The Guardrails Came Down.
The Enforcement Didn’t.
CMS eliminated the 48-hour SOA waiting period and key marketing restrictions while OIG released its first MA compliance guidance in 30 years — naming marketing and enrollment as a priority risk area.
The regulations were a layer of protection between the legal exposure and the conduct. Their removal does not reduce the legal exposure.
On April 2, 2026, CMS finalized its contract year 2027 rule and eliminated several of the Medicare Advantage marketing guardrails that the previous administration had installed in direct response to documented predatory enrollment practices.
What did not happen on April 2, 2026: OIG scaled back its Medicare Advantage enforcement posture. In February 2026, OIG released its first major MA-specific compliance program guidance since 1999, explicitly naming marketing and enrollment as a priority risk area. In December 2024, HHS-OIG issued a Special Fraud Alert on suspect payments in marketing arrangements involving MA plans. The Department of Justice reported record False Claims Act recoveries of $6.8 billion in fiscal year 2025 — driven substantially by Medicare Advantage cases.
The regulatory environment and the enforcement environment are now moving in opposite directions. Plans that interpret CMS’s marketing rollbacks as a reduction in compliance risk are misreading the situation. The guardrails were regulatory. The enforcement is statutory. They operate on different tracks.
The CY2027 rule changed CMS’s regulatory layer. It did not change the legal layer beneath it.
What the CY2027 final rule actually changed — and what it didn’t
The CY2027 Medicare Advantage and Part D final rule, published in the Federal Register on April 6, 2026, and effective June 1, 2026 — with marketing provisions applicable to the annual enrollment period beginning October 1, 2026 — rolled back several of the consumer protection measures CMS introduced under the prior administration to address documented problems in MA marketing and enrollment.
The specific changes include elimination of the 48-hour waiting period between scope of appointment form completion and personal marketing appointments; elimination of the 12-hour prohibition on transitioning from educational events to marketing events at the same location; express permission for SOA form collection at educational events; and reduction of call recording retention requirements from ten years to six.
These guardrails were introduced in the first place because CMS and OIG documented that the boundary between education and marketing was being systematically exploited: agents collecting SOA forms at events advertised as educational, immediate enrollment discussions after beneficiaries completed forms without being told what they were signing, and steering arrangements that rewarded agents for volume enrollment rather than plan fit.
What the rule did not do is change the underlying legal standard for those practices. The Anti-Kickback Statute and the False Claims Act apply to MA marketing and enrollment arrangements independently of CMS’s regulatory guardrails. The OIG fraud alert issued in December 2024 targeted precisely the kinds of arrangements that predated the Biden-era guardrails, persisted through them, and will persist after they are removed.
The regulations were a layer of protection between the legal exposure and the conduct. Their removal does not reduce the legal exposure.
$6.8B in FCA recoveries. OIG’s first MA guidance in 30 years. The enforcement posture didn’t change on April 2.
$6.8B — record FCA recoveries in FY2025
The Department of Justice reported $6.8 billion in False Claims Act recoveries in fiscal year 2025, driven substantially by Medicare Advantage cases. The year opened with a $556 million settlement with Kaiser Permanente centered on MA coding practices. A 2025 complaint alleged enrollment steering arrangements involving Aetna, Anthem, and Humana — compensation tied to enrollment volume and enrollee health status, independent of plan fit.
First dedicated MA compliance guidance since 1999
OIG’s February 2026 Medicare Advantage Industry Segment-Specific Compliance Program Guidance is the first dedicated MA ICPG in nearly 30 years. It explicitly names marketing and enrollment as a high-priority risk area. Problematic arrangements identified include payments contingent on enrollment volume or enrollee health status, remuneration to enrollees, and incentive payments structured to steer beneficiaries to plans regardless of healthcare needs.
Special Fraud Alert: suspect payments in MA marketing
In December 2024, HHS-OIG issued a Special Fraud Alert specifically targeting suspect payment arrangements in marketing relationships between MA plans, agents, brokers, and third-party marketing organizations. The alert named the same practices — volume-based compensation, health-status-contingent payments, steering arrangements — that the Biden-era regulatory guardrails were designed to restrict. The enforcement signal predates the regulatory rollback.
