Health Insurance Marketplaces: CMS Needs Stronger Controls to Prevent Unauthorized Actions by Agents and Brokers
Fast Facts
The Centers for Medicare & Medicaid Services require agents and brokers to be licensed, registered, and obtain consumer consent before helping consumers buy or change their health insurance plans on the federal insurance marketplace.
However, we found that the agency's safeguards don't always protect consumers from unauthorized activity by unscrupulous agents and brokers. This could result in consumers not being aware of changes to their health plans or even losing coverage altogether.
We made 2 recommendations, including implementing stronger safeguards—such as a one-time passcode—to ensure consumers consent to changes in their health plans.
Image showing the HealthCare.gov website with a spyglass enlarging the words "HealthCare.gov" and "Get Coverage."
Highlights
What GAO Found
Millions of consumers rely on the assistance of health insurance agents and brokers to purchase health insurance plans through federal and state Marketplaces established by the Patient Protection and Affordable Care Act. The federal Marketplace is maintained by the Centers for Medicare & Medicaid Services (CMS). To assist consumers in the federal Marketplace, agents and brokers must be licensed to sell health plans and be registered with the Marketplace, among other things. CMS conducts routine validation checks to help ensure that federal Marketplace agents and brokers are licensed. The agency also restricts access to its systems to only registered agents and brokers.
However, those CMS controls do not protect consumers from unauthorized activity by unscrupulous agents and brokers. Specifically, CMS
- processes to ensure consumer consent for agent or broker actions are weak,
- does not restrict access to consumer Marketplace records to the agent or broker already associated with a consumer’s enrollment, and
- does not inform consumers of all agent or broker actions.
In 2024, CMS implemented new procedures to better ensure agents and brokers obtain consumers’ consent prior to certain actions. However, GAO found that the procedures do not prevent all unauthorized actions because they are not always used, and CMS takes limited steps to confirm the identity of the consumer.
Together these weaknesses leave consumers vulnerable to unauthorized agent or broker activity. The number of consumer complaints of unauthorized enrollments and plan switches grew more than fourfold from 2023 through 2025.
Number of Consumer Complaints Tied to Confirmed Unauthorized Enrollments and Plan Switches in the Federal Marketplace, Calendar Years 2023 Through 2025
GAO examined three selected state-based Marketplaces and found they have controls that go beyond those used by CMS, such as requiring one-time passcodes to verify consumer consent to agent or broker actions. CMS told GAO that the agency is exploring options to potentially implement new controls for the open enrollment period for plan year 2027 but had not yet made decisions regarding any new controls. Without effective controls, consumers remain at risk.
Why GAO Did This Study
Recent federal fraud cases highlight concerns about certain agents and brokers in the federal Marketplace making unauthorized enrollments and plan changes to receive compensation from health plan issuers. As previously reported based on ongoing investigative work, GAO found at least 160,000 federal Marketplace applications in plan year 2024 had likely unauthorized changes.
GAO was asked to review program integrity practices in health insurance Marketplaces. This report examines the extent to which CMS has controls to ensure (1) agents and brokers in the federal Marketplace are licensed and registered, and (2) consumers authorize, and are informed of, agent and broker activity.
To perform this evaluation, GAO compared CMS controls to federal regulations and CMS policies and procedures by reviewing CMS documentation and interviewing CMS officials. GAO also interviewed organizations representing stakeholders—including agents and brokers, state insurance regulators, and consumers—and reviewed documentation and interviewed officials from three selected state-based Marketplaces—California, Georgia, and New Mexico—about their controls.
Recommendations
GAO is making two recommendations, including that CMS design and implement stronger controls to ensure consumers consent to, and are informed of, agent and broker actions, such as with a one-time passcode and other controls. HHS concurred with GAO’s two recommendations and identified steps it is considering to address the recommendations.
The status of these recommendations is tracked in this table.