Medicare Call Recording Retention: What Changed for 2027

Every Medicare marketing and sales call you make has to be recorded, that part hasn’t changed. What changed is how long you’re on the hook for keeping it, and in what format. CMS’s Contract Year 2027 Medicare Advantage and Part D final rule rewrote the retention requirement at 42 CFR 422.2274(g)(2)(ii) and 423.2274(g)(2)(ii): marketing and sales call recordings now sit on a 6-year clock instead of the 10-year window most agencies had been building their storage policy around, and years four through six can be a transcript instead of the original audio file (Cornell LII, 42 CFR § 423.2274). It’s a smaller rule than the 48-hour SOA repeal that dominated agent group chats this spring, and it’s also one almost nobody outside a compliance department has actually read.

What actually changed, in plain terms

CMS’s Contract Year 2027 Medicare Advantage and Part D final rule, published in the Federal Register on April 6, 2026 as document 2026-06600 (91 FR 17384), took effect June 1, 2026 (Federal Register, document 2026-06600). Per the rule’s own text, “the new marketing and communications policies in this rule are applicable for all contract year 2027 marketing and communications, beginning October 1, 2026” — two weeks before the 2026 Annual Enrollment Period opens on October 15 (CMS, Medicare Open Enrollment partner resources).

The actual regulatory text at 42 CFR 423.2274(g)(2)(ii), and its identical MA counterpart at 422.2274(g)(2)(ii), now reads to the effect that TPMOs must record all marketing and sales calls, including the audio portion of calls made through web-based technology like Zoom, in their entirety, and retain them for a minimum of 6 years. For the first 3 years of that window, the recording has to stay in audio format. For years 4, 5, and 6, you can keep either the original audio or a complete and accurate transcript (Cornell LII, 42 CFR § 423.2274; 42 CFR § 422.2274).

That’s a genuinely new, specific number. Before this rule, most agencies treated marketing call recordings the same way they treated everything else in a Medicare Advantage file: keep it 10 years, because that’s the general recordkeeping standard under 42 CFR 422.504(d), which requires MA organizations to maintain books, records, documents, and other evidence of accounting and compliance practices for 10 years (Cornell LII, 42 CFR § 422.504). CMS never published a rule specifically shortening call recordings from 10 years to 6 as a stated before-and-after — what it did was carve out call recordings as their own category with their own, shorter number, distinct from the general 10-year rule that agencies had been applying to everything by default. The practical effect is the same either way: you now have a specific, shorter number to build a policy around, instead of defaulting to the longest number in the rulebook because nobody wrote you a shorter one.

Why one call recording rule got shorter while everything else stayed the same

CMS doesn’t explain every line of a 219-page final rule in its public fact sheet, and this one is no exception — the agency’s own summary of the CY2027 rule doesn’t call out the retention change by name. What the fact sheet does say is that this rule is part of a broader marketing rollback: CMS describes “removing restrictions on the time and manner by which beneficiaries can have conversations with licensed agents and brokers” as one of the rule’s changes (CMS, Fact Sheet: Contract Year 2027 Medicare Advantage and Part D Final Rule). The 48-hour SOA repeal, which we covered separately, is the headline version of that rollback. The shorter recording retention window reads as the same instinct applied to the back end of the process instead of the front end: fewer standing obligations on agents and TPMOs, not more.

That doesn’t mean the recording requirement itself got easier. It’s still full-call, still every marketing and sales conversation, still both directions of inbound and outbound. What got easier is the storage tail — six years of holding audio and paying for the infrastructure to store, encrypt, and retrieve it is a real and recurring cost, and CMS just cut that specific tail by 40%, with an explicit option to compress years four through six down to a text file once the format allows it. If you’ve been assuming 10 years because that’s what everyone told you two AEPs ago, you’ve been over-retaining audio you’re no longer required to keep in that format — which isn’t a violation, but it is spend you don’t have to carry.

What it costs to get the retention window wrong

CMS’s civil monetary penalty schedule, published under 45 CFR 102.3 and updated annually for inflation, sets a maximum of $48,833 per violation, as of the 2025 table, for a Medicare Advantage organization that fails to comply with marketing restrictions or the regulations and guidance that implement them, under the authority at 42 U.S.C. 1395w-27(g)(1) (Cornell LII, 45 CFR § 102.3). Recording and retention requirements live inside that same “marketing restrictions and implementing regulations” bucket, since they’re part of 422.2274, the section governing TPMO oversight under the marketing rules. That figure is a ceiling per violation, set by the penalty schedule itself, not a number tied to any specific enforcement action against a recording gap — CMS hasn’t published a case that isolates this exact fact pattern. What the schedule tells you is the scale CMS has authorized itself to use if a program audit turns up a documented gap: not a warning letter, a five-figure exposure per finding.

