HEALTH INSURANCE MARKETPLACES:

Report to the Congressional Requesters

July 2026

GAO-26-108297

United States Government Accountability Office

A report to the congressional requesters

For more information, contact: John E. Dicken at DickenJ@gao.gov or Seto J. Bagdoyan at BagdoyanS@gao.gov

What GAO Found

Millions of consumers rely on the assistance of health insurance agents and brokers to purchase health insurance plans through federal and state Marketplaces established by the Patient Protection and Affordable Care Act. The federal Marketplace is maintained by the Centers for Medicare & Medicaid Services (CMS). To assist consumers in the federal Marketplace, agents and brokers must be licensed to sell health plans and be registered with the Marketplace, among other things. CMS conducts routine validation checks to help ensure that federal Marketplace agents and brokers are licensed. The agency also restricts access to its systems to only registered agents and brokers.

However, those CMS controls do not protect consumers from unauthorized activity by unscrupulous agents and brokers. Specifically, CMS 

1.     processes to ensure consumer consent for agent or broker actions are weak,

2.     does not restrict access to consumer Marketplace records to the agent or broker already associated with a consumer’s enrollment, and

3.     does not inform consumers of all agent or broker actions.

In 2024, CMS implemented new procedures to better ensure agents and brokers obtain consumers’ consent prior to certain actions. However, GAO found that the procedures do not prevent all unauthorized actions because they are not always used, and CMS takes limited steps to confirm the identity of the consumer.

Together these weaknesses leave consumers vulnerable to unauthorized agent or broker activity. The number of consumer complaints of unauthorized enrollments and plan switches grew more than fourfold from 2023 through 2025.

GAO examined three selected state-based Marketplaces and found they have controls that go beyond those used by CMS, such as requiring one-time passcodes to verify consumer consent to agent or broker actions. CMS told GAO that the agency is exploring options to potentially implement new controls for the open enrollment period for plan year 2027 but had not yet made decisions regarding any new controls. Without effective controls, consumers remain at risk.

Why GAO Did This Study

Recent federal fraud cases highlight concerns about certain agents and brokers in the federal Marketplace making unauthorized enrollments and plan changes to receive compensation from health plan issuers. As previously reported based on ongoing investigative work, GAO found at least 160,000 federal Marketplace applications in plan year 2024 had likely unauthorized changes.

GAO was asked to review program integrity practices in health insurance Marketplaces. This report examines the extent to which CMS has controls to ensure (1) agents and brokers in the federal Marketplace are licensed and registered, and (2) consumers authorize, and are informed of, agent and broker activity.

To perform this evaluation, GAO compared CMS controls to federal regulations and CMS policies and procedures by reviewing CMS documentation and interviewing CMS officials. GAO also interviewed organizations representing stakeholders—including agents and brokers, state insurance regulators, and consumers—and reviewed documentation and interviewed officials from three selected state-based Marketplaces—California, Georgia, and New Mexico—about their controls.

What GAO Recommends

GAO is making two recommendations, including that CMS design and implement stronger controls to ensure consumers consent to, and are informed of, agent and broker actions, such as with a one-time passcode and other controls. HHS concurred with GAO’s two recommendations and identified steps it is considering to address the recommendation.

 

 

 

 

APTC	advance premium tax credit
CMS	Centers for Medicare & Medicaid Services
EDE	enhanced direct enrollment
NPN	National Producer Number
PPACA	Patient Protection and Affordable Care Act
SSN	Social Security number

 

July 13, 2026

The Honorable Brett Guthrie
Chairman
Committee on Energy and Commerce
House of Representatives

The Honorable Jim Jordan
Chairman
Committee on the Judiciary
House of Representatives

The Honorable Jason Smith
Chairman
Committee on Ways and Means
House of Representatives

As of February 2026, over 19 million consumers enrolled in health insurance plans through federal and state Marketplaces established by the Patient Protection and Affordable Care Act (PPACA).[1] The Centers for Medicare & Medicaid Services (CMS), within the Department of Health and Human Services, is responsible for maintaining the federal Marketplace and overseeing state-based Marketplaces.[2] Through the Marketplaces, consumers can directly compare and select among plans based on a variety of factors, such as premiums and provider networks.

