TL;DR
Beginning in 2026, CMS removed the 48-hour waiting period between completing a Scope of Appointment and holding the personal marketing appointment. That speeds up the moment of yes — it does not lower the bar on documentation. Strong agencies still capture a clean SOA, secure email/SMS/website consent, complete A2P registration before AEP, and maintain communication records for retention requirements. Speed plus proof is the new standard.
Why it matters
Why this change actually matters
Modern Medicare sales are becoming easier. CMS removed the long-standing 48-hour waiting requirement between completing a Scope of Appointment and holding a personal marketing appointment.
Beginning in 2026, agents may now move more quickly when beneficiaries are ready to have a conversation. That removes friction at exactly the moment most enrollments are won or lost — the moment of yes.
While the delay requirement has changed, proper documentation remains just as important. Strong agencies continue to focus on capturing consent, maintaining records, and communicating through approved channels to protect both their clients and their business.
0hrs removed
the SOA waiting period eliminated for 2026 — under the CY2027 Medicare Advantage and Part D Final Rule
CMS · Issued April 2, 2026
Speed without proof is a trap
The change is real, and it's a gift to clients who are ready to act. But the agencies that benefit most are the ones whose process was already clean — because removing the wait only helps if the SOA, consent, and record are still captured correctly.
The new standard isn't 'move fast.' It's move fast and prove it — every appointment, every channel, every record.
Good processes create confidence
Electronic Scope of Appointment
A digital, e-signed SOA captured before every marketing or sales appointment — automatically attached to the client record. No paper. No 'I'll send it later.'
- Use an e-signature workflow your producers can send in under 30 seconds
- Auto-attach the signed SOA to the client record on completion
- Block the appointment from being marked complete without an SOA on file
- Retain SOAs for the carrier-required period (at least 6 years) in a retrievable system
- Audit a random sample of SOAs each quarter for completeness
Tooling note · If the SOA lives in someone's email, it doesn't live in the file. Capture it where the client record lives.
Email · SMS · Website consent
Channel-specific consent — captured cleanly at the point of opt-in — so every later touch is something the client agreed to receive.
- Use clear, plain-language disclosures on every web form
- Capture and timestamp opt-in for email and SMS separately (not bundled)
- Honor opt-outs immediately across every system that sends
- Keep a per-contact consent history you can produce on request
- Review your website forms each summer against current CMS marketing guidance
Tooling note · Channel-specific consent is the difference between 'they're on our list' and 'they asked to hear from us.'
Contact record — automatically stored
One client record that captures SOA, consent, communication history, A2P registration status, and audit-readiness — without producer effort.
- Pick one system of record (CRM) — not three half-systems
- Auto-log every email, SMS, and call against the contact
- Surface SOA status, consent status, and last-contact date on the contact view
- Restrict access to PHI by role; no shared logins
- Make 'is this contact audit-ready?' a one-glance answer, not a project
Tooling note · If a producer has to remember to log something, you've already lost some of it. Automation is the compliance layer.
A2P 10DLC registration before AEP
Application-to-person SMS from a 10-digit number now requires carrier-approved brand and campaign registration. Without it, your texts get filtered or dropped — quietly.
- Submit brand registration in July, not September
- Register a campaign for each use case (appointment reminders, AEP outreach, service)
- Confirm your SMS platform is sending through registered numbers
- Monitor message deliverability weekly during AEP
- Keep registration confirmation records with your compliance file
Tooling note · Unregistered A2P traffic is the silent killer of AEP outreach — the texts 'go through' but the carrier drops them mid-route.
Retention-grade recordkeeping
Communication records that survive a CMS or carrier inquiry — organized, retrievable, and complete across every channel you use.
- Retain SOAs, recordings, and enrollment docs per the CY2027 rule (recordings 6 years; SOAs/enrollments per carrier minimums)
- Store email and SMS history against the contact, not just in the sender's inbox
- Document a written retention and destruction schedule
- Run an annual retrieval drill: pick a random client, produce the full file in under 10 minutes
- Back up critical records to a secondary, access-controlled location
Tooling note · The audit question isn't 'do you have it?' It's 'can you produce it today?' Practice the retrieval, not just the storage.