The other cost is quieter and shows up whether or not CMS ever asks for a specific file: storage you’re paying for past the point you’re required to. If your dialer, your CRM, or your compliance vendor has been keeping full audio for 10 years because that was the safe assumption before this rule, you’re carrying storage and encryption cost on years 7 through 10 that the current regulation doesn’t require in that format anymore. That’s not a violation in the other direction — over-retaining isn’t illegal — but it’s real, recurring spend that a policy update can trim once you’ve confirmed the shorter number applies to what you’re actually storing.

The manual way to build a compliant retention policy, step by step

None of this requires software you don’t already have. Here’s the checklist, run once and then checked quarterly.

The disclaimer that’s now permanently on tape

Under 42 CFR 422.2267(e)(41), if you don’t represent every Medicare Advantage organization available in a beneficiary’s service area, you’re required to disclose language to this effect: “We do not offer every plan available in your area. Currently we represent [insert number] organizations which offer [insert number] products in your area. Please contact Medicare.gov or 1-800-MEDICARE to get information on all of your options.” If you do represent every plan in the area, the required version drops that first sentence and keeps the rest (Cornell LII, 42 CFR § 422.2267). The regulation requires this be conveyed verbally on sales calls before you discuss any plan benefits, electronically in email or online chat, prominently displayed on your website, and included in all print and broadcast marketing materials.

That disclaimer isn’t new. What’s new, functionally, is what happens to it once you say it: it’s now sitting inside a recording that CMS expects you to be able to produce for up to 6 years. Getting the wording wrong, skipping it, or saying it after you’ve already started walking through plan benefits used to be the kind of mistake that only mattered if someone complained. Now it’s provably on tape, retrievable, for six years. A CMS program audit doesn’t have to take your word for whether you read it correctly — the recording either has it in the right place or it doesn’t.

The consent layer CMS never mentions: your state’s own recording law

CMS’s recording mandate tells you that you have to record the call. It says nothing about whether you’re legally allowed to, in your state, without saying something first — and that’s a separate question, governed by state wiretapping law, not CMS. Most states are “one-party consent,” meaning you, as a participant on the call, can record it without saying anything, because your own consent is enough. A meaningful minority require all-party consent instead, and getting this wrong isn’t a CMS compliance issue, it’s a criminal one.

California is one of them. Penal Code 632 makes it a crime to “intentionally and without the consent of all parties to a confidential communication” use a recording device to record it, with a first violation carrying a fine up to $2,500, up to a year in county jail, or both, and repeat violations rising to a $10,000 fine (FindLaw, California Penal Code § 632). Florida is another. Statute 934.03 prohibits intercepting a wire, oral, or electronic communication without the consent of all parties, subject to a specific consent exception at subsection 2(d), and treats violations as felonies or misdemeanors depending on the circumstances (Florida Legislature, Fla. Stat. § 934.03).

The practical fix costs nothing: add a short, plain disclosure at the top of the call, “this call is being recorded for quality and compliance purposes,” before you get into the TPMO disclaimer or any plan discussion. In a one-party state, that line isn’t legally required but it’s good practice and doubles as proof of disclosure. In an all-party state, it’s the difference between a lawfully recorded, CMS-compliant call and a recording that’s simultaneously satisfying a federal retention mandate and violating a state criminal statute. Check your own state’s rule specifically — this article covers two examples, not all fifty, and state law is exactly the kind of detail that changes without a federal press release announcing it.

What happens once those transcripts leave the phone system

Here’s the part almost nobody’s thinking about yet. Once your dialer or CRM hands you a transcript instead of raw audio, years 4 through 6 under the new rule, or even a same-day transcript your softphone generates automatically, you now have a searchable, shareable text file of a real conversation with a real beneficiary. And the obvious next move for a lot of agents is going to be pasting that transcript into ChatGPT or a similar general-purpose AI tool to check whether the disclaimer landed in the right spot, summarize the call for a manager, or draft a QA note.

Don’t do that with a tool that hasn’t signed a Business Associate Agreement with you. A call transcript that names a real person and touches their Medicare status, health condition, or plan choice is exactly the kind of protected health information a general-purpose AI vendor without a BAA isn’t a safe destination for. This is also where the NAIC’s Model Bulletin on the Use of Artificial Intelligence Systems by Insurers, adopted by NAIC membership in December 2023, becomes directly relevant: it sets the expectation that AI-supported decisions and actions comply with all applicable insurance laws and regulations, establishes governance expectations for how insurers use AI, and puts insurers on notice of the kind of documentation a state insurance department may request during an investigation or exam (NAIC, Insurance Topics: Artificial Intelligence). A workflow that runs client call transcripts through an unvetted AI tool with no oversight or record of what happened is exactly the gap that expectation is aimed at.

