Compliance Forms Library
The forms agents reach for, in one place.
Scope of Appointment, Permission to Contact, HIPAA, pre-enrollment checklists. Each entry links to the official source — because agents may never design custom SOA text from scratch.
Verify the current plan-year version with your carrier or CMS before use. GoAEP provides these as educational references — not legal or compliance advice.
- SOAReviewed 2026-06
Scope of Appointment (SOA) — English
The CMS-required document capturing which Medicare product lines a beneficiary agrees to discuss before any personal marketing meeting.
- What it's for
- Documents the specific product lines (MA, MAPD, PDP, Medigap, D-SNP, etc.) the beneficiary agrees to discuss with an agent.
- When to use it
- Before any pre-scheduled personal marketing or sales appointment. The CY2027 Final Rule (effective June 1, 2026) eliminated the 48-hour waiting period — same-day SOA → meeting is now allowed, but the signed SOA is still mandatory.
- •Agents may NOT design custom SOA text. Use a carrier-approved form or CMS model language.
- •In-person personal marketing meetings require a written SOA. Telephonic/virtual appointments may use electronic or audio signatures.
- SOAReviewed 2026-06
Alcance de la Cita (SOA) — Español
Spanish-language Scope of Appointment. Required when the marketing conversation is conducted in Spanish.
- What it's for
- Documents agreed-upon product lines for Spanish-speaking beneficiaries.
- When to use it
- Before any pre-scheduled personal marketing or sales appointment with a Spanish-speaking beneficiary. Same 2026 rule changes apply.
- •Match the language of the SOA to the language of the appointment.
- •Most carriers publish both EN and ES PDFs on the same agent portal page.
- PTCReviewed 2026-06
Permission to Contact (PTC)
Documents a beneficiary's explicit consent to be contacted by the agent — required before any unsolicited outreach.
- What it's for
- Captures the contact methods the beneficiary authorizes (phone, text, email) and the specific products they want to be contacted about.
- When to use it
- Before making any unsolicited phone calls, texts, or emails. Valid for 12 months from signature, or through the enrollment period it was collected for — whichever is shorter.
- •Method-specific. If the beneficiary only checked Email, you cannot legally call them.
- •There is no single CMS model PTC — FMOs, carriers, and compliant lead vendors create their own. The required CMS marketing disclaimers must be visible.
- PTCReviewed 2026-06
Business Reply Card (BRC) Sample
Direct-mail card or digital lead form that doubles as Permission to Contact when the required CMS disclaimers are clearly displayed.
- What it's for
- Captures interest and contact permission from beneficiaries responding to a mailer, ad, or landing page.
- When to use it
- Any time a beneficiary opts in via mail, web form, or QR code campaign. Pair with your CRM intake and store the original timestamp.
- •Must carry the TPMO disclaimer and identify which product types the contact is being authorized for.
- •Capture the form image and timestamp — a printed BRC alone isn't enough on audit; you need the proof you received it.
- EnrollmentReviewed 2026-06
Pre-Enrollment Checklist (CMS Model)
The CMS model checklist beneficiaries must review before enrolling in a Medicare Advantage or Part D plan.
- What it's for
- Confirms the beneficiary understands plan rules (network, prior auth, drug coverage) before signing the enrollment.
- When to use it
- Walk through it with the beneficiary before completing any MA/MAPD/PDP enrollment — paper, telephonic, or digital.
- HIPAAReviewed 2026-06
HIPAA Authorization (Sample)
Authorization allowing the agent to discuss a beneficiary's protected health information with carriers or designated parties.
- What it's for
- Lets the agent assist with claims, appeals, or family-member conversations on behalf of the beneficiary.
- When to use it
- When a beneficiary asks you to help with a claim, formulary appeal, or wants a spouse/adult child included in conversations.
- •Most carriers publish their own HIPAA form — use the carrier's version when available.
- •Authorizations have an expiration date — track it in the client record.
- ChecklistsReviewed 2026-06
Enrollment Verification Checklist
Internal QA checklist agents run after each enrollment to confirm SOA, PTC, recording, and documentation are on file.
- What it's for
- Catches missing artifacts before the carrier flags them — keeps your audit file tight.
- When to use it
- Within 24 hours of every MA/MAPD/PDP enrollment, before closing the client record.
- •Pair with your CRM's audit view — a clean record on submission saves hours on chargeback disputes.
.png)

