TCPA 2026: What Medicare Agencies Must Know Now
The FCC changed the rules while you were busy selling.
On April 11, 2025, new opt-out requirements took effect. The most complex requirement, a revoke-all rule that carries one opt-out across all your robocalls and robotexts, has been delayed twice and now takes effect January 31, 2027.
Combined with CMS's October 2024 consent rules for TPMOs, you're now operating under the strictest compliance regime in TCPA history.
The stakes: TCPA settlements average $6.6 million. Some exceed $38 million. And CMS can terminate your carrier relationships immediately for non-compliance.
Here's what changed in 2025, what's still coming, and how careCycle keeps you compliant automatically.
April 2025: Three Critical Changes
1. The 10-Day Window
You have 10 business days to process opt-outs. Down from 30.
However the request arrives: a reply text, a voicemail, an email.
Industry best practice? Immediate processing. The 10-day window is a ceiling, not a target.
2. "Any Reasonable Manner" Standard
Your systems must recognize diverse opt-out expressions. Not just "STOP."
Everything counts:
- "leave me alone"
- "don't text me"
- "remove me"
- "STOP CALLING"
Real cost: One Medicare agency kept texting after "STOP CALLING" (not their standard "STOP" keyword). Class action settled for $1.4 million.
3. One Confirmation Text
After an opt-out, you may send one text confirming it. Sent within five minutes, it's presumed to fall within the consumer's original consent.
No marketing. No persuasion. Just the confirmation.
January 2027: The Revoke-All Rule
The big one. Originally due April 11, 2026, it has been delayed twice and now takes effect January 31, 2027.
What It Means
A beneficiary texts "STOP" to your AEP renewal campaign.
Once revoke-all takes effect, that opt-out applies to:
- Welcome calls from retention
- Member care texts from service
- Every robocall and robotext. All departments. All systems.
Even if managed by different vendors with separate platforms.
Why It Keeps Getting Delayed
The FCC first pushed the date back a year after industry demonstrated the challenges below. In January 2026 it extended it again, to finish reviewing a related rulemaking before imposing compliance costs that may turn out to be unnecessary.
Multiple business units with separate calling systems. Third-party vendors requiring coordination. Technical complexity of real-time cross-channel propagation. Risk of blocking legitimate communications (fraud alerts, service notifications).
The Clarification Window
You can send one confirmatory text to clarify scope.
Example: "You've opted out of appointment reminders. To stop ALL communications, reply YES. To keep member care texts, do nothing."
Rules:
- Send within 5 minutes
- No marketing content
- No persuasion
- If no response: treat as universal opt-out
Get it wrong? Multi-million dollar liability.
What This Means for Your Agency
Most Medicare agencies operate with sales teams using one dialing system, member care using a different platform, marketing emails through a third vendor, and SMS campaigns through yet another service.
From January 31, 2027, a single opt-out must update all systems within 10 business days.
CMS Layer: One-to-One Consent for TPMOs
Effective October 1, 2024.
Any organization compensated for lead generation, marketing, or enrollment must obtain express written consent before sharing beneficiary data with another TPMO.
This applies even to related entities under the same FMO.
What Changed
Consent forms must list each TPMO individually. Separate unchecked checkboxes.
Hyperlinked lists of marketing partners? No longer compliant.
If you're purchasing leads: Verify consent documentation explicitly names your organization. Inherited consent from upstream partners equals catastrophic liability.
Two Games at Once: TCPA + CMS
TCPA (FCC) governs how you can call. Technology and timing.
CMS governs who you can call. Permissions and scope.
Both apply simultaneously to every Medicare call.
Key CMS Requirements Still in Force
Permission to Contact (PTC): Valid 12 months from signature.
Scope of Appointment: Still required. From October 1, 2026, the 48-hour wait is gone under the CY 2027 final rule, so it can be collected on the same call.
Call Recording: Sales and marketing calls must still be recorded. From October 1, 2026, retention drops from ten years to six: full audio for the first three, audio or transcript for years four through six. Enrollment records keep their existing requirements.
TCPA compliance alone doesn't cover you. You need both.
Recent Settlements: The Cost of Non-Compliance
National Grid: $38.5M
Citibank: $29.5M
Assurance IQ: $21.875M (shut down 2024)
Realogy/Coldwell Banker: $20M
QuoteWizard: $19M
American Income Life: $14M
Common threads across every case:
- Inadequate consent documentation
- Failed to scrub DNC registries
- Wrong number calls from poor data
- Continued calling after opt-outs
- Vicarious liability from vendors
Traditional insurance policies don't cover TCPA liabilities. You bear the risk directly.
