent through a clear and conspicuous disclosure for each TPMO that will be receiving the beneficiary’s data.” CMS points to the FTC’s guidance of “clear and conspicuous” and encourages TPMOs to rely on the FTC’s numerous examples and guides. These new provisions are designed to address the complaints received by CMS from beneficiaries regarding unwanted phone and email solicitations, the CMS states.

Importantly, CMS also further heightens its new final rule by requiring TPMOS to obtain prior express written consent EVEN when dialing manually:

“In addition, this rule will prevent the sharing of personal beneficiary data with another TPMO unless expressly authorized by the beneficiary, which means beneficiaries will not be called by TPMOs with whom they have not given permission to be called, even when the new FCC rule does not apply (i.e., a manually dialed phone call).”

So for those operating with the Medicare space, even if you adhere to the TCPA regulations while manually dialing, you must still exercise caution when manually dialing Medicare leads.

CMS also explains that when a beneficiary can be connected to another TPMO in real time, prior express written consent may not be necessary. “For example, a beneficiary may call a TPMO seeking to get information about Medicare plan options and that TPMO, in order to assist the beneficiary, may be able to transfer or connect that beneficiary to another TPMO, such as an agent or broker during the call to provide real time assistance to the beneficiary.”

CMS further adds that this new final rule includes sharing information with another legal entity that shares the same parent organization or has a contract to perform a downstream function of the organization.

The new rules go into effect on October 1, 2024 — TPMOs must have prior express written consent — regardless of whether they are dialing manually or not — to share a beneficiary’s personal data on or after October 1, 2024.