ACA Consumer Consent Documentation: What Agents Must Keep

What CMS requires agents and brokers to document before helping an ACA Marketplace client, the five details every record needs, and how long you have to keep it.

Before you can help an ACA Marketplace client with anything — a quote, an application, an enrollment, a plan change — federal rules require you to get the consumer's consent first and keep a written record of it. The record has to name specific details, not just a signature, and you have to hold onto it for ten years. Here is exactly what CMS requires, what has to be in the record, and how to build the habit into a normal workday instead of scrambling for it during an audit.

Why This Isn't Optional

The requirement comes from the Federally-facilitated Marketplace standards of conduct for agents, brokers, and web-brokers, codified at 45 CFR 155.220(j)(2)(iii). It applies to anyone assisting a consumer with a Federally-facilitated Exchange or a State-based Exchange on the federal platform (the vast majority of states), whether you're writing new business on an ACA health insurance agent CRM, taking over an existing client's book, or just checking the status of an application. CMS does not care whether you think of this as "paperwork" — it is enforced the same way a license requirement is enforced, with the same kind of consequences for skipping it.

Two Separate Events You Have to Document

Agents sometimes assume one signed form covers everything. CMS actually requires documentation of two distinct moments, and the same document can cover both only if it clearly captures each one separately.

1. Consumer Consent

Per CMS's consumer consent FAQ, you must obtain and document consent before you:

Collect or use a consumer's personally identifiable information to provide a quote or estimate
Run a person search for a consumer's existing application through Classic Direct Enrollment or Enhanced Direct Enrollment
Actively help a consumer complete an eligibility application
Enroll a consumer in a qualified health plan
Update a consumer's eligibility application during the year
Check the status of a consumer's coverage or eligibility for financial assistance

One consent record can cover several of these actions going forward, as long as it says so — CMS doesn't require a brand-new form every time you check on a client's application if your existing documentation already authorizes it.

2. Application Review and Attestation

Separately, before you submit an eligibility application (new or updated), you have to document that the consumer reviewed the application and confirmed it's accurate, and that you explained the attestations at the end of it. This is its own record with its own timestamp — it happens after the application is filled out and before it's submitted, not at the same moment as the original consent.

What the Record Actually Has to Contain

This is where a lot of agencies fall short without realizing it. CMS does not accept a generic note that says "got consent." Under 155.220(j)(2)(iii)(B), the documentation must include:

A description of the scope, purpose, and duration of the consent
The date consent was given
The name of the consumer or their authorized representative
The name of the agent, broker, web-broker, or agency being granted consent
A process by which the consumer can rescind the consent

CMS has said directly that if an agent only writes a short note summarizing a verbal consent, and that note doesn't capture all five elements above, it does not satisfy the requirement — even though a note was made at the time. The record has to be complete, not just contemporaneous.

Acceptable Ways to Capture It

CMS does not mandate a specific format. Acceptable methods include a signed physical or electronic consent form, an email from the consumer confirming consent, a text message, or a recorded verbal conversation in which the consumer affirmatively agrees. What CMS does require is that the consumer took some action that produced a record — a typed name with no other indication of intent, or a pre-checked box the consumer never actually clicked, does not count. CMS publishes an optional model consent form and verbal script agents can adapt; using it isn't required, but it's a reasonable template if you don't already have your own.

How Long You Have to Keep It

Ten years, minimum, from the date of the enrollment or application submission — per 155.220(j)(2)(iii)(D) — and you have to be able to produce it to CMS on request for monitoring, audit, or enforcement purposes. That's longer than most agencies keep anything else client-related, and it's easy to lose track of a form signed in year one if it isn't stored somewhere permanent and searchable by contact.

What's Changing: A Standardized Form Is Coming

Right now, CMS lets you choose your own method as long as it hits the five required elements. That changes for enrollments tied to plan years beginning on or after January 1, 2028: per 155.220(j)(2)(iii)(C), documentation will have to be collected using an HHS-approved, HHS-created consumer consent form, executed by an action from the consumer (a handwritten or electronic signature, an email, or a recorded verbal conversation) — with the same rule that a typed name or a checked box alone won't qualify. That's two plan years out, not the enrollment season immediately ahead, but it's worth building your current process so the transition is a form swap, not a process rebuild.

What It Costs You to Get This Wrong

CMS can suspend or terminate an agent's or agency's Marketplace agreements for noncompliant consent or application-review documentation, which stops you from assisting consumers or submitting applications at all. Repeat or serious violations can also mean being denied future Marketplace agreements and civil money penalties, per CMS's own FAQ on the penalty. None of that requires a consumer complaint to trigger — CMS can request documentation at any time within the ten-year window, for any enrollment you've touched. This is also why it helps to keep consent records next to the rest of your compliance documentation rather than scattered across whatever happened to be convenient at the time.

Building This Into a Normal Day

The agencies that stay compliant without stress treat this as a two-step habit attached to every client interaction, not a separate compliance project:

Capture consent before you do anything else — before the first quote, before the first look at an existing application. Make it the opening move of the conversation, not an afterthought at the end.
Log the five required details against that specific client's record immediately, while the conversation is fresh, rather than batching it for later.

In AgencyView, the Notes tab on a contact's record is a natural place to do the second step: a note saves to that exact contact and shows up immediately, timestamped, so you have a running, searchable history tied to the person — not a separate spreadsheet or a stack of paper forms you have to match back to a client later. It's a place to capture the scope, date, and names CMS requires; it doesn't replace actually capturing them. A note that just says "got consent" has the same problem CMS has already called out, whether it's on paper or in a CRM.

This habit pairs naturally with the other ACA record-keeping work already on your plate this season — getting ready for Open Enrollment, tracking turning-26 SEP documentation, and following up on passive re-enrollments. Consent and application-review records belong in the same place as the rest of that paper trail.

A Documentation Checklist You Can Use Today

Did I get consent before collecting PII, quoting, searching an existing application, enrolling, updating, or checking status?
Does my record show the scope, purpose, and duration of that consent?
Does it show the date consent was given?
Does it name the consumer (or their authorized representative)?
Does it name me and my agency specifically?
Does it explain how the consumer can rescind consent?
Before I submit any application, do I have a separate record that the consumer reviewed and confirmed it's accurate, and that I explained the attestations?
Is this stored somewhere I can still find and produce it in ten years?

FAQ

Does one signed form cover consent and application review?

Yes, if it clearly captures both as separate events — when consent was given, and later, when the consumer reviewed and confirmed the application before submission. They can't be merged into one undated blanket statement.

Do I need new consent every time I check on a client's application?

Not if your existing, documented consent already authorizes that specific action and hasn't expired or been rescinded. If it doesn't cover that action, you need a new, documented consent first.

Is a verbal "yes" on the phone enough?

Only if you record it or otherwise turn it into a document that captures all five required elements. An unrecorded verbal yes, or a note that just says the client agreed, does not meet the standard.

Does this apply if I'm just taking over a client's existing policy?

Yes. Before working with any new client, including one transferred from another producer, you need your own documented consent — the previous agent's consent record doesn't carry over to you.

What happens if a client's application was changed by someone else without my knowledge?

You need to confirm with the client whether they authorized that change before reverting it, and if you do revert it, you need documentation that the client authorized the reversal too.

Keeping this organized gets easier when a client's consent history lives on their actual contact record instead of in a separate compliance folder. AgencyView keeps your ACA book, notes, and policy history in one place so the record is there the day CMS asks for it, not the day you go looking for it.

Cover photo: RDNE Stock project / Pexels

Where AgencyView fits

Keep reading

Share: Facebook · LinkedIn · X · Email

All articles · AgencyView