Lead Generation: Your Biggest Exposure
The Bilek v. Federal Insurance decision: You're liable for your lead generators' TCPA violations.
You can't point to vendor contracts. The liability is yours.
Red Flags for Problematic Leads
Suspiciously low pricing ($5-10 vs. typical $50-150). Vendors refusing consent documentation. "Exclusive" leads sold to multiple buyers. Aged leads with stale consent.
If a lead seems too cheap, it's missing the consent quality that costs millions in settlements.
How careCycle Keeps You Compliant
Our platform was built with TCPA and CMS compliance as core infrastructure. More importantly, we're ready for the revoke-all rule because it's how we designed the system from day one.
Pre-Sale Suite
Inbound Pre-Screening:
- Real-time DNC scrubbing before every call
- Automatic time zone detection (8 AM to 9 PM local)
- Natural language opt-out recognition (beyond "STOP")
- Source tracking with consent verification
Outbound Pre-Qualification:
- Consent management with timestamped records
- IP addresses and geolocation data
- Reassigned Numbers Database integration
- Immediate opt-out processing (not 10 days, immediate)
Retention Suite
Welcome Calls & Post-Enrollment:
- CMS-compliant call recording (10-year retention)
- Verbal SOA captured on the call, stored ten years, filterable for audit
- Two-party consent notifications for all states
- PTC tracking with 12-month expiration alerts
Always-On Member Care:
- Universal opt-outs applied across all channels instantly
- Natural language processing for any opt-out expression
- State-specific rules engine (Florida 8 PM cutoff, Texas SMS consent, etc.)
- Immutable audit logs for litigation defense
Revenue Suite
AEP Renewals & Cross-Sell:
- List upload with automatic consent verification
- DNC scrubbing on every number before dialing
- Frequency caps preventing harassment
- Real-time compliance monitoring with human escalation
AI Voice Systems Done Right
The FCC ruled (February 2024): AI-generated voices require prior express written consent.
careCycle's AI assistants include explicit AI disclosure at the beginning of every call. Transparency builds trust. Meets regulatory requirements.
Ready for Revoke-All
careCycle's omni-channel compliance:
Single source of truth: All campaigns reference one unified contact preferences database.
Real-time propagation: Opt-out in any campaign instantly updates all others.
Channel-agnostic: Works across voice, SMS, and (with integrations) email.
Vendor coordination: API pushes opt-outs to your CRM, email platform, other systems automatically.
Audit trail: Immutable logs showing exactly when and how each opt-out was processed.
When revoke-all takes effect, careCycle customers will already be compliant.
Your Next Steps
- Audit your opt-out processing time. If it exceeds 10 days, you're accumulating violations at $500 to $1,500 per incident.
- Review your consent forms. If they don't list each TPMO individually with separate checkboxes, they're non-compliant.
- Test your keyword recognition. If your system only recognizes "STOP," you're violating April 2025 rules.
- Conduct vendor compliance audits. Request consent documentation from all lead sources. Test sample leads.
- Implement consent management technology. Excel spreadsheets won't protect you in court.
- Establish a TCPA Compliance Officer with real authority and budget.
Before January 31, 2027
- Map your communication infrastructure. Document every system, vendor, channel used to contact beneficiaries.
- Design cross-channel opt-out workflows. How will a text opt-out stop emails from your marketing vendor?
- Evaluate centralized consent platforms. Omni-channel requirement demands unified systems, not disconnected tools.
- Begin vendor negotiations. Third-party platforms must receive and process opt-outs from your central system.
The Bottom Line
Average TCPA settlements ($6.6M) exceed the annual revenue of many Medicare agencies. A single class action can be terminal.
The agencies dominating Medicare marketing over the next decade are building compliance infrastructure today. Not waiting for the class action complaint.
careCycle's compliance infrastructure is built, tested, and protecting agencies across all campaign types.
See It in Action
Book a 15-minute demo to see how careCycle handles:
- Natural language opt-out recognition
- Real-time DNC scrubbing
- Automated consent management
- State-specific compliance that adjusts automatically
Last Updated: September 27, 2026
This post is for informational purposes only and does not constitute legal advice. Consult with specialized TCPA counsel for guidance specific to your situation.