FDR governance: OIG’s expectations didn’t change with the rule
OIG’s ICPG updates expectations for how MA plans govern relationships with agents, brokers, and third-party marketing organizations — FDRs in CMS’s contract framework. Plans are expected to verify that compensation structures are not designed to generate enrollment volume independent of plan fit, and that contracted entities are not using educational event formats to conduct undisclosed marketing solicitations. These are governance expectations, not regulatory minimums that changed on April 2.
The rescinded UM health equity requirement: OCR exposure didn’t leave with the regulation
CMS rescinded the requirement for plans to conduct and publicly report an annual health equity analysis of utilization management policies. OCR’s authority to investigate discriminatory UM practices is not contingent on CMS’s regulatory mandate. Plans that discontinue health equity UM analysis because the CMS requirement is gone have removed an internal monitoring mechanism that identified OCR exposure. The analysis was a compliance tool as much as a regulatory requirement.
Sources: DOJ FCA statistics FY2025; OIG MA ICPG (February 2026); OIG Special Fraud Alert (December 2024); CMS CY2027 Final Rule Fact Sheet
Three things compliance and governance leaders must now do
The CY2027 marketing rule changes create a specific compliance governance obligation that many plans will get wrong: treating the rollbacks as compliance relief rather than as a risk reallocation. The regulatory layer that provided a specific audit citation basis for certain enrollment practices has been reduced. The legal and enforcement exposure has not been reduced. Plans must now maintain appropriate guardrails through internal governance.
Review marketing and FDR compensation structures before October 2026
The marketing changes take effect for the annual enrollment period beginning October 1, 2026. That is the deadline by which plans must have new marketing workflows active. It is also the deadline by which plans should have reviewed their agent and broker compensation structures for compliance with the Anti-Kickback Statute and OIG’s February 2026 guidance. If any compensation arrangement rewards enrollment volume, ties payments to enrollee health status, or creates financial incentives for steering independent of plan fit, those arrangements carry FCA exposure that the regulatory rollback did not change.
Update FDR oversight protocols to fill the governance gap
The 48-hour SOA waiting period and the educational-to-marketing transition rules were audit-visible evidence that plans were controlling the conduct of their downstream marketing relationships. Now that those requirements are gone, plans lose the automatic paper trail those rules generated. FDR oversight protocols must explicitly address what replaced those requirements: how does the plan verify that educational events are not functioning as undisclosed marketing solicitations, and how does it document that verification? The OIG guidance’s expectations for FDR marketing governance did not change when CMS’s regulatory requirements did.
Treat the rescinded health equity UM analysis as a compliance gap, not a regulatory relief
CMS rescinded the annual health equity analysis of UM policies. Plans that discontinue that analysis because the CMS requirement is gone have removed an internal monitoring mechanism that identified OCR exposure. OCR’s civil rights enforcement authority is not contingent on CMS’s regulatory mandate. Plans should assess whether a modified internal health equity UM analysis — even if no longer publicly reported — is necessary to maintain adequate compliance monitoring under OCR standards.
The CY2027 rule’s marketing and communications changes are an instruction to update workflows and documentation for October 2026. They are not an instruction to lower the compliance posture of the plan’s marketing governance program. Plans that read them as relief will discover the difference when the next OIG audit, FCA complaint, or CMS program audit arrives.
Plans that interpret CMS’s marketing rollbacks as a reduction in compliance risk are misreading the situation. The guardrails were regulatory. The enforcement is statutory. They operate on different tracks.
PCOOB Weekly — May 29, 2026Why this matters — by function
Regulatory deregulation is not enforcement deregulation
The eliminated guardrails provided specific CMS audit citation points. Their removal means CMS loses a regulatory basis for citations — not that OIG or DOJ lost a legal basis for enforcement. Compliance programs must fill the governance gap with internal controls.
AKS and FCA exposure persists independent of CMS rule changes
Anti-Kickback Statute and False Claims Act liability for improper enrollment arrangements exist independently of CMS’s marketing regulations. Volume-based compensation and steering arrangements that were legally problematic before the rollback remain legally problematic after it.
October 1 is a workflow deadline, not a compliance holiday
Marketing changes take effect for AEP beginning October 1, 2026. Plans must update SOA workflows, agent event procedures, and call recording retention. They must simultaneously ensure those updated workflows maintain adequate documentation of educational-to-marketing event governance.
