AI Starts the Holiday Shop, but Trust Still Stops at Checkout

For Medicare Advantage marketers, October usually brings more rules. This year it brings fewer. From October 1, CMS's Contract Year 2027 marketing changes remove a notice, relax limits on when and where plans can talk to people with Medicare, drop the paperwork behind superlatives and shorten how long call recordings must be kept. The Annual Enrollment Period opens two weeks later, on October 15, and runs to December 7. The easing is real, but it covers the sales conversation, not the data trail behind the digital campaigns that feed it.

What Actually Changes on October 1

The CMS partner tip sheet, dated September 2026, lists six changes that apply to all CY2027 marketing and communications materials. The most important for acquisition teams concern timing. Plans can now hold a marketing event directly after an educational event in the same location, provided attendees are told and given the opportunity to leave. Personal marketing appointments can be scheduled any time after a Scope of Appointment form is completed, and those forms can now be collected at educational events themselves.

Creative gets more room too. Materials that use superlatives such as “best” or “most” no longer need supporting documents included, although CMS notes that plans must in many cases still provide the supporting data if it asks. The third-party marketing organisation disclaimer drops State Health Insurance Assistance Programs as a listed resource, and it must now be given verbally before benefits are discussed rather than within the first minute of a call.

Two obligations disappear outright: the Notice of Availability of language assistance services, which CMS says duplicated an HHS Office for Civil Rights requirement, and the mid-year notice telling enrollees about supplemental benefits they have not yet used. Call recording retention falls from 10 years to 6, with transcripts permitted in place of recordings for years 4 to 6. The changes flow from the CY2027 final rule, which CMS presented in April partly as removing restrictions on the time and manner of beneficiaries' conversations with licensed agents and brokers.

A Large, Concentrated and Slowing Prize

The size of the market explains why these details matter. KFF's 2026 enrollment update counts 35.2 million Medicare Advantage enrollees, 55% of eligible beneficiaries. Growth is slowing, though. Enrollment rose by about 1.1 million, or 3%, and special needs plans accounted for 85% of the net increase. UnitedHealth Group and Humana together hold 46% of enrollment, with Humana rising from 17% to 20% while UnitedHealth fell from 29% to 26%.

A slower-growing market in which share is moving is a switching market, and the switching is concentrated into a 54-day window. A faster path from event to appointment and more freedom in advertising claims are precisely the levers acquisition teams will pull this autumn. That puts more weight on the digital top of the funnel: the search, social and programmatic campaigns that send people to plan finders, quote tools and event sign-up pages.

The Rule That Did Not Move

Nothing in the tip sheet touches web tracking, and HIPAA has not changed. For a health plan, a visitor researching coverage on its site is often a member or a prospective one, and the analytics and advertising tags on those pages sit in the same territory that has generated years of pixel litigation.

The Piwik PRO healthcare tracking report, produced with Verified Data, audited 59 major US hospital and clinic websites, crawling up to 25 pages on each from California with an active Global Privacy Control signal. 43 of the 59 sites, or 73%, had advertising or marketing trackers running anyway. Across the sample it found 75 distinct tracking tools, 38 for analytics and 37 for advertising or call tracking, with Google Marketing Platform present on 33 sites. Providers rather than payers were audited, but the tag stacks involved are the ones insurers use too.

The report's most useful detail is the small gap between the 73% of sites with trackers and the 69% using marketing or advertising cookies. Some tracking ran without cookies at all, which means a cookie banner on its own would not have stopped it. Call tracking belongs in the same picture, and Medicare marketing is heavily phone-led.

The cost of getting it wrong keeps adding up. HIPAA Journal reported in August on five more provider settlements over pixels and tracking tools, including $9.5 million from Penn Medicine and $800,000 from Concord Hospital Health System, with every organisation denying wrongdoing. None was a health plan, but an enrollment season that pushes more traffic through more tags is the wrong moment for plans to assume the same exposure stops at the hospital door.

An Enrollment Playbook for Looser Rules

• Map every path from event to appointment. With appointments allowed any time after a completed Scope of Appointment, the form becomes the gate, so capture, store and time-stamp it the same way wherever it is collected.
• File the evidence behind every superlative. Supporting documents no longer travel with the material, but CMS can still ask for the data, so keep it ready before the claim goes live.
• Rewrite scripts for the disclaimer's new position. The TPMO disclaimer now has to come before benefits are discussed, which is a script change for every agent and vendor rather than a timing tweak.
• Rework retention, not just the schedule. Six years instead of ten, with transcripts allowed from year four, only saves money if recordings and transcripts are indexed well enough to retrieve on request.
• Audit tags on quote and plan finder pages before October 15. Test with a Global Privacy Control signal switched on, and look for cookieless trackers and call tracking scripts, not just cookies.
• Build creative for a 54-day window. Enrollment runs from October 15 to December 7, so make a small set of core assets that can be cut down for every channel rather than a new asset per placement.

CMS has made the sales conversation easier to start. It has done nothing to make the data behind the ad that started it any safer, and in a slowing market where share is on the move, plans that treat those as separate problems are likely to discover they are the same one.