Medicare AI Compliance Guide: HIPAA, TCPA, TPMO & Consumer Health Privacy
This guide explains the regulatory framework that actually governs AI-assisted Medicare lead generation and SMS-based consumer health communication. It draws on primary regulatory sources, distinguishes legal requirements from industry practice, and separates HIPAA obligations from the broader set of laws that most reliably apply — several of which bind Medicare programs regardless of HIPAA status.
Editorial principles: We cite primary sources wherever possible, separate legal requirements from best practices, and acknowledge regulatory uncertainty where it exists. We encourage corrections from practitioners and compliance counsel. This guide is not legal advice — consult qualified counsel for compliance determinations specific to your program.
Executive Summary
- HIPAA applies conditionally, not automatically. HIPAA reaches a software vendor only through the business-associate path — when it handles Protected Health Information on behalf of a Covered Entity or Business Associate. Consumer Medicare lead data volunteered directly to a non-covered intermediary is typically not PHI in the HIPAA sense.
- The binding constraints are broader than HIPAA. For consumer Medicare lead generation over text, the regimes that most reliably apply are state consumer-health-privacy laws (WA My Health My Data Act, NV SB 370), CCPA/CPRA sensitive-data rules, TCPA texting-consent rules, and CMS Medicare marketing / TPMO requirements — several of which apply regardless of HIPAA status.
- TCPA is often the higher-velocity litigation risk. HIPAA enforcement is government-initiated and typically targets Covered Entities with significant breaches. TCPA violations can be brought as private class actions at $500–$1,500 per message — creating potentially catastrophic exposure from SMS programs lacking documented consent.
- Texting health data is permitted with the right framework. The legally significant SMS issue is documented consent and risk disclosure — not the fact that carrier-hop transmission is unencrypted. HIPAA doesn't prohibit SMS of health information; it requires warning the individual and documenting their preference.
1. HIPAA and Medicare Lead Generation
HIPAA governs only two categories of organizations: Covered Entities — health plans, healthcare clearinghouses, and providers that transmit health information electronically — and Business Associates, which are entities that create, receive, maintain, or transmit Protected Health Information on behalf of a Covered Entity.[1],[2]
A software vendor is never itself a Covered Entity. HIPAA reaches vendors only through the Business Associate path — by handling PHI on behalf of a Covered Entity or its Business Associate. If no Covered Entity sits in the data chain, the same data is governed by other laws. This is because HIPAA defines PHI as health information held by or for a Covered Entity — the status of the holder determines whether HIPAA applies, not the sensitivity of the information alone.
Are insurance brokers Covered Entities?
Generally no. The Covered Entities within Medicare are the health plans — the carriers and insurance issuers that underwrite the plans. Insurance agents and brokers who market and sell Medicare Advantage and supplement plans are intermediaries, not health plans.
- Lead data a consumer volunteers directly to a broker, before any carrier relationship exists, is typically not PHI under HIPAA.
- A brokerage can become a Business Associate in other contexts — for example, if it administers group health benefits and directly handles a carrier's PHI. In that context, a subcontractor BAA is appropriate.
- Whether a specific brokerage is a BA for a specific data flow requires a fact-specific analysis; carriers sometimes contractually treat distribution partners as BAs.
When HIPAA does apply
If a Medicare program's data flow ties to a Covered Entity or BA relationship — for example, a technology vendor processing lead data that feeds directly into a carrier's enrollment workflow — HIPAA applies and a Business Associate Agreement is required before PHI can be shared with that vendor.
Even when not strictly required, HIPAA-aligned controls are worth maintaining. Enterprise security teams require them contractually, those controls represent the floor demanded by other applicable laws, and maintaining them removes "are you HIPAA compliant?" as a procurement obstacle.
