Medicare permission to contact: who you may dial during AEP
AEP runs October 15 to December 7, and it is the heaviest calling of a Medicare agent’s year. Every rule on this page comes from the regulation text on eCFR, read today, with the paragraph number beside it, because the forms, the scripts and the forum answers you will find about permission to contact are often a rule or two out of date.
Medicare permission to contact rules, from 42 CFR 422.2264
The rule is written for Medicare Advantage organizations, and it reaches agents and brokers through their contracts; the Part D rule, 42 CFR 423.2264, repeats it for drug plans. Read on eCFR, current to October 26, 2026, last amended April 6, 2026:
| Contact | Allowed? | Where the rule says so |
|---|---|---|
| Cold calls, robocalls, texts or voicemail to a beneficiary who did not ask | No | 422.2264(a)(2)(iv) |
| Calls based on referrals | No | 422.2264(a)(2)(iv)(A) |
| Calls to people who attended a sales event | Only with their express permission | 422.2264(a)(2)(iv)(C) |
| Calls to confirm someone received your mailer | No | 422.2264(a)(2)(iv)(D) |
| Direct messages on social media, unsolicited | No | 422.2264(a)(2)(iii) |
| Returning a call, or calling a completed business reply card | Yes, not unsolicited | 422.2264(a)(3) |
| Direct mail and email (with an opt-out) | Yes | 422.2264(a)(1) |
| Calling your own clients about auto or home policies | Yes, but not to generate Medicare leads | 422.2264(b)(1)(iv)–(v) |
42 CFR 422.2264 as amended at 91 FR 17583 (April 6, 2026), read on eCFR October 28, 2026. Your carrier contract can be stricter.
So the permitted list is short: people who sent a reply card or filled in a form asking for contact, people who called you, people who gave express permission at an event, and your own book. A purchased “T65 list” or an aged Medicare list without the permission record behind each name is a cold-call list.
When does Medicare permission to contact expire?
Two clocks run at once, and agents mix them up:
- CMS’s scope clock, 12 months. A Scope of Appointment, business reply card or request for information is “valid for 12 months following the date of beneficiary’s signature date or the date of the beneficiary’s initial request for information” (422.2264(c)(3)(iii)(A)). It defines what you may market in the appointment; a second product line needs its own Scope of Appointment.
- The Do Not Call clock, 3 months. If the number is on the National Do Not Call Registry, an inquiry creates an established business relationship for 3 months and a purchase for 18 months (47 CFR 64.1200(f); the FTC’s rule at 16 CFR 310.2 counts the same windows as 90 and 540 days). Past that, a registered number needs “a signed, written agreement” that “includes the telephone number to which the calls may be placed” (64.1200(c)(2)(ii)).
On the call: recording, the disclaimer, calling hours
- Record the whole call and keep it 6 years. Third-party marketing organizations must record “all marketing and sales calls” in their entirety, the first 3 years in audio (42 CFR 422.2274(g)(2)(ii)).
- Say the TPMO disclaimer before benefits. A TPMO that sells for more than one MA organization must convey it verbally “during sales calls prior to the discussion of any benefits”; the wording is standardized (42 CFR 422.2267(e)(41)).
- Call between 8 a.m. to 9 p.m. at the beneficiary’s location, the federal window for telephone solicitation (64.1200(c)(1)); many states set narrower hours.
Where a dialer fits, and where it does not
A dialer cannot tell you whether a lead gave permission; that record comes from the reply card, the form or the call log, and your lead vendor should hand it over with the file. What a dialer can do is dial only the list you loaded, record each answered call, and stop every agent from calling a number the moment someone asks.
DialSheet does those three: answered calls are recorded into your own Twilio account (played back and transcribed in the app on Pro, $29/month per seat), and a number on your account’s Do Not Call list is blocked for every agent. Because seats are month to month, 10 agents for the 2 billing months of AEP cost $580 in software, and you remove them in December. Calls run at ~$0.014/min on your Twilio. It does not scrub against the national registry for you, and does not store your permission records. Its calling-hours switch skips leads outside a fixed 8am to 6pm by area code; it does not apply your state’s own calling-hour law.
