ImplementationComplianceAlex Mariano5 min read
Compliance by design: consent, recordings and data security inside your agency CRM
Compliance that depends on memory fails on the busiest day of the year. Build it into the workflow instead.
Insurance agencies operate under several overlapping rulebooks: federal rules for telemarketing calls and texts, CMS requirements for Marketplace and Medicare, state insurance regulations and a growing set of data security laws. Most agencies handle them with training, good intentions and a folder of forms. That works until volume peaks, a key person leaves or an auditor asks for proof from three years ago.
Compliance by design means the CRM captures the evidence as a side effect of doing the work: consent is recorded where the lead is created, the application review is logged where the application is prepared, the recording is attached to the call, and access is limited by role automatically. This guide walks through the four areas where that matters most.
This article is a practical overview, not legal advice. Rules change and vary by state; review your processes with counsel, your carriers and your FMO.
1. Consent for calls and texts
Under the Telephone Consumer Protection Act, telemarketing calls and texts made with automated technology or prerecorded voices generally require the consumer's prior express written consent. In 2023 the FCC adopted a stricter "one-to-one" consent rule, but in January 2025 the Eleventh Circuit vacated it (Insurance Marketing Coalition v. FCC). The underlying requirement of prior express written consent for telemarketing remains in place, and consumers can revoke consent at any time through reasonable means.
What that means for the CRM:
- Store consent as data, not as a checkbox: the source, the date and time, the language shown to the consumer and the channels covered.
- Attach consent to the person, so it follows the lead when it becomes a client and when ownership changes.
- Honor opt-outs everywhere at once: a "stop" received on SMS should block marketing on every channel and campaign, and the block should be visible to every agent.
- Keep marketing and service separate: informational messages about an existing policy follow different rules from marketing, so tag them differently.
Messaging with consent and context is also a service advantage. Read: WhatsApp and SMS for US insurance agencies
2. ACA: consent and application review
CMS requires agents and brokers who help consumers with Marketplace applications to document the consumer's consent before providing assistance, and to document that the consumer or their authorized representative reviewed and confirmed the accuracy of the application information. That documentation must be retained for at least 10 years.
| Requirement | Design it into the workflow as |
|---|---|
| Consent before assistance | A consent step (signed form or recorded confirmation) that must be completed before the enrollment task can start |
| Application review | A review and confirmation step with the consumer, logged with date, method and the agent who assisted |
| 10-year retention | Documents and records stored on the client and policy, with a retention rule that prevents deletion |
| Income accuracy | The income estimate, its basis and the consumer's attestation recorded on the household |
3. Medicare: scope of appointment and recordings
Medicare Advantage and Part D marketing follows CMS rules that affect agents and third-party marketing organizations directly. A signed Scope of Appointment is required before a personal marketing appointment, and calls between third-party marketing organizations and beneficiaries must be recorded; CMS has clarified that this includes virtual connections such as video calls. The contract year 2027 final rule, published in April 2026, removed restrictions on the time and manner in which beneficiaries can talk with licensed agents, which the market reads as the end of the 48-hour waiting period for the Scope of Appointment.
- Link each Scope of Appointment to the beneficiary and the appointment, with the products discussed.
- Record calls from the start of the conversation and attach the recording to the client record, with a retention rule aligned with current CMS guidance and your carrier contracts.
- Use approved scripts and required disclaimers as templates, not as text each agent types.
- Confirm the current requirements with your carriers and FMO before every Annual Enrollment Period.
“The best compliance evidence is the one your team produces without noticing, because it is part of how the work gets done.”
4. Data security
Insurance agencies are licensees of state insurance departments, and a growing number of states have adopted the NAIC Insurance Data Security Model Law (#668). As of the NAIC's August 2025 brief, 28 of 56 jurisdictions had adopted it. Where it applies, it requires licensees, including agents and agencies, to maintain an information security program based on a risk assessment, to investigate cybersecurity events and to notify the insurance commissioner. Smaller licensees may qualify for exemptions depending on the state.
| Control | What it looks like in the CRM |
|---|---|
| Least-privilege access | Permissions by role and hierarchy; producers see their book, not the whole agency |
| No sensitive data in personal tools | Documents and conversations stored on the record, not in personal phones or email attachments |
| Offboarding | Access removed and open work reassigned the day someone leaves |
| Audit trail | Who viewed, changed or exported what, and when |
| Vendor diligence | Know where your CRM stores data and how it protects it |
A compliance-by-design checklist
- 01Every lead has a consent record with source, date and channels.
- 02Opt-outs block marketing across all channels immediately.
- 03ACA enrollments can't start without documented consent and end with a logged application review.
- 04Medicare appointments have a linked Scope of Appointment and a recording on the record.
- 05Signed documents live on the client or policy with a retention rule.
- 06Access is by role, and offboarding is a checklist, not a favor.
- 07Someone owns compliance operations and reviews exceptions weekly.
Ready when you are
Put the plan in motion this week.
No credit card, set up in days, and a team that speaks English, Portuguese and Spanish if you want help.
Sources
- U.S. Court of Appeals, Eleventh Circuit — Insurance Marketing Coalition v. FCC (2025) (opens in a new tab)
- FCC — Stop unwanted robocalls and texts (opens in a new tab)
- CMS — Consumer consent and application review requirements (FAQ) (opens in a new tab)
- CMS — Contract Year 2027 Medicare Advantage and Part D Final Rule (fact sheet) (opens in a new tab)
- NAIC — Insurance Data Security Model Law brief (August 2025) (opens in a new tab)
This article is for information only and reflects public information as of its publication date. It is not legal or tax advice. Confirm current rules with CMS, your state exchange and your carriers.
