Guidelines for Sharing Personal Beneficiary Data with Other TPMOs

CMS required TPMOs to obtain prior express written consent from the beneficiary before sharing their personal information. This affects Medicare insurance lead sharing, but how?

Here are the details you need to know.

What Is a TPMO in Medicare?

CMS defines TPMOs as “organizations that are compensated to perform lead generation, marketing, sales, and enrollment related functions as a part of the chain of enrollment.”

Are Insurance Agents Considered TPMOs?

Yes. According to their definition, CMS considers all lead generation organizations, agencies, and independent insurance agents and brokers to be TPMOs. Therefore, field marketing organizations, insurance agents, and brokers must adhere to all CMS’ TPMO rules and guidelines.

What Qualifies as Personal Beneficiary Data?

Personal beneficiary data includes some or all this information:

• Name
• Address
• Phone number and other contact information
• Any other information given by the beneficiary for the purpose of finding an appropriate MA or Part D plan

When in doubt as to whether data is considered personal, be as cautious as possible and assume it is.

Obtaining Prior Express Written Consent

CMS’ rules require all TPMOs to obtain prior expressed written consent from the beneficiary before sharing their personal data. The consent must involve a clear and easily visible disclosure listing each TPMO receiving the data.

Additionally, the beneficiary must have the option to consent or reject data sharing with each individually specified TPMO.

Affirmative action is required for consent. The default is “no sharing” unless the beneficiary actively agrees to share data with each TPMO.

TPMOs may obtain consent through various written forms besides a signed hard copy. This includes a website interface, email, or text message.

CMS Informed Consent Requirements FAQs

Here are some frequently asked questions about the Medicare data sharing TPMO regulation.

Why has CMS imposed this rule?

CMS wants to curtail activities by bad actors in the industry, stating: “Some TPMOs have been selling and reselling personal beneficiary data, which can undermine existing rules that prohibit cold calling people enrolled in Medicare and result in other aggressive marketing tactics for Medicare Advantage and Part D plans. Individuals may be unaware that by placing a call or clicking on a generic-looking web link, they are unwittingly agreeing and providing consent for their personal beneficiary data to be collected and sold to other entities for future marketing activities.”

Are there any circumstances when I don’t need to obtain prior express written consent?

CMS states that prior express written consent may not be necessary in situations of real-time assistance and phone transfers. A beneficiary may call a TPMO seeking to get information about Medicare and that TPMO.

To assist the beneficiary, the TPMO can connect them to another TPMO, like an agent, during the call. A verbal agreement from the beneficiary during the live call is sufficient.

We suggest that agents note any permission given. This is likely already done due to call recording rules. Alternatively, consent can be obtained through email.

If the agent cannot assist the beneficiary through a live transfer, then that agent will need to get written consent. This is needed before sharing the data with another agent for a callback.

CMS also clarifies that “the definition of TPMO does not apply to MA organizations or Part D sponsors, and therefore TPMOs may share personal beneficiary data with those entities without acquiring direct consent from the beneficiary under this rule.”

Any agent or entity sharing personal beneficiary data would still need to ensure they are complying with HIPAA privacy rules.

Do I have to get permission for each TPMO I’m sharing data with?

Yes, a beneficiary must have the option to consent or reject data sharing with each individual TPMO. The disclaimer must specify each TPMO by name and get permission for each in a one-to-one consent structure.

Can I share personal beneficiary data with another independent agent?

No, an independent agent cannot share personal beneficiary data with another independent agent — even if both are affiliated with the same FMO — unless the independent agent obtains prior express written consent before sharing.

The first independent agent must obtain prior express consent from the beneficiary. This allows them to share their personal data with a specifically identified independent agent. A generic “another agent” in the disclaimer is not sufficient.

Do I still need to obtain consent even when I’m manually dialing phone numbers?

Yes, even if you follow the TCPA regulations when dialing by hand, you still need to to get prior express written consent first.

Is there a model disclaimer I can use?

CMS points to the Federal Trade Commission (FTC) for examples of “clear and conspicuous” disclaimers regarding obtaining consent. See the FTC’s .com Disclosures booklet for an in-depth discussion on disclaimers and examples. You can also read more in this section of the Federal Register.

Do I have to get permission even if we’re downlines of the same upstream entity?

Yes, even if TPMOs are connected, sharing the beneficiary’s data still requires prior express written consent. This includse cases like a shared parent company, contracts for services, or independent agents under the same FMO.

Will I still be able to buy leads from my FMO or other organizations?

It depends on the FMO or lead generator organization and the type of lead. If the FMO or other organization has taken the right steps, they must get written consent. This is needed for MA and PDP leads before selling the lead.

In that instance, then yes, you will still be able to buy compliant leads. The Final Rule only applies to buying MA and PDP leads. The same rules do not apply to other kinds of leads, like Medicare Supplement and final expense.

How long do I have to store the written consent?

Similarly to the Scope of Appointment, store prior express written consent for 10 additional years after the selling year.

How long is the consent good for?

Like the Medicare Permission to Contact form, the prior express written consent is good for 12 months. It remains valid until a client says they do not want further contact. After that, the TPMO would need to obtain renewed consent.

Lead sharing and receiving is important for agents selling any type of health insurance, including Medicare plans. Proceed compliantly with Medicare lead sharing by following these guidelines and obtaining prior express written consent.

Ritter takes compliance seriously, and we’re dedicated to helping our agents follow all the necessary CMS guidelines and regulations. Register with us to stay up to date on rulings, receive support, and get access to compliant sales technology.