For the dialer comparison itself, see the best auto dialer for insurance agents, and for life and final expense, the best dialer for life insurance agents. The wider rankings are the best power dialer software and the cheapest power dialers.
Who runs on it
An independent insurance agency and a nine-rep calling floor in our published case studies.
Medicare permission to contact questions
What is Medicare permission to contact?
It is the beneficiary's own request to hear from you: a business reply card, a web form, a call they made, or an express request at a sales event. Under 42 CFR 422.2264(a)(3), a call is not unsolicited when the beneficiary consents or initiates contact, and CMS gives "calling an individual who has completed a business reply card requesting contact" as its example. Without it, the same rule bars telephone solicitation of Medicare beneficiaries, including calls based on referrals. Read on eCFR, current to October 26, 2026. This is not legal advice.
When does Medicare permission to contact expire?
The rule ties a 12-month clock to scope: a Scope of Appointment, business reply card or request for information "is valid for 12 months following the date of beneficiary's signature date or the date of the beneficiary's initial request for information" (42 CFR 422.2264(c)(3)(iii)(A), current to October 26, 2026). Separately, if the number is on the National Do Not Call Registry, the FCC's inquiry exemption lasts only 3 months (47 CFR 64.1200(f)); after that you need a signed written agreement that names the number. Check your carrier's own rule, which can be stricter.
Can you cold call for Medicare?
No. 42 CFR 422.2264(a)(2)(iv) says MA organizations may not "use telephone solicitation (that is, cold calling), robocalls, text messages, or voicemail messages" with beneficiaries who have not asked to be contacted, and lists calls based on referrals, calls to people who attended a sales event without giving express permission, and calls to confirm receipt of mailed information. The Part D rule at 423.2264 says the same. Agents may call their own clients about other lines they sell, such as auto or home, but may not use those calls to generate Medicare leads.
Do Medicare sales calls have to be recorded?
For third-party marketing organizations, yes. 42 CFR 422.2274(g)(2)(ii) requires that "all marketing and sales calls" be recorded and retained in their entirety for at least 6 years, the first 3 in audio format. Your FMO or carrier contract tells you whether you sit under it. DialSheet records answered calls into your own Twilio account; keeping them for 6 years, and exporting them before you close an account, is your job.
Can I leave a voicemail for a Medicare lead?
Not on an unsolicited call: 422.2264(a)(2)(iv) bars voicemail messages alongside cold calls, robocalls and texts. On a lead who asked to be contacted, a voicemail is part of returning their request; keep the message short and plain, and do not drop a prerecorded marketing message without checking your carrier's rule and the TCPA's consent requirement for prerecorded calls. This is orientation, not legal advice.
What dialer can a Medicare agent use during AEP?
Any dialer that only dials the permitted list you load, records the call and lets you stop calling a number the moment someone asks. DialSheet is free for one person, with a list of up to 500 leads and 500 calls a month, then $29/month per seat month to month on your own Twilio at ~$0.014/min; 10 agents for the 2 billing months of AEP cost $580 in software with no annual contract. It records answered calls into your Twilio account and blocks numbers on your Do Not Call list for every agent. It does not check whether a lead gave permission; that record comes from your lead source.
Regulation text read on eCFR on October 28, 2026 (current to October 26, 2026): 42 CFR 422.2264 and 423.2264 as amended April 6, 2026, 422.2274, 422.2267, 47 CFR 64.1200 and 16 CFR 310.2. AEP dates from medicare.gov. CMS marketing rules change by annual rulemaking and carriers add their own; confirm with your FMO or compliance team. This page is orientation, not legal advice, and DialSheet does not make a call compliant. We build DialSheet.