Consumers can apply for, and enroll in, health insurance coverage through a Marketplace independently or with assistance, such as from an insurance agent or broker.[3] Assistance from an agent or broker is of no cost to the consumer. Rather, agents and brokers are allowed to receive compensation directly from health insurance issuers in accordance with agreements with those issuers and any applicable state requirements.[4]

Recent sentencings in federal fraudulent enrollment cases, as well as preliminary results of ongoing GAO investigative work, highlight concerns about agent and broker practices in the federal Marketplace. In those cases, individuals were found to have fraudulently enrolled consumers in health plans offered through the federal Marketplace or switched their plans without the consumers’ knowledge or consent in order to receive compensation from issuers. In addition, as we previously reported in December 2025 based on preliminary results of our ongoing investigative work, we found at least 160,000 federal Marketplace applications in plan year 2024 had likely unauthorized changes.[5] Such practices can result in harm and unexpected costs for consumers. These can include loss of access to medical providers and medications, higher copayments and deductibles, or repayment of premium tax credits if income or other eligibility was misrepresented.[6] Such practices can also result in wasteful federal spending on premium tax credits for enrollees who are not eligible.

You asked us to review issues related to program integrity practices in the oversight of agents and brokers in the health insurance Marketplaces. In this report, we examine the extent to which CMS has controls to ensure that

1.     agents and brokers who assist consumers in the federal Marketplace are licensed and registered; and

2.     consumers authorize, and are informed of, agent and broker activity.

To address our objectives, we reviewed CMS documentation, including policies and guidance pertaining to agent and broker roles and responsibilities within the federal Marketplace. We also interviewed CMS officials about controls the agency has in place pertaining to agent and broker activity in the federal Marketplace. Based on this information, we evaluated the extent to which CMS has controls in place consistent with agency policies and guidance to ensure agents and brokers have

·       met licensure and registration requirements prior to assisting consumers in the federal Marketplace;

·       obtained consent from consumers before assisting them with applying for, enrolling in, or changing health plans through the federal Marketplace, and

·       obtained consent from consumers before accessing their federal Marketplace enrollment records.[7]

In addition, we examined CMS controls to limit agent and broker access to consumer information for authorized purposes consistent with agency policy.[8] We also compared CMS’s controls for ensuring consumers authorize, and are informed of, agent and broker actions against the agency’s 2018 fraud risk assessment—the most recent assessment at the time of our review. That is, we examined whether CMS’s efforts to inform consumers of agent and broker actions addressed this risk. Additionally, we compared CMS’s controls against selected federal internal controls standards to determine whether the agency periodically reviewed its controls activities for continued relevance and effectiveness.[9]

For additional context and insights, we compared CMS’s controls in the federal Marketplace to those of three selected state-based Marketplaces—California, Georgia, and New Mexico. These Marketplaces were selected based on several factors, including variation in the number of consumers who selected a plan during 2025 open enrollment and the number of years the state operated its own state-based Marketplace. The results of our review of documentation and interviews with officials from these state-based Marketplaces are intended to provide illustrative examples of controls they have in place and cannot be generalized to other Marketplaces.

In addition, we interviewed representatives from a non-generalizable selection of 14 organizations representing stakeholders who interact with the federal and state Marketplaces to gain insight into the stakeholders’ experiences. These included researchers; organizations that represented agents and brokers, state insurance regulators, and health care consumers; navigator organizations; and entities CMS approved to operate websites where consumers can apply for and enroll in a plan offered through the federal Marketplace.

We conducted this performance audit from January 2025 to July 2026 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Background

Marketplaces

Consumers purchase health plans offered through federal or state-based Marketplaces for a variety of reasons, including being unemployed or self-employed, or working for an employer that does not offer a health plan. There are several aspects of plans sold through the Marketplaces for consumers to consider, such as whether their doctors are covered by the plan, the amount they would be expected to pay for the health services they use, and the cost of the plan premium. In determining the cost of the premium, consumers also need to consider their eligibility for a premium tax credit.

