A compliance-first Medicare agency website shows the required TPMO disclaimer where visitors actually see it, collects only the data the next step needs, records consent before any call or text, and never uses the Medicare name to suggest government endorsement. Have your carriers, FMO and compliance team review it, because CMS updates its rules every year.
A Medicare agency website is not a normal lead generation site. Your visitors are making a decision about doctors, prescriptions and monthly costs, often with an adult child reading over their shoulder. Your carriers expect every page to follow federal marketing rules. And a single misleading headline can create a complaint that follows your agency for years.
That is why the safest approach is to treat compliance as part of the structure. Disclaimers, consent and plain language get designed in from the start, instead of being pasted into a footer after launch. This guide walks through what that means for independent agents, brokers and agencies that work as third-party marketing organizations (TPMOs), meaning any agent, broker or entity that markets or sells Medicare Advantage or Part D plans on behalf of a plan.
This is general information, not legal advice. CMS revises its marketing rules regularly, so confirm current requirements with your carriers, your FMO and your compliance team before you publish.
Why a Medicare agency website follows different rules
Most service businesses can say almost anything on their site as long as it is true. A Medicare insurance agent website works inside a framework written by the Centers for Medicare and Medicaid Services (CMS), and your carrier contracts usually pass those obligations down to you.
Three things set it apart:
- The audience is protected. Rules exist specifically to stop pressure, confusion and misuse of personal information among people on Medicare.
- The calendar matters. The Annual Enrollment Period runs from October 15 to December 7, and what you can solicit, and when, changes around it.
- Carriers review your work. Many carriers and FMOs ask to see web pages, scripts and ads before they go live, and they can end a contract over violations.
On a Medicare agency website, trust is the conversion strategy: a visitor who feels pressured leaves, and a visitor who feels informed calls.
The rules that shape the site
For Medicare Advantage (Part C) and Part D, the core requirements sit in 42 CFR Part 422, Subpart V, with matching rules for Part D in Part 423. CMS explains how it applies them in the Medicare Communications and Marketing Guidelines, usually called the MCMG, which it updates as rules change.
The most useful idea in that framework is the difference between communications and marketing. Communications are general activities and materials aimed at beneficiaries. Marketing is a narrower category: content meant to draw attention to a plan or influence enrollment, such as benefits, premiums or cost sharing. Once a page crosses into marketing, stricter content and review rules apply.
In practice, that gives you two kinds of pages. Educational pages explain how Medicare works and can stay general. Plan-specific pages that mention benefits or costs need closer review, accurate sourcing and tight control over who can edit them.
Medicare supplement (Medigap) products follow different rules, mostly at the state level. If you sell both, keep the two clearly separated on the site so each set of pages follows the right rules.
The TPMO disclaimer on your website
The requirement agents ask about most is the TPMO disclaimer, set out in 42 CFR 422.2267(e)(41) and 423.2267(e)(41). If you market plans as a TPMO, your website has to display it prominently. In general terms, the disclaimer tells visitors that you do not offer every plan available in their area, states how many organizations and plans you currently represent, and directs them to Medicare.gov, 1-800-MEDICARE or their local State Health Insurance Assistance Program (SHIP) for information on all of their options.
Use the exact wording CMS and your carriers currently require, and keep the plan and organization counts accurate as your contracts change. A TPMO disclaimer website setup that shows outdated numbers is a compliance problem, even if the wording is right.
| Area | What it means on the site | Where it shows up |
|---|---|---|
| TPMO disclaimer | Required text, current plan and organization counts | Visible on the site, near quote and contact points |
| Consent to contact | Clear opt-in before any call, text or email | Every form and chat entry point |
| Scope of appointment | Documented before a sales appointment | Booking flow and confirmation steps |
| Medicare name and claims | No implied endorsement, no unsupported superlatives | Headlines, logos, ads, page titles |
| Data handling | Minimal fields, encrypted transfer, clear privacy policy | Forms, CRM, analytics, chatbots |
| Accessibility | Readable type, contrast, keyboard and screen reader support | Every page and form |
The cleanest way to keep counts current is to store the disclaimer in one place in the site and reuse it everywhere, so a single edit updates every page.
Forms, calls and consent
Most compliance risk on a Medicare broker website lives in the moment a visitor hands over contact details. CMS guidance to beneficiaries makes the same point from the other side: plans and agents should not ask for personal information just to give a quote, and they should not call people who have not asked to be contacted.
- Ask for less. A name, a phone number or email, a ZIP code and a preferred time are usually enough to schedule a conversation. Leave Medicare numbers, Social Security numbers and health history out of web forms.
- Make consent explicit. Use an unchecked box with plain wording that says who will contact the visitor, how and about what. Store the time, page and wording that were shown with each submission.
- Respect TCPA rules for calls and texts. The Telephone Consumer Protection Act requires prior consent for many marketing calls and texts. The FCC’s one-to-one consent rule was challenged in court and did not take effect as written, so ask your counsel what standard your forms should meet today.