2. The Regulatory Framework That Actually Applies
The compliance conversation for Medicare AI programs should not begin and end with HIPAA. Here is the regulatory landscape as it actually applies to consumer Medicare lead generation over SMS:
| Regime | What it requires | HIPAA required? |
|---|---|---|
| WA My Health My Data Act[4] & NV SB 370[5] | Affirmative opt-in consent to collect/share consumer health data; published privacy policy; deletion and withdrawal rights. WA carries a private right of action. | No — applies regardless of HIPAA status |
| CCPA / CPRA[6] | Health and precise data is "sensitive personal information" — specific notice, opt-out/consent, and a service-provider data processing agreement required. | No — applies regardless |
| TCPA[7] | Prior express written consent for marketing texts; documented opt-in; honor STOP/opt-out immediately. Penalties are per-message. This is the real SMS gate. | No — applies regardless |
| CMS Medicare Marketing / TPMO[8] | Possible TPMO status: required disclaimer, communication recording retention (10 yrs), Scope of Appointment before discussing specific plans. | No — CMS rules are independent |
| HIPAA[1],[2] | If the flow ties to a CE/BA relationship: Security Rule controls — access, audit, encryption, breach notification — under a signed BAA. | Only if a CE/BA relationship exists |
The compliance conversation should lead with consent + state health privacy law + TCPA, with HIPAA/BAA as an available scope that attaches when the data chain involves a Covered Entity.
3. Collecting Health Data Over SMS — What the Rules Actually Say
There is a widespread misconception that collecting personal or health data over SMS is inherently non-compliant. That is not what the regulations say, and it is not how the market has operated.
What HIPAA actually says about SMS
HHS Office for Civil Rights has stated explicitly that covered entities may communicate with individuals via unencrypted text or email when the individual is informed of the risks and still prefers that channel.[3] The obligation is to warn and document, not to refuse the channel entirely.
The Security Rule's transmission-encryption standard is "addressable" — not mandatory — meaning a covered entity may implement an alternative measure and document why it is reasonable. A documented consent and risk acknowledgment is an established alternative to end-to-end encryption for the carrier hop.
What TCPA says about SMS
TCPA's primary gate is prior express written consent before sending marketing messages — not the content or sensitivity of the data exchanged in those messages. A program that has proper consent in place, honors opt-outs, and operates with a compliant sender profile is within the TCPA framework regardless of whether health-related information is discussed.
How to mitigate SMS risk responsibly
- Consent and risk disclosure captured before messaging — combining TCPA prior express written consent with state health-privacy opt-in requirements.
- Minimize what's solicited over SMS — general intake and education only; keep the conversational footprint light over the carrier hop.
- Route sensitive fields to a secure web channel — medications, provider relationships, and specific benefit decisions route to an encrypted web form by design, keeping the heaviest PII off the SMS transmission.
- HIPAA-eligible transport for the messaging layer when operating in HIPAA scope (Twilio HIPAA tier, Bandwidth, Telnyx, Sinch, and AWS End User Messaging all provide BAA-backed messaging infrastructure).
4. State Consumer Health Privacy Laws
Washington My Health My Data Act (MHMDA)
Enacted in 2023 (ESHB 1155),[4] the MHMDA is one of the most significant consumer health privacy laws enacted outside the federal HIPAA framework. Key provisions:
- Affirmative opt-in consent is required before collecting or sharing consumer health data — passive or implied consent is not sufficient.
- A consumer health data privacy policy must be published and linked from the first point at which health data is collected.
- Consumers have the right to access, delete, and withdraw consent for their health data.
- The law applies to entities that collect health data of Washington residents regardless of where the entity is based, making it effectively extraterritorial for programs that market nationally.
- It carries a private right of action — individual consumers and class plaintiffs can sue for violations, significantly elevating enforcement risk compared to laws enforced only by government regulators.
For a Medicare SMS program that may reach Washington residents, MHMDA compliance is not optional and does not depend on whether the program is subject to HIPAA.
Nevada SB 370
Nevada Senate Bill 370 (effective 2023)[5] establishes a parallel framework for Nevada residents. Like MHMDA, it requires opt-in consent before collecting or sharing consumer health data, establishes consumer access and deletion rights, and applies to entities collecting Nevada residents' data regardless of where the entity is located.
CCPA / CPRA — California Sensitive Data
California's Consumer Privacy Rights Act[6] treats health information and precise geolocation as "sensitive personal information." This triggers additional requirements: the right to limit sensitive data use, specific notice obligations, and the requirement that data shared with vendors be covered by a CCPA-compliant service-provider agreement. For programs reaching California residents, CCPA/CPRA is the baseline state privacy framework.
