Medicare Lead Generation for Agents: Channels and Compliance

The best Medicare lead generation for agents combines a few channels you can work consistently (T65 outreach, referrals, digitally local marketing, events, direct mail and paid ads), measured by return rather than cost per lead, worked with fast follow-up in a CRM you control, and run inside CMS rules on consent, the TPMO disclaimer and call recording.

Most agents think they have a lead problem. Usually they don't. They have a lead flow problem. Buying leads is not the same as building lead flow. One is rented. The other is owned.

I started out knocking doors in a 50-mile radius around Tupelo. I learned marketing because I wanted a better way to reach people who actually wanted my help. That's still the goal. Not more leads. More of the right conversations.

This guide is the map: the channels, how to test them, how to follow up, the rules that matter right now and a 90-day plan. If you're newer and burning money on bought leads, read why buying Medicare leads burns new agents first.

Leads, prospects and marketing: get the definitions straight

Lead vs prospect

By my definition, a lead is someone who has shown interest, through some kind of marketing, in something you can help them with. A prospect is someone you've personally talked to and confirmed is a real opportunity. A vendor can sell you leads. Only you can turn one into a prospect.

Active vs passive marketing

Active marketing, or direct response, gets someone to raise their hand now: a lead ad, a business reply card, a search ad. Passive marketing, or brand, builds familiarity over time so you're the name people already know when they need help. I call it subconscious inundation. You need both.

Owned vs bought lead flow

Bought leads stop the day you stop paying. Owned lead flow keeps working: referrals, reviews, local reputation, content and people who asked to hear from you. It's how agents build a real book of business. Ownership compounds. Rentals don't.

The channels

Every channel can work, and none works alone. Scope note: the CMS rules here cover Medicare Advantage and Part D marketing. For Med Supp and other lines, check your state and carrier rules too.

Turning 65 (T65)

T65 is a long pipeline. The agent who shows up early, stays helpful and follows up wins. I've covered it in depth: the best T65 lead sources, why not all T65 leads are created equal and five questions to ask every T65 prospect.

Watch-out: CMS allows unsolicited first contact by conventional mail, print and email (every email needs an opt-out). Unsolicited calls, texts and voicemails are prohibited under 42 CFR 422.2264(a), with the same rule for Part D at 423.2264.

Referrals

Referrals are the warmest lead flow you'll ever have, and they come from service. Answer the phone in March. Fix the claim problem. People refer the agent who shows up after the sale.

CPAs, financial advisors and local employers' HR teams make good referral partners, especially for clients working past 65.

Watch-out: a referral is not permission to call. CMS lists "calls based on referrals" as unsolicited contact under 422.2264(a)(2)(iv). Let the referred person reach out first. Any thank-you gift must be of nominal value, never cash, and offered whether or not anyone enrolls, per 42 CFR 422.2263(b). Get the current dollar limit from compliance.

Digitally local

Digitally local means putting a local agent's trust where people look now. Start with a Google Business Profile. Google's guidelines for representing your business say your name must match your real-world business name, so skip the keyword stuffing. Ask happy clients for honest reviews, but Google prohibits offering incentives for them. Then show up: schools, civic clubs, little league, community events.

Watch-out: reuse a client's post or review in your marketing and CMS endorsement rules can apply. A beneficiary endorsing a plan must have been enrolled when it was created, and paid endorsements must say so, under 42 CFR 422.2262(b).

Events and seminars

Events work, and CMS sets rules for each type under 422.2264(c).

Educational events must be advertised as educational and can't market specific plans or benefits. You can share materials, answer questions and collect reply cards. CMS's CY 2027 final rule, which applies to CY 2027 marketing beginning October 1, 2026, now lets you collect Scope of Appointment forms there too.

At marketing events, you can't require sign-in sheets or contact info to attend, run health screenings or use raffle entries for anything but the raffle. If a marketing event follows an educational one, announce that the educational part is over and give people a real chance to leave. That replaced the old 12-hour separation rule. No meals for potential enrollees, regardless of value, per 422.2263(b)(3). Ask carriers how they want events reported.

Direct mail and business reply cards

A reply card is one of the cleanest ways to get permission. Calling someone who returned a card asking for contact isn't unsolicited under 422.2264(a)(3).

Never make a mailer look like it came from the government. CMS prohibits using the Medicare name, the CMS logo or federal products like the Medicare card in a misleading way, and the card image needs CMS authorization, under 42 CFR 422.2262(a). If a reader would feel tricked, it's wrong.

Paid digital: search, social and lead ads

Platform rules come first. Meta's ad standards prohibit ads that assert or imply personal attributes, including age and medical conditions, so describe the service, not the reader. Google treats health as a sensitive interest category, and ads in those categories can't use advertiser-curated audiences like customer match or remarketing lists.