This is where Ambrose’s PHI Rail is built to solve exactly this problem — not by adding a call-recording feature, but by sitting between an agent and any AI destination. Per Ambrose’s own architecture documentation, PHI Rail runs a redact-then-rehydrate pipeline: when a prompt or file comes in, the system checks whether the destination is on the agency’s BAA allowlist. If it is, the data passes through unchanged. If it isn’t, PHI Rail calls its phi-gateway spoke to scrub identifiers and return a payload of typed aliases, PERSON_xxxx, EMAIL_xxxx, and so on, along with a hydration map, so the AI model sees a coded version of the conversation instead of the real names and details. When the model’s response comes back, phi_rehydrate splices the real identifiers back in before the answer reaches you (Ambrose docs, arch-phi-rail).

The phi-gateway spoke itself is listed in Ambrose’s current spoke catalog as a “PHI scrubber + re-hydrator” with a “safe” HIPAA posture, meaning it’s designed to run local-only rather than sending raw identifiers to an external model (Ambrose docs, Spokes catalog, fetched August 2026). Every scrub event gets logged, timestamp, source, and identifier counts, but never the actual values, through phi_audit_query, which is the kind of documentation trail a program auditor or a state exam would actually want to see. That catalog also lists agent-vault and client-vault, an agency’s private book-of-business store and a client-facing enrollment and policy store, both marked “safe” posture, as the tenant-scoped places that kind of material can actually live once it’s off the phone system.

To be direct about the boundary here: Ambrose doesn’t currently ship a dedicated call-recording or transcription spoke of its own — that’s not in its live spoke catalog as of this writing, and this article isn’t going to claim otherwise. What it does, confirmed and documented, is give you a safe way to put a transcript your phone system already generated in front of an AI model without that model — or whatever’s on the other end of it — ever seeing the beneficiary’s real name, number, or health details. If you’re already recording and retaining calls the way this rule requires, that’s the piece that keeps the next step, actually using those files for QA or coaching, from becoming its own HIPAA problem.

What you get by joining

One Ambrose seat, including the PHI Rail and the phi-gateway, agent-vault, and client-vault spokes, comes with a Tech Savvy Insurance membership: $97 a month, billed monthly, cancel anytime, founding rate locked in while the membership stays active. Alongside the seat: weekly Zoom calls with open Q&A and build-with-you sessions, 30+ hours of recorded training, Meta Ads, AI, and marketing training built specifically for this industry, pre-built AI templates and bot deployments, and a free annual in-person member workshop. It’s also an explicit no-recruiting zone — you can ask a real compliance question about your call recording policy without ending up on someone’s downline pitch list.

Compliance: what this touches, and what it doesn’t

If you market or sell Medicare Advantage or Part D coverage and get compensated to do it, you’re a TPMO under 42 CFR 422.2260, and the recording, retention, and disclaimer rules covered here apply to you directly, not just to the carrier or upline you work with. That includes the multi-plan disclaimer requirement at 422.2267(e)(41) covered above, and the recording retention window at 422.2274(g)(2)(ii) and 423.2274(g)(2)(ii). None of this article is legal advice, and CMS guidance and enforcement priorities shift — confirm your own agency’s specific obligations with CMS’s Medicare Communications and Marketing Guidelines, your upline’s compliance team, or qualified counsel before finalizing a retention policy.

If you’re using AI tools anywhere in your call-review, QA, or coaching workflow, the NAIC’s Model Bulletin on the Use of Artificial Intelligence Systems by Insurers sets the expectation regulators increasingly apply: AI-supported decisions have to comply with applicable insurance law, insurers need governance around how the tools are used, and documentation has to be available if a state department of insurance asks for it (NAIC, Insurance Topics: Artificial Intelligence). Ambrose is HIPAA-aware by default, not HIPAA certified — there’s no such thing as HIPAA certification for a software platform, and any vendor claiming otherwise is worth a second look.

The close

Six years, audio for the first three, audio or a clean transcript for the last three, and enrollment records still on their own separate ten-year track. That’s the whole rule, and building a one-page policy around it costs nothing and takes an afternoon, whether you ever join anything or not. If you’d rather have someone double-check the policy with you, and see how PHI Rail keeps a transcript safe once you’re ready to put it in front of an AI tool, one Ambrose seat comes with a Tech Savvy membership, and the weekly build-with-you calls are where agents actually set this up on their own book: https://techsavvyinsurance.com/.