Other states
Colorado, Connecticut, Virginia, Texas, and several other states have enacted or are implementing consumer privacy laws with health data provisions. The landscape is evolving rapidly. Confirm currently effective laws for the specific states your program will market into before launch, and build in a quarterly review cadence to catch new enactments.
5. TCPA and Medicare Text Messaging
The TCPA framework
The Telephone Consumer Protection Act (47 U.S.C. § 227)[7] and FCC regulations require prior express written consent before sending marketing text messages to a consumer's mobile phone. Key requirements:
- Prior — consent must be obtained before the first marketing message, not concurrent with or after.
- Express — not implied by an existing business relationship. The consumer must affirmatively agree.
- Written — electronic signatures and online opt-in forms qualify; verbal consent does not meet the written standard for marketing messages.
- Specific sender — following the FCC's 2024 one-to-one consent rule, consent must identify the specific marketing sender. A consumer cannot consent on behalf of multiple companies through a single opt-in event.
Opt-out requirements
Any SMS marketing program must honor opt-outs immediately. Industry standard is to recognize STOP, QUIT, CANCEL, END, and UNSUBSCRIBE. Opt-outs must be processed promptly and the consumer must not receive further marketing messages after opting out. Failure to honor opt-outs is itself a TCPA violation independent of the initial consent question.
Why TCPA is often the higher enforcement risk
HIPAA enforcement is initiated by government regulators and typically focuses on Covered Entities with significant data breaches — the enforcement path is slow and generally not available to individual plaintiffs. TCPA violations can be brought as private class actions on a per-message basis — statutory damages of $500 to $1,500 per message. A Medicare SMS program that sends 10,000 texts without proper consent faces potential exposure of $5–$15 million before any class multiplier. The plaintiff-side TCPA bar is active and well-funded.
Documented consent records, a clean opt-in flow, and a properly configured opt-out mechanism are the primary defenses against TCPA class action exposure.
6. CMS Medicare Marketing & TPMO Rules
TPMO definition and scope
CMS defines Third-Party Marketing Organizations as entities that perform lead generation, marketing, sales, or enrollment functions on behalf of Medicare Advantage or Part D plans.[8] The key question for technology vendors is whether they are acting as a pure technology provider or as a functional TPMO. The analysis turns on what the vendor actually does, not what technology it uses.
TPMO compliance requirements
- Required disclaimer: Every marketing communication must include the CMS-mandated disclaimer: "We do not offer every plan available in your area. Any information we provide is limited to those plans we do offer in your area. Please contact Medicare.gov or 1-800-MEDICARE to get information on all of your options." This applies to text, email, websites, and digital channels — not only printed materials.
- Communication recording: CMS requires audio recording of marketing and sales calls, retained for a minimum of 10 years. The application of this requirement to SMS conversation logs warrants analysis with qualified Medicare compliance counsel.
- Scope of Appointment (SOA): Before discussing specific plan options with a Medicare beneficiary, agents must obtain a documented SOA indicating which plan types the consumer agrees to discuss. SOAs must generally be obtained at least 48 hours before the appointment.
Technology vendors vs. TPMOs
A technology platform that provides software infrastructure — SMS routing, data collection, lead management — without directly marketing plan options or influencing enrollment decisions may be a technology vendor rather than a TPMO. However, this is a fact-specific analysis. Vendors that generate enrollment-ready leads with plan-specific messaging, or that present plan options to consumers, are more likely to be classified as TPMOs. For ambiguous situations, the safer course is a counsel read and direct confirmation with your CMS Regional Office.
7. AI Systems and Medicare Compliance
AI and the HIPAA analysis
Adding an AI model to a Medicare intake workflow doesn't change the fundamental HIPAA question: is there a Covered Entity or BA relationship for this data flow? If there is, PHI that flows through or is processed by the AI is subject to HIPAA controls, and a BAA is required with the AI provider if that provider processes PHI on the CE's behalf.
Key questions for AI in a HIPAA-scope Medicare program:
- Does the AI model process PHI? If intake conversations include PHI and are sent to a third-party AI model, that model provider may need to be a Business Associate with a BAA. AWS Bedrock, Azure OpenAI (Enterprise), and Google Vertex AI all offer HIPAA-eligible tiers.
- Are prompts and conversation logs retained? AI platforms often log prompts and completions by default. In HIPAA scope, those logs can constitute PHI and must be handled accordingly.