Historically, most Marketplace consumers have been eligible for these premium tax credits. The tax credits reduce the amount a consumer contributes toward their premium and can be paid to the consumer’s health insurance issuer in advance, known as the advance premium tax credit (APTC).[10] The amount of the premium tax credit varies by individual and is calculated based on multiple factors, including household income and the premium for the plan in which the individual is enrolled. Depending on their estimated income and the cost of the plan they choose, some consumers who receive their tax credit in advance through the APTC may pay nothing for their premiums if their tax credit covers the full monthly premium cost. The Marketplaces determine each consumer’s eligibility for APTC when they apply for coverage. In doing so, they need to collect from consumers personally identifiable information and information on their income, among other things.

Generally, individuals may enroll in or switch health plans during the annual open enrollment period. Outside of the annual open enrollment period, consumers can generally enroll in a plan or switch plans if they qualify for a special enrollment period due to a qualifying life event. For example, if an individual reports a change in household size, such as after the birth of a baby, or change in income that affects their eligibility for an APTC, they may qualify for a special enrollment period to enroll in or change plans.

Role of Agents and Brokers

Agents and brokers can provide assistance to consumers who are trying to decide among their Marketplace plan options and can help them apply for coverage and related financial assistance. Agents and brokers must be licensed in the state in which they sell plans. And, to work with consumers in states that use the federal Marketplace, agents and brokers must be registered, and execute required agreements, with the federal Marketplace.[11]

Federal regulations and CMS guidance require agents and brokers to, among other things, obtain and document consumers’ consent before assisting them with applying for, enrolling in, or changing health plans through the federal Marketplace.[12] For example, consumer consent is required before the agent or broker can

·       collect, access, or use personally identifiable information, such as name, date of birth, and Social Security number (SSN);

·       help a consumer apply for coverage or financial assistance (including APTC) by completing an eligibility application on their behalf; and

·       enroll a consumer in a plan offered through the federal Marketplace.

After a consumer has applied, or is enrolled, the agent or broker can also update a consumer’s eligibility application or plan selection on their behalf, if the initial consent authorized the agent or broker to do so, or if they obtained subsequent consent for any new actions.

In its agent and broker training materials and guidance, CMS directs agents and brokers to use a person search tool to determine if an enrollment already exists for the consumer. Prior to conducting a person search, agents and brokers are required to obtain and document consent from consumers to do so.

Enrollment Pathways

The federal Marketplace offers multiple pathways to enroll in health insurance coverage—primarily through HealthCare.gov (also known as the Marketplace pathway) or through a CMS-approved, non-Marketplace website hosted by an enhanced direct enrollment (EDE) entity (also known as the EDE pathway).[13] There is one key difference between the pathways when agents and brokers assist consumers. Through the Marketplace pathway, the consumer typically completes the application and enrollment steps with verbal advice and guidance by an agent or broker. In contrast, through the EDE pathway, the agent or broker typically completes the steps on behalf of the consumer. Most enrollments in the federal Marketplace are assisted by an agent or broker through the EDE pathway. Figure 1 illustrates these two enrollment pathways when an agent or broker assists the consumer.

Note: Alternatively, consumers may submit an eligibility application and enroll in a health plan without agent or broker assistance through either pathway. Additional pathways include applications submitted via paper, telephone, or through the original direct enrollment pathway. Through the original direct enrollment pathway, the agent or broker may use a CMS-approved, non-Marketplace website to assist a consumer with enrolling in a health plan. However, the eligibility application is completed using HealthCare.gov before the agent or broker can complete the consumer’s enrollment through the non-Marketplace website. CMS began discontinuing the original direct enrollment pathway starting November 1, 2025, with a plan to fully end the pathway by November 1, 2026. According to CMS, this decision was made to prioritize the agency’s investment in the development and improvement of the EDE pathway.

CMS Oversight of Agents and Brokers

CMS is responsible for overseeing agents and brokers in the federal Marketplace and ensuring that they comply with federal rules.[14] As part of its oversight responsibilities, CMS investigates complaints, referrals, and other leads reported to CMS from various sources. These sources include consumers, other agents and brokers, issuers, and state insurance regulators, related to actions taken by agents and brokers.[15] CMS’s contractor, the Marketplace Program Integrity Contractor (MPIC), supports the agency in its investigations. CMS and the MPIC also analyze various data sources, such as person search activity and enrollment trends, throughout the year to identify instances of potential agent and broker noncompliance with Marketplace rules and state or federal laws.

