Compliance Forms Library

The forms agents reach for, in one place.

Scope of Appointment, Permission to Contact, HIPAA, pre-enrollment checklists. Each entry links to the official source — because agents may never design custom SOA text from scratch.

Verify the current plan-year version with your carrier or CMS before use. GoAEP provides these as educational references — not legal or compliance advice.

  • SOAReviewed 2026-06

    Scope of Appointment (SOA) — English

    The CMS-required document capturing which Medicare product lines a beneficiary agrees to discuss before any personal marketing meeting.

    What it's for
    Documents the specific product lines (MA, MAPD, PDP, Medigap, D-SNP, etc.) the beneficiary agrees to discuss with an agent.
    When to use it
    Before any pre-scheduled personal marketing or sales appointment. The CY2027 Final Rule (effective June 1, 2026) eliminated the 48-hour waiting period — same-day SOA → meeting is now allowed, but the signed SOA is still mandatory.
    • Agents may NOT design custom SOA text. Use a carrier-approved form or CMS model language.
    • In-person personal marketing meetings require a written SOA. Telephonic/virtual appointments may use electronic or audio signatures.
  • SOAReviewed 2026-06

    Alcance de la Cita (SOA) — Español

    Spanish-language Scope of Appointment. Required when the marketing conversation is conducted in Spanish.

    What it's for
    Documents agreed-upon product lines for Spanish-speaking beneficiaries.
    When to use it
    Before any pre-scheduled personal marketing or sales appointment with a Spanish-speaking beneficiary. Same 2026 rule changes apply.
    • Match the language of the SOA to the language of the appointment.
    • Most carriers publish both EN and ES PDFs on the same agent portal page.
  • PTCReviewed 2026-06

    Permission to Contact (PTC)

    Documents a beneficiary's explicit consent to be contacted by the agent — required before any unsolicited outreach.

    What it's for
    Captures the contact methods the beneficiary authorizes (phone, text, email) and the specific products they want to be contacted about.
    When to use it
    Before making any unsolicited phone calls, texts, or emails. Valid for 12 months from signature, or through the enrollment period it was collected for — whichever is shorter.
    • Method-specific. If the beneficiary only checked Email, you cannot legally call them.
    • There is no single CMS model PTC — FMOs, carriers, and compliant lead vendors create their own. The required CMS marketing disclaimers must be visible.
  • PTCReviewed 2026-06

    Business Reply Card (BRC) Sample

    Direct-mail card or digital lead form that doubles as Permission to Contact when the required CMS disclaimers are clearly displayed.

    What it's for
    Captures interest and contact permission from beneficiaries responding to a mailer, ad, or landing page.
    When to use it
    Any time a beneficiary opts in via mail, web form, or QR code campaign. Pair with your CRM intake and store the original timestamp.
    • Must carry the TPMO disclaimer and identify which product types the contact is being authorized for.
    • Capture the form image and timestamp — a printed BRC alone isn't enough on audit; you need the proof you received it.
  • EnrollmentReviewed 2026-06

    Pre-Enrollment Checklist (CMS Model)

    The CMS model checklist beneficiaries must review before enrolling in a Medicare Advantage or Part D plan.

    What it's for
    Confirms the beneficiary understands plan rules (network, prior auth, drug coverage) before signing the enrollment.
    When to use it
    Walk through it with the beneficiary before completing any MA/MAPD/PDP enrollment — paper, telephonic, or digital.
  • HIPAAReviewed 2026-06

    HIPAA Authorization (Sample)

    Authorization allowing the agent to discuss a beneficiary's protected health information with carriers or designated parties.

    What it's for
    Lets the agent assist with claims, appeals, or family-member conversations on behalf of the beneficiary.
    When to use it
    When a beneficiary asks you to help with a claim, formulary appeal, or wants a spouse/adult child included in conversations.
    • Most carriers publish their own HIPAA form — use the carrier's version when available.
    • Authorizations have an expiration date — track it in the client record.
  • ChecklistsReviewed 2026-06

    Enrollment Verification Checklist

    Internal QA checklist agents run after each enrollment to confirm SOA, PTC, recording, and documentation are on file.

    What it's for
    Catches missing artifacts before the carrier flags them — keeps your audit file tight.
    When to use it
    Within 24 hours of every MA/MAPD/PDP enrollment, before closing the client record.
    • Pair with your CRM's audit view — a clean record on submission saves hours on chargeback disputes.

Provided by Lync. Insurance technology for agents, by agents — keeping GoAEP free for the industry.