- Is PHI de-identified before AI processing? If the AI operates on de-identified data (per the HIPAA Safe Harbor or Expert Determination standards), the output is not PHI and many HIPAA controls do not apply to that processing step.
AI and TCPA / TPMO
TCPA does not distinguish between AI-generated and human-generated text messages — the same prior express written consent requirement applies. If anything, AI systems that can send messages at scale make documented consent records more important, not less, because the volume of potential exposure per consent failure is higher.
For TPMO purposes, CMS rules apply to the marketing function, not the technology. An AI system performing lead generation on behalf of a Medicare Advantage plan is performing a TPMO function regardless of whether it is automated.
Evaluating AI vendors for Medicare programs
Key compliance questions when evaluating an AI vendor for a Medicare program:
- Will the vendor sign a BAA if operating in HIPAA scope?
- What AI subprocessors does the vendor use, and will they sign BAAs?
- How are prompts and conversation logs retained, and can retention be configured or disabled?
- Is PHI detection and redaction available before data crosses to the AI processing layer?
- Does the platform enforce and log consent, opt-in, and opt-out events?
- What CMS TPMO controls — disclaimer, SOA support, communication recording — are built in?
- What deployment options exist for data-sovereignty requirements?
Frequently Asked Questions
Common compliance inquiries from brokers, carriers, compliance teams, and TPMOs evaluating SMS-based Medicare AI programs.
Is Medicare lead data PHI?
Not necessarily. PHI under HIPAA is health information held by or on behalf of a Covered Entity or Business Associate. When a consumer volunteers health information directly to a non-covered-entity intermediary — such as an insurance broker or technology vendor — without a Covered Entity in the data chain, that information is personal data governed by other laws, not PHI in the HIPAA sense. The same data can become PHI if it flows through or on behalf of a Covered Entity. Source: 45 C.F.R. § 160.103.[1]
Are insurance brokers HIPAA Covered Entities?
Generally no. HIPAA's Covered Entities are health plans (including insurance issuers), healthcare clearinghouses, and providers that transmit health information electronically. Insurance agents and brokers who sell Medicare Advantage or supplemental plans are not themselves health plans — the carriers and issuers hold that status. A brokerage can become a Business Associate in other contexts (e.g., administering group health benefits and handling a carrier's PHI), but the broker's Medicare sales and lead-generation activity typically does not create that relationship unless a carrier contractually assigns BA obligations.
Can health information be collected over SMS?
Yes, with appropriate consent and disclosure. HIPAA does not prohibit SMS collection of health information. HHS OCR has stated that covered entities may communicate via unencrypted text when the individual is warned of the risk and prefers that channel.[3] The Security Rule's transmission-encryption standard is "addressable" — not mandatory — and may be satisfied by documented consent and risk acknowledgment. The governing gate is consent under TCPA and state health privacy law, not the channel itself.
Does HIPAA prohibit texting?
No. HHS OCR has explicitly stated that covered entities may communicate by unencrypted text or email when the individual has been informed of the risks and still prefers that channel.[3] The obligation is to warn and document — not to prohibit. A Covered Entity operating in HIPAA scope should use a HIPAA-eligible messaging platform that will sign a Business Associate Agreement (Twilio, Bandwidth, Telnyx, Sinch, and AWS End User Messaging all offer HIPAA-eligible tiers), but that is an infrastructure and contracting requirement, not a prohibition on the channel.
What is the Washington My Health My Data Act?
Enacted in 2023 (ESHB 1155),[4] Washington's My Health My Data Act (MHMDA) is a consumer health privacy law that applies regardless of HIPAA status. It requires: (1) affirmative opt-in consent before collecting or sharing consumer health data; (2) a published consumer health data privacy policy; (3) consumer deletion and consent-withdrawal rights. It carries a private right of action, meaning consumers and class plaintiffs can sue directly for violations. It applies to entities collecting data of Washington residents regardless of where the entity is based — making it effectively national in reach for programs that market across states.
Does TPMO call recording apply to SMS conversations?
CMS TPMO rules specifically require audio recording of sales calls, with records retained for 10 years.[8] Whether SMS conversations constitute "calls" requiring audio recording is not definitively resolved by current CMS guidance. CMS rules do require retaining records of marketing communications broadly, and the operationally safer approach is to retain SMS conversation logs for the required period. This question warrants a specific read with qualified Medicare compliance counsel for your program's contracted role and communication model.