CMS assessed the risk of fraud in the federal Marketplace in 2018, in which the agency identified multiple fraud risks related to agents and brokers.[16] In particular, the agency identified agent and broker licensure noncompliance as a risk to the federal Marketplace. CMS also identified agent and broker theft of consumer personally identifiable information to enroll them in a health plan without their knowledge as the greatest risk to the federal Marketplace. The agency noted that both risks have potential to result in financial risk to the federal government and harm to consumers.[17]

According to its 2018 fraud risk assessment, one way CMS seeks to combat agent and broker unauthorized activity is through consumer education. In addition, in a press release announcing actions the agency took to address unauthorized plan changes, CMS noted a goal to arm consumers with information needed to help them avoid and report unauthorized activity by agents and brokers.[18]

CMS Has Controls to Help Ensure Only Licensed and Registered Agents and Brokers Assist Federal Marketplace Consumers

CMS conducts routine licensure validation checks that help the agency ensure that only agents and brokers who maintain active state health insurance licenses assist federal Marketplace consumers. In addition, CMS’s controls to restrict access to and monitor its systems help the agency ensure that only registered agents and brokers assist consumers.

CMS’s routine validation checks help ensure agents and brokers are licensed. To ensure that agents and brokers participating in the federal Marketplace maintain a valid state license to sell health insurance, CMS validates the agent or broker’s National Producer Number (NPN) against data stored in National Insurance Producer Registry’s public database of NPNs.[19] This validation check is done initially each year when they complete the annual training and registration process. As part of its ongoing monitoring, CMS also conducts weekly validation checks to ensure that all registered agents and brokers have maintained their license since registering. Based on the results of these validation checks, the CMS FFM Agent/Broker Registration Completion List is updated as frequently as daily and posted on HealthCare.gov.[20] CMS officials said the agency also conducts biweekly checks to validate licensure to ensure that the agent or broker working with the consumer was licensed in the state where that consumer was enrolled. For example, if the enrollment was submitted through the EDE pathway, they said CMS validates the NPN associated with the agent or broker’s account with the federal Marketplace.[21]

According to CMS officials, when the agency determines that an agent or broker does not have a valid license in the state in which they enrolled a consumer, they are sent corrective action letters, asking them to confirm valid licensures.[22] If the agent or broker does not confirm their licensure, the agency will terminate their registration with the federal Marketplace. According to CMS, as of January 2026, there were about 96,000 agents and brokers who were registered with the federal Marketplace.

CMS restricts access to the agency’s systems to only registered agents and brokers. According to CMS guidance, the agency requires EDE entities to restrict system access to agents and brokers who, when they registered with the federal Marketplace, created a CMS Enterprise Portal account with unique login credentials and multi-factor authentication.[23] CMS policies prohibit agents and brokers from having more than one CMS Enterprise Portal account or sharing login credentials. According to CMS guidance, agents and brokers are also prohibited from being logged in simultaneously on different devices or using multiple sessions on the same device with the same credentials.

CMS officials explained that the agency also conducts ongoing monitoring for potential misuse of login credentials. They said the agency reviews daily activity reports to identify cases where more login sessions were generated than would be expected in a typical workday, which is an indicator of potential concurrent sessions using the same login credentials. According to CMS officials, in 2024, the agency observed a high volume of login sessions on EDE platforms.[24] In addition, through its routine data analysis, MPIC reports showed that CMS identified cases of potential credential sharing. For example, CMS identified agents or brokers who conducted between 600 to 1,000 person searches in a single day or who submitted over 800 enrollments per day, which may be an indication of potential credential sharing.