Bonus insight
Permission compounds
Every clean SOA, opt-in record, and stored conversation is one less question on audit day and one more reason the client picks up next year. The agencies that win 2026 are the ones whose consent layer is invisible to the client and bulletproof to the regulator.
- Make consent capture a single click for the client and unskippable for the producer
- Pick one system of record for SOA + communication history — not three
- Treat A2P registration as a July task, not a September one
Old workflow vs. modern workflow
Compliance isn't about slowing down. It's about creating trust and protecting your agency.
Timeline
A small change with big benefits
Step 01
Move when the client is ready
Removing the 48-hour waiting period eliminates unnecessary friction for agents and beneficiaries — close the loop the same day the client says yes.
Step 02
Never trade speed for documentation
The SOA still matters. Consent still matters. Good recordkeeping still matters. Speed without proof is a liability.
Step 03
Make the right path the easy path
Build workflows where capturing an SOA, logging consent, and storing the record happens automatically — not through producer memory.
Step 04
Treat A2P as infrastructure
Get brand and campaign registration done in July. By October, you want SMS deliverability, not a registration ticket.
Step 05
Audit yourself before anyone else does
Run a quarterly file drill. Find the gaps in May, not in the middle of a CMS inquiry in November.
Permission & communication — pre-AEP readiness checklist
Key takeaways
- The 48-hour SOA delay is gone — but the SOA itself, and the documentation around it, still matters.
- Consent now spans three channels: electronic SOA, email/SMS/website opt-in, and the automatically stored contact record.
- A2P 10DLC SMS registration must be completed before AEP, not during it — registration takes weeks.
- Approved channels + retention-grade recordkeeping protect both the client and the agency from CMS or carrier scrutiny.
- Modern CRM workflows make compliance the default path, not an extra step a producer has to remember.
Frequently asked
FAQs
- Did CMS really remove the 48-hour SOA waiting period?
- Yes. The Contract Year 2027 Medicare Advantage and Part D Final Rule, issued April 2, 2026, removed the long-standing 48-hour waiting requirement between completing a Scope of Appointment and holding a personal marketing appointment. Beginning in 2026, agents may move more quickly once a beneficiary is ready to have a conversation.
- Does that mean the SOA itself is going away?
- No. The SOA is still required for any pre-scheduled marketing or sales appointment involving MA, MAPD, PDP, or other CMS-regulated products. What changed is the timing rule — not the obligation to capture, retain, and produce the SOA on demand.
- What is A2P 10DLC and why do I need it before AEP?
- A2P 10DLC is the U.S. carrier registration system for application-to-person SMS sent from standard 10-digit phone numbers. Without it, texts to clients are increasingly filtered or blocked. Registration involves brand and campaign approval that can take 2–6 weeks — finish it well before October, not in the middle of AEP.
- What counts as 'approved channel' communication?
- Channels where the beneficiary has given documented, channel-specific consent — email opt-in, SMS consent (with A2P-registered sender), website forms with clear disclosures, and recorded phone consent. Approved doesn't just mean 'they answered.' It means you can prove they agreed to be contacted that way.
- How long do I have to keep communication records?
- Under the CY2027 Final Rule (effective June 1, 2026), sales and marketing call-recording retention dropped from 10 years to 6 years. Most other Medicare records — SOAs, enrollment documentation — should still be retained for the longer of carrier-required periods and 6 years. Communication records (email, SMS, contact history) should be retained at least as long as the underlying enrollment, stored in a retrievable system, not scattered across inboxes.
Authoritative sources
Related reading
From the printed guide
This lesson's one-pager
Preview the printed page for this lesson, or download just this page as a standalone PDF.
From the 2026 Readiness Guide
Lesson 01 — printable one-pager
Keep going
.png)