What consent is required for Medicare marketing texts?
TCPA requires prior express written consent before sending marketing text messages.[7] Under the FCC's 2024 one-to-one consent rule, each marketing sender must be specifically identified in the consent — a single blanket consent covering multiple companies is no longer sufficient. Consent must be: (1) prior — before the first marketing message; (2) express — not implied by a business relationship; (3) written — electronic signatures qualify; (4) specific to the marketing sender. Washington MHMDA and other state health privacy laws may impose additional opt-in consent requirements for health-related communications beyond TCPA's requirements.
When is a Business Associate Agreement (BAA) required?
A BAA is required when: (1) a Covered Entity shares PHI with a vendor, contractor, or partner that will create, receive, maintain, or transmit that PHI on the CE's behalf; or (2) a Business Associate shares PHI with a subcontractor for those same purposes. If no PHI is involved — because no Covered Entity is in the data chain — no BAA is required under HIPAA. However, a data processing agreement still makes sense under other applicable laws: CCPA service-provider agreements, and state health privacy data processing agreements where required.
Is a Medicare AI chatbot a TPMO?
It depends on the contracted role and what the system actually does. CMS defines TPMOs as entities that perform lead generation, marketing, sales, or enrollment functions for Medicare Advantage or Part D plans. A technology vendor that provides software infrastructure without directly marketing plan options may not be a TPMO. A vendor whose AI system directly markets plan options to consumers or generates enrollment-ready leads with plan-specific content is more likely to be classified as a TPMO. This is a fact-specific analysis requiring qualified Medicare compliance counsel review and, for ambiguous situations, direct confirmation with your CMS Regional Office.
Does AI change HIPAA obligations?
AI doesn't change the threshold analysis — the Covered Entity/Business Associate framework still determines whether HIPAA applies. But AI expands the surface area where those obligations can trigger. Key questions: Does the AI model process PHI? Is the AI provider operating on behalf of a Covered Entity such that a BAA is required? Are prompts or conversation logs stored in a way that creates or retains PHI? Third-party AI model providers used in HIPAA scope need BAAs — AWS Bedrock, Azure OpenAI (Enterprise), and Google Vertex AI all offer HIPAA-eligible tiers with BAA availability.
What is prior express written consent under the TCPA?
Prior express written consent is the legal standard under the TCPA (47 U.S.C. § 227)[7] and FCC regulations requiring that a consumer clearly authorize a specific sender to send marketing texts before any marketing message is sent. "Written" includes electronic records and online opt-in forms; verbal consent does not meet the standard for marketing messages. "Prior" means before the first marketing text. "Express" means affirmative agreement — not a pre-existing business relationship. Following the FCC's 2024 rule, consent must identify the specific sender and may not be shared across multiple marketers through a single consent event.
What are the CMS Medicare marketing disclaimer requirements?
CMS requires that TPMOs include a specific disclaimer in all marketing materials and communications:[8] "We do not offer every plan available in your area. Any information we provide is limited to those plans we do offer in your area. Please contact Medicare.gov or 1-800-MEDICARE to get information on all of your options." This disclaimer must appear in text messages, emails, websites, and digital channels — not only in printed materials. CMS periodically updates marketing guideline requirements; verify against the current Medicare Marketing Guidelines for the applicable plan year.
What is the Scope of Appointment requirement?
CMS requires Medicare agents and brokers to obtain a Scope of Appointment (SOA) from a Medicare beneficiary before conducting a sales meeting. The SOA documents which plan types — Medicare Advantage, Part D, Medicare Supplement — the consumer agrees to discuss. In most circumstances, SOAs must be obtained at least 48 hours before the appointment; exceptions exist for in-person walk-ins. Technology tools supporting the Medicare enrollment workflow must be designed to support the SOA process, and SOA records must be retained consistent with CMS requirements.[8]
Does HIPAA apply to Medicare brokers?