To prevent further noncompliant credential sharing behavior, CMS officials said the agency implemented two system changes in March 2024. Specifically, they said the agency required EDE entities to ensure

·       user information for agents or brokers logged into their non-Marketplace website matches their federal Marketplace login credentials; and

·       each agent or broker reauthenticates their user session every 12 hours when using their platform, instead of every 30 days.[25]

Since the change, CMS officials said the agency has observed a large decrease in the number of login sessions by individual agents and brokers, including among previously flagged high users. They said this suggests the system controls that were put in place resulted in a decrease in noncompliant credential sharing behavior.

CMS Controls Do Not Protect Consumers from Unauthorized Activity by Unscrupulous Agents or Brokers

While CMS controls can help ensure agents and brokers are licensed and registered, the agency’s other controls are insufficient for preventing unauthorized activity by agents and brokers. We found weaknesses in its controls to (1) verify consumer consent authorizing agent and broker activity on their accounts, (2) restrict agent and broker access to consumer information, and (3) ensure consumers are notified of agent and broker actions. Together these weaknesses may leave consumers vulnerable to unauthorized activity by unscrupulous agents and brokers.

CMS processes to verify consumer consent to agent or broker actions are weak. Federal regulations and CMS policy require agents and brokers to obtain and document consumer consent prior to taking certain actions to assist them.[26] For example, consent is to be obtained before assisting with a new enrollment, making changes to an existing enrollment, or conducting a consumer person search. Agents and brokers are required to maintain the documentation of consumer consent, such as with an email or recorded phone call, and make it available to CMS upon request in response to monitoring, audit, and enforcement activities.[27]

However, we found that CMS procedures to verify consumer consent are weak because the agency does not verify that the agent or broker actually obtained consumer consent before agent and broker actions occur. Further, the CMS procedures do not prevent agents and brokers who have not obtained that consent. Four stakeholders we interviewed told us that agents and brokers generally only attest that they obtained consumer consent through the EDE pathway, which could include checking a box. Further, CMS’s controls may not ensure that the actual consumer is consenting to agent and broker actions. For example, two stakeholders noted that consent documentation can easily be forged. In addition, CMS does not routinely review consent documentation.[28] As noted earlier, based on preliminary analysis from ongoing investigative work, we reported in December 2025 that at least 160,000 applications in plan year 2024 had likely unauthorized changes.[29]

New Controls Implemented by CMS in Response to Unauthorized Enrollments 1.    In July 2024, CMS began blocking any changes to enrollments by federal Marketplace agents and brokers who were not already associated with the consumer’s enrollment. To change the agent or broker associated with an enrollment, CMS requires a three-way call between the new agent or broker, the consumer, and a Marketplace Call Center representative.  2.    In October 2024, CMS began blocking any new applications submitted by agents or brokers through the Enhanced Direct Enrollment (EDE pathway) without verifiable Social Security numbers (SSN) or immigration documentation. If an agent or broker attempts to submit an application without a valid SSN or immigration documentation, they are directed to conduct a three-way call with the consumer and the Marketplace Call Center. Alternatively, consumers can submit new enrollments or changes to their enrollment themselves through the Marketplace or through the EDE pathway, either on their own or with verbal advisement by an agent or broker, rather than having the agent or broker submit the enrollment or change for them. Source: GAO analysis of Centers for Medicare & Medicaid Services (CMS) documentation.  |  GAO‑26‑108041

In 2024, in response to reports of widespread unauthorized enrollments and plan switches, CMS implemented new procedures to better ensure consumer authorization occurred before certain agent and broker actions. Specifically, CMS began blocking certain actions by agents and brokers through the EDE pathway and requiring a three-way call between the consumer, agent or broker, and the Marketplace Call Center to complete the action.[30] However, we found that these procedures are weak, because they are not used for all enrollments or changes that may be made on behalf of a consumer, and CMS takes limited steps to confirm the identity of the consumer on a three-way call. Specifically, CMS officials told us that the Marketplace Call Center confirms the identity of the consumer on a three-way call with information that may be publicly available, such as name, address, and date of birth. CMS officials and five stakeholders told us that unauthorized people have posed as the consumer on three-way calls.[31] We also previously reported in December 2025, based on ongoing investigative work, that three-way calls did not prevent brokers from submitting new applications for two fictitious consumers with invalid Social Security numbers due to weaknesses in CMS’s consumer identity proofing.[32]

