CMS lacks adequate safeguards to stop agents and brokers from enrolling individuals into ACA coverage or switching their plans without consent, according to a report from the Government Accountability Office published July 13.
More than 19 million people were enrolled in ACA coverage as of February, and about 96,000 agents and brokers were registered with the federal marketplace as of January.
In 2024, CMS began blocking unassociated agents and brokers from making changes to marketplace enrollments and requiring three-way verification calls after a wave of consumer complaints, then proposed broader marketplace integrity rules that year, including a standardized consent form and expanded authority to hold agents accountable. In 2025, the agency finalized the tougher measures and updated its consent documentation requirements as part of a wider push under the Trump administration to tighten ACA program integrity.
Seven notes from the GAO’s report:
- Consumer complaints that CMS received and later confirmed as unauthorized ACA enrollments or plan switches rose from 66,548 in 2023 to 258,424 in 2024 and 299,604 in 2025.
- GAO reported in December that at least 160,000 federal marketplace applications for plan year 2024 had likely unauthorized changes by agents or brokers.
- GAO identified three core weaknesses in CMS controls: the agency’s processes to verify consumer consent are weak, it does not limit access to a consumer’s enrollment record to the agent or broker already tied to that enrollment, and it does not notify consumers of all agent and broker activity.
- The report also noted that the person search tool is easy to exploit. Any registered agent or broker, not only the agent of record, can pull a consumer’s full enrollment record by entering a first name, last name and date of birth. The record includes contact details, employment and income information, and the last four digits of household members’ Social Security numbers.
- Despite the previously implemented integrity measures, GAO found the three-way calls among the consumer, the agent or broker and the marketplace call center are not required for all enrollments or changes, and identity is verified using information that may be public. CMS officials and other stakeholders said unauthorized individuals have posed as consumers on those calls, and GAO previously found brokers submitted applications for two fictitious consumers with invalid Social Security numbers.
- GAO reviewed exchange policies in California, Georgia and New Mexico and found controls that exceed the federal marketplace, including one-time passcodes to confirm consumer consent, consumer notifications of enrollments and agent-of-record changes. In California specifically, there is no person search function. Officials from two of the states said unauthorized activity is not a major problem on the state exchanges.
- GAO made two recommendations, and HHS agreed with both. HHS said it is working on new requirements that would require a one-time consumer confirmation, such as a passcode, before an agent or broker can act on a consumer’s behalf, and would restrict access to a consumer’s full application to the agent or broker of record, ahead of open enrollment for 2027 coverage. CMS also told GAO in March that it was still weighing other new policies and had not made final decisions.
At the Becker's 5th Annual Fall Payer Issues Roundtable, taking place November 2–3 in Chicago, payer executives and healthcare leaders will come together to discuss value-based care, regulatory changes, cost management strategies and innovations shaping the future of payer-provider collaboration. Apply for complimentary registration now.