Generally no, for the brokerage function itself. Insurance agents and brokers selling Medicare plans are not Covered Entities under HIPAA. The health plans and carriers are. If a broker administers group health benefits and directly handles a carrier's PHI, HIPAA attaches in that capacity as a Business Associate. The broker's Medicare lead-generation activity — collecting consumer information to connect them with a carrier — typically does not create a HIPAA BA relationship unless the carrier contractually assigns BA obligations. Confirm your specific contractual relationship with carriers to determine whether BA obligations have been assigned to your organization.
What states have consumer health data privacy laws?
Washington (My Health My Data Act, 2023)[4] and Nevada (SB 370, 2023)[5] have enacted dedicated consumer health data privacy statutes. California (CPRA)[6] treats health information and precise location as sensitive personal information with heightened requirements. Colorado, Connecticut, Virginia, Texas, and several other states have enacted or are implementing consumer privacy laws with health data provisions. The state law landscape is evolving rapidly — verify currently effective laws for the specific states your program markets into before launch, and build in a review cadence to catch new enactments and amendments.
What is Nevada SB 370?
Nevada Senate Bill 370 (effective 2023)[5] establishes consumer health data privacy requirements modeled on the Washington MHMDA framework. It requires affirmative consent before collecting or sharing consumer health data, establishes consumer rights to access and delete their data, and applies to entities collecting Nevada residents' consumer health data regardless of where the entity is based. Like the MHMDA, it applies independently of HIPAA status. Confirm current Nevada law provisions applicable to your program; state statutes are subject to amendment.
Is TCPA or HIPAA a bigger risk for Medicare SMS programs?
For most Medicare SMS programs, TCPA is the more immediate litigation and regulatory risk. HIPAA enforcement is government-initiated, typically targets Covered Entities with significant breaches, and the enforcement path is slow. TCPA violations can be brought as private class actions at $500–$1,500 per message, and the plaintiff-side TCPA bar is active. A Medicare SMS program that sends 10,000 texts without documented consent faces potential exposure of $5–$15 million before any class multiplier. Consent documentation, a clean opt-in flow, and a properly configured opt-out mechanism are the primary TCPA defenses.
How long must communication recordings be retained under CMS rules?
CMS requires TPMOs to retain audio recordings of marketing and sales calls for a minimum of 10 years.[8] This is one of the most operationally demanding TPMO compliance requirements. For AI-assisted or SMS programs, what qualifies as a "marketing communication" for retention purposes warrants analysis with Medicare compliance counsel. Specific format and access requirements are detailed in the CMS Medicare Marketing Guidelines published annually for each plan year.
What is data minimization in the context of Medicare AI?
Data minimization is the principle — required by HIPAA and many state privacy laws — of collecting and retaining only the personal data necessary for the specific purpose at hand. In a Medicare AI context, this means: (1) soliciting only the intake information needed for broker preparation over SMS, not detailed clinical data; (2) routing sensitive fields (medications, provider relationships, benefit decisions) to an encrypted web channel rather than collecting over the SMS hop where possible; (3) limiting AI model prompts to de-identified or minimized data where the architecture allows; and (4) implementing retention schedules that honor consumer deletion rights under applicable state laws including the MHMDA and CCPA/CPRA.
What does a Business Associate Agreement actually cover?
A BAA is a contract required by HIPAA between a Covered Entity and a Business Associate — or between a BA and a subcontractor BA — governing how PHI may be used and protected. BAAs establish: (1) the permitted purposes for which the BA may use PHI; (2) security controls the BA must maintain consistent with the HIPAA Security Rule; (3) breach notification obligations — the BA must notify the CE of any breach without unreasonable delay and no later than 60 days after discovery; (4) requirements for return or destruction of PHI at the end of the relationship. A BAA does not make a vendor HIPAA compliant — it establishes the contractual framework and allocates responsibility between the parties.
Sources
This guide cites primary regulatory sources wherever possible. All sources were verified as of June 2026. If a source becomes unavailable or outdated, please contact us and we will update the reference and preserve a replacement source wherever possible.
- 1 HIPAA Covered Entity Definition — 45 C.F.R. § 160.103 U.S. Department of Health and Human Services. Statutory definition of "covered entity" — health plans, healthcare clearinghouses, and providers that transmit health information electronically. HHS guidance confirms that insurance agents, brokers, and most Medicare intermediaries are not covered entities.
