How to buy Medicare Advantage calls legally and profitably

Medicare Advantage lead generation has a compliance problem, and it's not a small one. Every year, agencies get burned buying calls that look cheap on a spreadsheet but end up costing them their license, their carrier contracts, or worse. I've watched agencies scale fast on call volume, then unravel just as fast when a TCPA complaint or a CMS audit lands on their desk. Buying calls isn't the problem. Buying them without understanding the rules is.

Here's the thing: this space changed a lot between 2022 and 2024, and plenty of agents are still working off old assumptions. If you're buying Medicare Advantage calls now, you need to know what's changed. The old playbook can get you fined.

Why this market got harder to buy into

CMS finalized rules effective October 2022 requiring Third-Party Marketing Organizations, or TPMOs, to record all calls with Medicare beneficiaries in their entirety, including the sales call itself. Not just the lead gen call. The actual sales conversation. That single rule reshaped how vendors operate. Every call needs a paper trail now, and agencies buying those calls inherit some of that compliance burden whether they realize it or not.

On top of that, the FCC pushed through a one-to-one consent rule as part of a broader regulatory push running through 2023 and into 2024. This closed a loophole a lot of lead vendors leaned on for years: a single checkbox on a lead form used to count as consent for calls from dozens of unrelated buyers. Not anymore. Consent has to be tied to a specific seller now, not a marketplace of buyers hiding behind one form.

In practice, this means the $8 aged lead you bought two years ago from a vendor with a vague consent trail is a much riskier purchase today. The rules caught up to the industry's laziest habits.

What "legally" actually means when you're buying calls

Buying legally means confirming three things before you ever pay for a call: consent, disclosure, and TPMO compliance. Skip any one and you're exposed to TCPA penalties, CMS sanctions, or both, regardless of whether you personally made the call.

Let's break each one down.

Consent is the big one. The Telephone Consumer Protection Act requires prior express written consent for marketing calls to any number on the National Do Not Call Registry, and violations typically run $500 to $1,500 per call. Per call. Not per campaign. If a vendor sends you 200 calls a week and even a fraction lack proper consent, the math gets ugly fast. Ask vendors directly: how was consent captured, when, and for what specific scope of products? A vague answer is a red flag, full stop.

Disclosure is the part most new agents miss entirely. CMS requires TPMOs to state specific plans they represent and to say, word for word, "we do not offer every plan in your area." It's a scripted requirement, easy to overlook because it sounds like boilerplate. But CMS auditors listen for it. If a vendor's scripts skip that line, you're buying risk along with the lead.

Then there's the scope issue. CMS restricts unsolicited direct contact, and agents generally can't call a beneficiary based on information pulled from an unrelated plan or product without consent that actually covers that scope. This trips up agencies buying "warm" data from list brokers who scraped it from unrelated forms. That data might look fine on paper. It's often not compliant at all.

You also can't ignore state law here. State Departments of Insurance regulate telemarketing and lead-buying practices separately from CMS and the FCC, so a call that clears federal rules can still violate a state-specific requirement. Compliance isn't one checklist. It's several, stacked on top of each other, and they don't always line up.

What calls actually cost, and why price alone tells you nothing

Aged or shared Medicare Advantage leads generally run $5 to $15. Exclusive live transfer calls run much higher, often $20 to $75 or more depending on the vendor and how qualified the transfer is. That's a wide range, and it exists for a reason: exclusivity, recency, and consent quality all cost the vendor money to maintain, and they pass that cost to you.

Look, cheap leads aren't automatically bad, and expensive leads aren't automatically clean. I've seen $10 aged leads convert better than $60 live transfers because the vendor had tight consent practices and a real recording trail. I've also seen $75 live transfers turn into TCPA headaches because the vendor cut corners on disclosure scripts to boost close rates. Price is not a proxy for compliance. Ask for the consent language. Ask for a sample recording. Ask how long they retain records, since CMS expects TPMOs to keep that documentation available for audit.

Building a profitable buying process

Profitability here comes down to matching call quality to your actual close rate, not chasing the lowest cost per call. A vendor selling you $6 aged leads that convert at 2% is more expensive per sale than a $45 live transfer converting at 18%. Run the math on cost per enrollment, not cost per call. Every time.

Budget for the agent side too. Licensed agents have to complete Medicare Advantage certification every year, including AHIP training, which typically runs $175 to $200 per carrier certification cycle. Running a team of ten agents across four carriers? That's a real line item, and it needs to factor into your cost-per-sale math before you decide a lead source is "too expensive."

Here's a habit worth building: audit your vendors quarterly. Pull recordings. Check scripts against current CMS disclosure language, since it does get updated. Confirm consent capture matches what the FCC's one-to-one rule now requires. This isn't paperwork for its own sake. It's the difference between a lead source you can scale and one that gets you a cease-and-desist letter from a state regulator.

If you'd rather generate your own inbound calls instead of buying from a vendor whose compliance you can't fully verify, that's a different business model entirely, and one worth learning properly. My book, The Pay Per Call Revolution, walks through how to build that kind of program from scratch. There's a companion workbook too, if you want to build it out step by step rather than lean on someone else's pipeline.

Given how often these rules shift, and how much money is on the line if you get it wrong, it's worth having a health insurance compliance attorney or a CMS-focused consultant review your buying process at least once a year. Cheap insurance, honestly, compared to the alternative.

FAQ

Can I buy Medicare Advantage leads without a TPMO agreement in place? No. If a vendor is generating or transferring Medicare calls to you, they're functioning as a TPMO under CMS rules, and you need a documented relationship spelling out compliance responsibilities on both sides.

Do recorded calls belong to me or the vendor? Depends on your contract, but CMS requires the recordings to exist and be retrievable for audit purposes regardless of who technically owns them. Get this in writing before you buy.

Is a live transfer automatically more compliant than an aged lead? No. Recency has nothing to do with consent quality. A live transfer built on a bad consent form is just as risky as an aged lead with the same problem.

How often do CMS disclosure requirements change? Often enough that you can't assume a script from 2022 is still compliant today. Check annually at minimum, and re-check anytime CMS issues new marketing guidance.