Third-party marketing governance gap requires deliberate replacement
The SOA and event transition rules were audit-visible evidence of FDR oversight. Their removal eliminates a paper trail. FDR oversight protocols must explicitly define what replaced those requirements in the plan’s governance documentation — or carry unexplained gaps when CMS auditors arrive.
OCR exposure didn’t leave with the health equity UM reporting requirement
Plans discontinuing health equity UM analysis because CMS no longer requires it have removed a monitoring mechanism for OCR exposure. OCR’s civil rights jurisdiction is independent of CMS’s regulatory mandate. The internal analysis that informed the public report still has compliance value.
The enforcement environment escalated as the regulatory environment loosened
Record FCA recoveries, a new OIG Special Fraud Alert, and the first dedicated MA compliance guidance in 30 years — all released within the same window as the CY2027 marketing rollbacks. Executive leaders should understand that these tracks are independent and moving in opposite directions.
Questions leaders should be asking now
Does our agent and broker compensation structure — including any third-party marketing organization arrangements — comply with the Anti-Kickback Statute independent of CMS’s regulatory requirements?
Now that the 48-hour SOA waiting period is eliminated, what internal process ensures that beneficiaries attending educational events are not immediately solicited for enrollment before they understand what they are agreeing to?
How does our FDR oversight program document verification that contracted agents and brokers are conducting educational events consistent with their designation — not as undisclosed marketing solicitations?
Has our compliance team read OIG’s February 2026 MA compliance program guidance? Have we assessed our current marketing and enrollment arrangements against the specific risk areas it names?
If we discontinue the annual health equity UM analysis because CMS no longer requires it, what replaces it as our internal mechanism for identifying OCR compliance exposure?
Are we treating the October 1, 2026 marketing change effective date as a workflow update deadline or as a governance review deadline? What is the difference in our current plan?
- CMS’s CY2027 final rule eliminated the 48-hour SOA waiting period, the 12-hour educational-to-marketing transition prohibition, and reduced call recording retention from ten years to six. Marketing provisions are effective October 1, 2026.
- OIG’s February 2026 MA compliance program guidance — the first in nearly 30 years — named marketing and enrollment as a high-priority risk area, with specific attention to volume-based compensation and steering arrangements.
- DOJ reported $6.8 billion in FCA recoveries in FY2025, substantially driven by Medicare Advantage. The December 2024 HHS-OIG Special Fraud Alert flagged suspect payment arrangements in MA marketing relationships.
- The regulatory layer changed. The Anti-Kickback Statute, the False Claims Act, and CMS’s general sanctioning authority did not. Plans that treat deregulation as reduced enforcement exposure are misreading the risk environment.
- Plans must deliberately replace the governance documentation that eliminated regulatory requirements previously generated — particularly for FDR marketing oversight and health equity UM monitoring.
Sources
-
1
CMS — Contract Year 2027 Medicare Advantage and Part D Final Rule Fact Sheet Confirms: 48-hour SOA waiting period eliminated, 12-hour transition prohibition eliminated, SOA forms permitted at educational events, call recording retention reduced 10→6 years, UM health equity analysis requirement rescinded. Effective June 1, 2026; marketing provisions October 1, 2026. Tier 1.
-
2
Federal Register — CY2027 Final Rule (April 6, 2026) Full regulatory text of CY2027 policy and technical changes. Tier 1.
-
3
OIG — Medicare Advantage Industry Segment-Specific Compliance Program Guidance (February 2026) Confirms: Marketing and enrollment as priority risk area; problematic arrangements including volume-based compensation, health-status-contingent payments, steering; FDR oversight expectations. First dedicated MA ICPG since 1999. Tier 1.
-
4
HHS-OIG — Special Fraud Alert: Suspect Payments in Marketing Arrangements Related to Medicare Advantage and Providers (December 2024) Confirms: Flagged suspect payment arrangements in MA marketing; volume-based and health-status-contingent compensation named as enforcement priority. Tier 1.
-
5
DOJ — False Claims Act statistics FY2025 Confirms: $6.8 billion in FCA recoveries in FY2025, Medicare Advantage a central driver; $556M Kaiser Permanente MA settlement; Aetna, Anthem, Humana enrollment steering complaint. Tier 1.