- 2 HIPAA Business Associate Definition and Agreements — 45 C.F.R. § 160.103; 45 C.F.R. § 164.308(b) U.S. Department of Health and Human Services. Statutory definition of "business associate" — entities that create, receive, maintain, or transmit PHI on behalf of a covered entity. Requires a signed Business Associate Agreement before PHI may be shared with a BA. A software vendor becomes a BA only if it handles PHI on behalf of a covered entity.
- 3 HIPAA Privacy Rule — 45 C.F.R. Part 164, Subpart E U.S. Department of Health and Human Services. The HIPAA Privacy Rule establishes national standards for the protection of individuals' medical records and other identifiable health information. Defines protected health information (PHI) as individually identifiable health information held by or for a covered entity — the holder's status, not the data's sensitivity, determines whether HIPAA's privacy protections apply.
- 4 HIPAA Security Rule — 45 C.F.R. Part 164, Subpart C U.S. Department of Health and Human Services. The HIPAA Security Rule establishes national standards to protect electronic PHI (ePHI). Requires covered entities and BAs to implement administrative, physical, and technical safeguards. Transmission encryption is "addressable" — not unconditionally mandatory — meaning a documented alternative measure may be implemented.
- 5 HIPAA Breach Notification Rule — 45 C.F.R. Part 164, Subpart D U.S. Department of Health and Human Services. Requires covered entities and BAs to provide notification following a breach of unsecured PHI. Business associates must notify the covered entity within 60 days of discovering a breach.
- 6 HHS OCR Guidance — HIPAA and Electronic Communication (Texting/Email) U.S. Department of Health and Human Services, Office for Civil Rights. FAQ 570 confirms that covered entities may communicate with individuals by unencrypted text or email when the individual is informed of the risks and requests or agrees to that channel. The obligation is to warn and document, not to refuse the channel.
- 7 HHS OCR — Online Tracking Technologies Guidance U.S. Department of Health and Human Services, Office for Civil Rights. Guidance on when technology vendors that receive PHI from covered entities via online tracking technologies are subject to HIPAA as business associates. Applicable by analogy to AI and SMS vendors that receive PHI in the data chain.
- 8 HIPAA Preemption of State Law — 45 C.F.R. § 160.203 Federal preemption standard: HIPAA preempts contrary state law only where the state law is less protective of individual privacy. More protective state laws — including the Washington MHMDA and Nevada SB 370 — are not preempted and must be satisfied alongside HIPAA.
- 9 Telephone Consumer Protection Act — 47 U.S.C. § 227 U.S. Congress. The Telephone Consumer Protection Act of 1991, as amended. Prohibits sending marketing text messages without prior express written consent. Per-message penalties of $500–$1,500. The TCPA is the primary federal gate for SMS-based Medicare lead generation regardless of HIPAA status.
- 10 FCC — Prior Express Written Consent Rules — 47 C.F.R. § 64.1200 Federal Communications Commission. Implementing regulations for TCPA. Defines prior express written consent requirements for marketing calls and texts, opt-out obligations, and the required content of a compliant consent disclosure. Applies to all SMS marketing regardless of channel or industry.
- 11 FCC 2024 One-to-One Consent Order — FCC 23-107 (effective January 2025) Federal Communications Commission. Final Rule requiring that TCPA marketing consent specifically name the seller — a single consent covering multiple companies is no longer sufficient. Each company that will send marketing texts must be individually identified in the consent disclosure. Directly impacts Medicare lead aggregators and multi-carrier programs.
- 12 CTIA Messaging Principles and Best Practices CTIA — The Wireless Association. Industry-standard guidelines for commercial SMS messaging programs, including consent requirements, opt-out handling (STOP, HELP, CANCEL), message frequency disclosures, and carrier compliance requirements. Carrier filtering algorithms enforce many of these standards technically.
- 13 CMS Medicare Marketing Guidelines — Chapter 3 (TPMO Requirements) Centers for Medicare & Medicaid Services. Medicare Marketing Guidelines, current plan year. Defines TPMO status, required verbatim disclaimer language, call recording and retention requirements (10 years), Scope of Appointment requirements, and digital channel obligations.
- 14 TPMO Definition — 42 C.F.R. § 422.2268 (Medicare Advantage) Code of Federal Regulations. Defines Third Party Marketing Organizations for Medicare Advantage plans, required compliance obligations, verbatim disclaimer text, recording and retention mandate, and civil monetary penalty authority of up to $100,000 per violation per beneficiary.