- Plan for scope of appointment. CMS requires the scope of a sales appointment to be agreed and documented ahead of time, generally with a waiting period. A booking page can collect it, but the timing rules still apply.
- Do not resell or share leads casually. Recent CMS rules limit how TPMOs share beneficiary data with other TPMOs without the person’s prior express written consent.
- Remember call recording. TPMOs must record marketing, sales and enrollment calls. If your site promotes a phone number, make sure the line behind it records and retains calls the way your carriers require.
Treat the form like a medical intake desk, even when HIPAA does not strictly apply to your agency: HTTPS everywhere, no sensitive data in URLs or analytics events, access limited to the people who need it, and vendors that will sign the agreements your compliance team asks for.
Medicare name, logos and claims
Federal law and CMS rules prohibit using the Medicare name, the CMS logo or similar symbols in a way that suggests the government sponsors or endorses you. That affects more than the logo file.
- Avoid business names, domains and headlines that read like an official Medicare office.
- Do not claim to be recommended or endorsed by Medicare or CMS.
- Skip unsupported superlatives such as “the best plan” or “the lowest premiums” unless your carrier approves a sourced claim.
- Keep plan names, benefits and costs exactly as the carrier publishes them for the current year.
If a headline could make a visitor think they reached Medicare itself, rewrite it before a carrier or a complaint forces you to.
Senior-friendly design, accessibility and privacy
Compliance protects the agency. Design decides whether a visitor actually picks up the phone. For an older audience, that usually means:
- Large, high-contrast type and generous spacing that still works on a phone.
- One clear next step per page, such as calling, booking a review or asking a question.
- A visible phone number, licensed states and a real office address.
- Short pages written in plain language, with Medicare terms explained the first time they appear.
- Accessibility built to the Web Content Accessibility Guidelines (WCAG), including keyboard navigation, form labels and text alternatives for images.
- A privacy policy that matches what the site actually does with data, including analytics, chat and any third-party tools.
These decisions belong in development, not in a plugin added later. When we build custom and WordPress websites for regulated businesses, the disclaimer, the forms and the editing permissions are planned before design starts. If you are still choosing a platform, our comparison of a custom website vs WordPress walks through the trade-offs.
Being found on Google and in AI answers
Beneficiaries and their families search for plain questions, such as when they can change plans or what a Medicare Advantage plan covers. Clear educational pages that answer those questions, with honest headings and structured data, help both search engines and AI assistants understand and cite your site.
Keep the same rules in place for search content. An educational article still cannot imply endorsement, and if it starts comparing benefits or premiums it may become marketing. Our approach to SEO, AEO and GEO for search and AI visibility fits well here, because it rewards clear answers over aggressive claims. If you add an assistant, review its scripts the same way you review your pages; chatbots and AI agents should hand off to a licensed agent rather than discuss specific plans on their own.
A compliance-first build checklist
- Confirm your status. Check with your carriers and FMO whether you operate as a TPMO and which of their review rules apply to your website.
- Map the pages. Separate educational content, plan-specific content and Medigap content, and decide who can edit each type.
- Place the disclaimer. Build the TPMO disclaimer as one reusable block with current counts, visible where visitors request help.
- Design the consent path. Minimal fields, explicit opt-in, stored consent records and a booking flow that supports scope of appointment.
- Audit the claims. Remove implied endorsement, unsupported superlatives and outdated plan details.
- Test with real users. Check readability, contrast, keyboard use and phone layouts with the people you actually serve.
- Schedule reviews. Revisit the site before each enrollment season, because CMS rules and your contracts change every year.
If you want a second set of eyes on your plan, a Blueprint Briefing is a short conversation about what your website has to produce and what a compliance-first build would involve.
Medicare agency website: FAQ
Does my Medicare agency website need the TPMO disclaimer?
If you market Medicare Advantage or Part D plans as a third-party marketing organization, CMS rules require the TPMO disclaimer on your website. Independent agents and brokers usually fall into that group. Confirm your status and the current wording with your carriers and FMO.
What does the TPMO disclaimer have to say?
In general, it says you do not offer every plan in the area, states how many organizations and plans you represent, and points visitors to Medicare.gov, 1-800-MEDICARE or their local SHIP. Use the exact text CMS and your carriers currently require.
Can I use the Medicare logo on my website?
Using the Medicare name or CMS logo in a way that suggests government endorsement is prohibited. Many agencies avoid official symbols entirely. Check carrier guidance before using any Medicare-related imagery, names or domains.
What should a Medicare lead form ask for?
Only what the next step needs, usually a name, a phone or email, a ZIP code and a preferred time. Add an unchecked consent box with plain wording, and leave Medicare numbers, Social Security numbers and health details out of the form.
How often should a Medicare website be reviewed?
At least once a year before the Annual Enrollment Period, and whenever your carrier contracts or CMS rules change. Updating plan counts in the disclaimer is a common reason to edit the site mid-year.