CMS does not restrict access to consumer Marketplace records to the agent or broker of record. We also found that CMS procedures allow any registered federal Marketplace agent or broker (not just the agent of record) to access any consumer’s full enrollment record if the agent or broker attests that they obtained consent and can match a few pieces of information about the consumer. According to CMS guidance, a person search can be conducted by entering the consumer’s first name, last name, and date of birth—all information that may be publicly available.[33] As described above, CMS does not verify consumer consent before an agent or broker can access a consumer’s enrollment record through a person search.[34] This is inconsistent with CMS policy that requires permission from consumers before providing an agent or broker access to their information.[35] The consumer’s enrollment record includes detailed personal information for the consumer and all their household enrollees, including their contact information, employment and income information, and the last four digits of their SSNs. Five stakeholders we interviewed expressed concern about the ease of access to consumer information through the person search tool. For example, two stakeholders explained that information needed to conduct a successful search may be easily obtained through public sources, such as social media.

Further, three stakeholders stated that some unscrupulous agents and brokers obtained basic information about consumers to enroll them in a new plan or switch their plans without their knowledge to receive a commission. According to CMS data, the number of consumer complaints received by CMS and subsequently confirmed and resolved as either an unauthorized enrollment or unauthorized plan switch increased more than fourfold from calendar year 2023 through calendar year 2025 (see fig. 3).[36]

Note: According to CMS officials, complaints received in a calendar year may correspond to a prior plan year. This figure includes consumer-initiated complaints. CMS may have also received complaints of unauthorized agent and broker activity from other agents and brokers, issuers, and state insurance regulators.

CMS notices do not inform consumers of all activity by agents and brokers. Although CMS’s fraud risk assessment identified consumer education as a means for mitigating the risk of unauthorized enrollments by agents and brokers, we found that CMS does not inform consumers of all activities related to their application and enrollment. CMS sends notices to consumers on Marketplace eligibility, data-matching issues requiring document submission, tax information, and open enrollment and special enrollment periods, among other things.[37] However, CMS officials told us that the agency does not notify consumers of person searches, new enrollments, or changes to enrollments other than sending an eligibility determination notice.[38] As a result, consumers may not be aware of unscrupulous agents or brokers using their information to gain control over the consumer’s enrollment. CMS officials said issuers are responsible for notifying consumers of a new enrollment or a termination of enrollment.

In addition, CMS notices may not reach some consumers because their contact information may be incorrect or may have been fraudulently changed or misrepresented by an agent or broker. Our review of federal Marketplace enrollment data for plan year 2024 found the same phone number or email address was listed for many different consumer Marketplace applications, and some of these phone numbers and email addresses appeared to be dummy contact information or belong to an agent or broker.[39] Further, nine stakeholders raised concerns that consumers may not have been aware of changes to their enrollment because of a lack of notification about agent and broker activities at the time the unauthorized activity occurred. For example, four stakeholders said consumers may have learned they were enrolled in a plan when they received a notice from the IRS during tax filing season advising them to reconcile their APTC or when they sought medical care and learned that their plan had been switched. Two stakeholders representing agents and brokers told us that in some cases, bad actors changed consumers’ contact information, which may have resulted in consumers not receiving the notices that CMS sends. According to CMS officials, if a consumer’s contact information changes, a new eligibility determination notice is sent to the updated contact information but not to the old contact.

These three weaknesses leave consumers vulnerable to unauthorized enrollments and plan changes made by unscrupulous agents and brokers. This is because CMS has not implemented sufficiently strong controls to protect consumers from unauthorized activity, safeguard their information, and notify them of all activity on their enrollments. Further, CMS controls currently are not consistent with federal regulations, agency policy, and the agency’s fraud risk assessment for mitigating the risk of unauthorized actions by agents and brokers. In March 2026, CMS officials told us that the agency is exploring options to potentially implement new controls for the open enrollment period for plan year 2027 but had not yet made decisions regarding any new controls. One option CMS described included using a one-time passcode to help verify consumer consent before an agent or broker action occurs.[40] CMS officials also told us that they had considered implementing additional controls before the open enrollment period for plan year 2026 but opted not to because of uncertainty regarding potential implementation of other program integrity changes to the federal Marketplace for that plan year.