Watch-out: CMS requires the TPMO disclaimer to be prominently displayed on TPMO websites, including your landing pages, and in marketing materials, under 42 CFR 422.2267(e)(41). Unsolicited social media DMs are prohibited under 422.2264(a)(2)(iii). Let people message you first.

Content, video and personal brand

This is the long game. Useful videos and articles keep answering your market's questions long after you post them. I made the full case in why personal branding matters for Medicare agents.

Watch-out: CMS defines marketing by intent and content under 42 CFR 422.2260. Content about specific plans, benefits or costs that could steer an enrollment decision is marketing and needs approval.

Bought leads: exclusive, shared and live transfers

Bought leads have a place while your owned channels grow. An exclusive lead goes to you alone. A shared lead goes to several agents, so speed decides who gets the conversation. A live transfer is a call handed to you in real time.

The model to watch is the reseller that sells the same person to as many buyers as it can and treats consent as a checkbox. Judge vendors on consent, recording and source transparency, not just price.

Brand vs direct response: how to split your effort

Broke-agent phase: start active

Most of us started without much money for marketing. What you need first is people to talk to, so start with direct response. Your time is your biggest budget.

Growth phase: shift toward brand

Once your book pays the bills, move more effort into brand until you're the obvious local name. Brand makes every other channel convert better.

Why both need tracking

Brand is harder to measure, so ask every new client how they heard about you and log it. Track direct response by source too, or you'll keep spending blind.

How to test a channel (without fooling yourself)

Set the test up

Change one variable at a time. Pick the budget and time window before you start, big enough for real results, not a weekend of noise. Tag every lead with its source in your CRM.

Measure return, not cost per lead

Cost per lead is the wrong scoreboard. A cheap lead that never places a policy is expensive. A pricey lead that becomes a client for years is cheap. Track lead to appointment to application to placed policy to retained policy. Stop guessing. Watch ROAS.

Ignore vendor dashboards

The vendor's dashboard is built to sell you more. Your CRM is built to tell you the truth.

Find the kink in the hose

When a channel underperforms, find the one step where leads stall: contact, show rate, close rate or persistency. Fix that leak, retest, then move to the next.

Follow-up: where most leads die

Speed to contact

Most leads aren't lost to a "no." They're lost because nobody called back. Speed matters most with lead ads.

Multi-touch cadence within consent rules

Call, text and email, but only the way the person agreed to. Telemarketing calls to cell phones made with an autodialer or an artificial or prerecorded voice need prior express written consent under 47 CFR 64.1200(a)(2), and the FCC's consent rules cover texts too. People can revoke consent by any reasonable method, including replying "stop," and you must honor it within ten business days under 64.1200(a)(10).

The FCC adopted more revocation changes on September 30, 2026, effective 30 days after Federal Register publication (FCC 26-67). Confirm current rules with compliance before you build a cadence.

Scrub against the National Do Not Call Registry. The FCC's safe harbor uses a registry version no more than 31 days old, and do-not-call requests made to you must be honored for five years, under 64.1200(c) and (d). States may add their own rules.

A CRM you control

Every lead needs a source, an owner, a next step and a consent record. At Brock we built GoGuruX, our CRM and enrollment platform for Medicare agents, with lead management, quoting, policy tracking, client communication tools and compliance documentation in one place. Whatever you use, make sure your data stays yours. It's one of the questions in my FMO contracting guide.

Nurture people who aren't ready yet

Plenty of leads are early. A client whose plan is changing for 2027 needs a review, not a pitch, as I laid out in how we'd work AEP for members who need a new plan. Keep helpful touches going on the schedule they agreed to.

Compliance for Medicare lead generation

These are the rules for contract year 2027 marketing. Several changed this year, and carriers can be stricter than CMS.

The TPMO disclaimer

Independent agents are third-party marketing organizations (TPMOs) under 42 CFR 422.2260, and any TPMO selling for more than one MA organization uses the CMS disclaimer. Under 422.2267(e)(41), it's said on sales calls before any discussion of benefits, conveyed in email and chat, prominently displayed on your website and included in marketing materials.

For CY 2027, "within the first minute" became "before any discussion of benefits," and the wording dropped the reference to State Health Insurance Programs. Get the exact wording from compliance, with your real organization and plan counts.

Consent and data sharing

Personal beneficiary data a TPMO collects for marketing or enrollment can be shared with another TPMO only with the beneficiary's prior express written consent, through a clear disclosure listing each entity receiving it, under 422.2274(g)(4). The CY 2027 final rule describes that protection as still in place.

TCPA consent is a separate layer. The FCC's 2023 "one-to-one" consent rule was vacated by the Eleventh Circuit in January 2025, and the FCC removed it from its rules in August 2025. That doesn't loosen the CMS rule. Have compliance review your consent language before you collect or buy a lead.