- 15 TPMO Definition — 42 C.F.R. § 423.2268 (Part D) Code of Federal Regulations. Equivalent TPMO requirements for Medicare Part D prescription drug plans. Disclaimer, recording, retention, and SOA obligations mirror the MA requirements in § 422.2268.
- 16 Scope of Appointment — 42 C.F.R. § 422.2264 Code of Federal Regulations. Scope of Appointment rules for Medicare Advantage: documentation requirements, the 48-hour advance rule, and exceptions for beneficiary-initiated contact.
- 17 CMS 2023 Final Rule — 88 Fed. Reg. 22120 (April 5, 2023) Centers for Medicare & Medicaid Services. Contract Year 2024 Policy and Technical Changes. Significantly strengthened TPMO requirements, expanded civil monetary penalty authority, and clarified recording and retention mandates. Effective for the 2024 plan year.
- 18 CMS TPMO FAQ (2021) Centers for Medicare & Medicaid Services. Agency responses to industry questions on TPMO classification, technology vendor analysis, disclaimer placement, and recording requirements. Confirms that technology platforms may be classified as TPMOs based on function, not corporate structure.
- 19 Washington My Health My Data Act — ESHB 1155 (2023); RCW chapter 70.372 Washington State Legislature. The most comprehensive US state consumer health data privacy law. Requires opt-in consent before collecting consumer health data, prohibits geofencing within 2,000 feet of healthcare facilities, requires data processing agreements, and includes a private right of action. Applies extraterritorially to any organization collecting health data of Washington residents.
- 20 Nevada SB 370 — Consumer Health Data Privacy Law (2023); NRS chapter 629 Nevada Legislature. Senate Bill 370, 82nd Session (2023). Requires opt-in consent before collecting Nevada residents' consumer health data, prohibits sale without standalone authorization, and requires data processing agreements with processors. Enforced by the Nevada Attorney General; no private right of action.
- 21 California Consumer Privacy Rights Act (CPRA) — Cal. Civ. Code § 1798.100 et seq. California Office of the Attorney General. Classifies health information as "sensitive personal information" with heightened rights: the right to limit use, opt-out of sale/sharing, and specific notice requirements. HIPAA-covered entities are partially exempt; non-covered-entity Medicare marketing programs are within scope for California residents' data.
- 22 Colorado Privacy Act (CPA) — CRS §§ 6-1-1301 to 6-1-1313 Colorado General Assembly. Senate Bill 21-190. Classifies health data as sensitive personal data requiring opt-in consent before collection or processing. Applies to controllers collecting data of 100,000+ Colorado residents annually or 25,000+ where data is sold. Enforced by the Colorado AG.
- 23 Connecticut Data Privacy Act (CTDPA) — Public Act 22-15 Connecticut General Assembly. Classifies health data as sensitive personal data requiring opt-in consent. Structurally similar to the Colorado Privacy Act. Applies to controllers meeting size thresholds; enforced by the Connecticut AG.
- 24 Texas Health Privacy Law — HB 300 (2011, amended 2012); Texas HSC ch. 181 Texas Legislature. Applies to any covered entity — including organizations that are not HIPAA covered entities — that assembles or maintains protected health information of more than 50 individuals. Extraterritorial reach and a private right of action. Requires consent for uses of health information beyond the primary purpose.
- 25 HHS OCR — SMS FAQ: Can a Covered Entity Use SMS to Communicate PHI? U.S. Department of Health and Human Services, Office for Civil Rights. FAQ addressing whether covered entities may use SMS for PHI communication. Affirms that SMS is permissible when the patient is informed of risks and prefers that channel — the HIPAA obligation is documented consent and risk disclosure, not refusal of the channel.
MediMatch
About MediMatch
MediMatch is a white-label SMS Medicare lead intake tool for benefits brokers and General Agents. It handles TCPA consent capture, state health-privacy opt-in, CMS TPMO disclaimers, and routing of sensitive data to a secure web channel — so brokers can focus on the enrollment conversation, not the compliance stack.
Questions about compliance for your specific program? We're happy to talk through the framework.
This guide is an educational resource and is not legal advice. Consult qualified Medicare compliance counsel for determinations specific to your program and geography.