Call recording

All marketing and sales calls, including the audio of calls on web-based platforms like video meetings, must be recorded in full and kept at least six years under 422.2274(g)(2)(ii). The first three years must be audio. Years four through six can be audio or a complete, accurate transcript. The CY 2027 final rule adds that the enrollment portion of a phone call is still recorded, since it serves as the enrollment form, and enrollment records stay on a ten-year retention.

No unsolicited contact

No cold calls, robocalls, unsolicited texts or voicemails, door knocking without an appointment, approaching people in parking lots or lobbies, or unsolicited DMs. It's all in 422.2264(a). Contact is fine when the person reaches out or gives permission.

Scope of Appointment

You still need a Scope of Appointment (SOA) before every personal marketing appointment, in writing for in-person appointments. The 48-hour waiting period and its two exceptions are gone; CMS eliminated them in the CY 2027 final rule, and the current text is 422.2264(c)(3). The SOA, reply card or request is valid for 12 months. Anything outside the agreed scope needs a separate SOA, and non-health products like annuities can't be marketed in that appointment.

Materials review and approval

Under 42 CFR 422.2261, marketing materials go through CMS review before use, and materials a TPMO creates for multiple MA organizations need each organization's review first. In practice, your ads, mailers, landing pages and scripts go through your carriers and upline compliance first. No approval, no launch.

Vetting lead vendors

Before you buy, ask every vendor:

• Show me the exact consent language and where it's collected. Does it name each entity receiving the data?

• Do you tell people their information goes to a licensed agent, and tell callers before a transfer to an agent who can enroll them? CMS requires both under 422.2274(g)(3).

• Are calls recorded and kept to the CMS standard, and will you share the recording?

• Where does the lead come from, and who else touched it? TPMO contracts with plans must require disclosure of subcontracted lead generation under 422.2274(g)(2)(i).

• Is it exclusive or shared, and how many agents get the same person?

If a vendor can't answer clearly, that's your answer.

A 90-day lead plan template

Fill in your own budget and pick two or three channels. If you're reading this during AEP, do the setup now, work the season with the AEP 2027 playbook and start the tests when your calendar opens up.

How Brock supports agent lead generation

We're an FMO, so read this with that in mind. Here's what Brock provides, plainly: GoGuruX, our CRM and enrollment platform, and the Brock Portal, which covers contracting status, production and commission reports, training and certification tracking and a marketing resource library. Both are on our tools page. Our agent resources page puts contracting, certifications and training in one place, and our team page shows the marketing and compliance people you'd work with.

Training runs through Agent Bootcamp, Behind the Agency and our weekly webinars, all on our events page. There's also Medicare Monsters by Brock, our agent community, and Brockapalooza, our invite-only gathering for Brock partners in September 2027.

FAQs

What is the best lead source for Medicare agents?

There isn't one best source. The best mix is the channels you can work consistently and measure by placed, retained business. For most agents that means referrals, T65 outreach and local presence first, with events, direct mail and paid ads added as budget and systems allow.

Are bought Medicare leads worth it?

They can be, if the vendor's consent and compliance are solid, you follow up fast and you track return all the way to retained business. Buying leads isn't the same as building your own lead flow, so treat them as a supplement, not the whole plan.

Can Medicare agents cold call?

No. CMS prohibits unsolicited telephone contact for Medicare Advantage and Part D marketing, including cold calls, robocalls, texts, voicemails and calls based on referrals, plus door-to-door visits without an appointment. Contact people who reached out or gave permission, like a returned reply card, and follow federal TCPA and do-not-call rules for every call and text.

Do I need consent to use or share Medicare leads?

Yes. You need the right consent to call or text under FCC rules, and CMS allows beneficiary data to be shared between TPMOs only with prior express written consent that names each entity receiving it. Consent rules have changed recently, so have compliance review your consent language before you collect, buy or share any leads.

Do Medicare lead calls have to be recorded?

Yes. CMS requires marketing and sales calls, including the audio of web-based calls, to be recorded in full and kept at least six years, with audio for the first three. The enrollment portion of a phone call is also recorded as the enrollment record, which is kept for ten years. Check carrier and upline storage requirements too.

How long should I test a new lead channel?

Long enough to work a meaningful number of leads all the way to placed policies. Set the time window and budget before you start, change one thing at a time and judge the result by your own CRM data, not the vendor's dashboard.

The Bottom Line

Leads are rented. Lead flow is owned. Pick a few channels, run them inside the rules, follow up fast and judge everything by placed and retained business.

Build the system. Follow the rules. Work every lead. Keep the client.

Want help building lead flow you own? Book a call with Brock Partners and we'll walk through your plan.