Stakeholders we spoke with also supported stronger controls, such as the use of one-time passcodes, to mitigate the persistent risk of unauthorized enrollments, plans changes, and other agent and broker activity. For example, six stakeholders suggested that CMS implement additional consumer authentication steps, such as one-time passcodes, to better ensure the verification of a consumer’s identity and the validity of their authorization. Other suggestions that two stakeholders raised included requiring a consumer’s SSN to conduct a person search and restricting the amount of information agents and brokers can see from a person search. Until effective controls are implemented, consumers remain at risk of unauthorized activity by agents and brokers. In addition, periodically evaluating any new controls to determine their continued effectiveness in protecting consumers from unauthorized agent or broker activity would be consistent with federal internal control standards.[41]

In contrast to the federal Marketplace, we found that the three selected state-based Marketplaces have controls in place that go beyond those in the federal Marketplace to ensure consumers authorize, and are informed of, agent and broker actions. Examples of these controls include

·       not allowing person searches;

·       requiring a consumer one-time passcode to authorize agent and broker actions, such as accessing their information, changing the agent of record, or making other changes to their enrollment record on their behalf; and

·       notifying consumers of a new enrollment, plan change, or change in the agent of record.

According to five stakeholders and officials from two of the selected state-based Marketplaces, unauthorized enrollments and plan switching are not a significant issue in the state-based Marketplaces.[42] See table 1 for additional details on the controls the three selected state-based Marketplaces have in place to ensure consumers authorize, and are informed of, agent and broker actions.

Federal Marketplace	Covered California	Georgia Access	BeWell New Mexico
	Verification of Consumer Consent to Agent or Broker Actions
Does not verify that the agent or broker obtained consumer consent before carrying out enrollment activities on behalf of a consumer.	Requires a consumer one-time passcode or a three-way call before an agent or broker can carry out enrollment activities on behalf of a consumer.a	Requires a consumer one-time passcode before a new agent of record relationship is established and the agent can carry out enrollment activities on behalf of a consumer.	Requires a consumer one-time passcode before an agent or broker can carry out enrollment activities on behalf of a consumer.
	Access to Consumer Enrollment Records Through Person Searches
Requires first name, last name, and date of birth to conduct a person search. Any registered agent or broker can view consumer enrollment records if they attest they received consumer consent, but consumer consent is not verified before an agent or broker can view the record.	Does not allow person searches.b Only the agent of record can access consumer enrollment records.	Requires a consumer one-time passcode before a new agent of record relationship is established and the agent can access consumer enrollment records.	Requires a consumer one-time passcode before a non-agent of record can access consumer enrollment records.
	Consumer Notifications
Does not send notification to consumers of ·        person searches; ·        new enrollments or enrollment changes; ·        agent of record changes.c	Sends notification to consumers of: ·        new enrollments or enrollment changes; ·        agent of record changes.	Sends notification to consumers of: ·        agent of record changes.	Sends notification to consumers of: ·        person searches; ·        new enrollments or enrollment changes; ·        agent of record changes.

Source: GAO analysis of guidance documentation and interviews with officials from the Centers for Medicare & Medicaid Services (CMS) and selected state-based Marketplaces.  |  GAO‑26‑108297

Notes: The enrollment record includes detailed personal information for the consumer and all their household enrollees, including their contact information, employment and income information, and the last four digits of their Social Security numbers. The agent of record is the agent or broker on a consumer’s enrollment record who receives a commission from the associated health plan issuer. According to the National Institute of Standards and Technology, a one-time passcode is a one-time secret obtained from a device or application held by the subscriber, which in this case would be the consumer.

^aUnlike the federal Marketplace, Covered California does not offer a person search function. As a result, the information needed to verify a consumer’s identity on a three-way call is not as easily accessible to agents and brokers through the Covered California portal.

^bAccording to Covered California officials, Covered California uses identity data to detect potential duplicate enrollments and display a warning before an application is submitted. This eliminates the need for the person search tool.

^cAccording to CMS officials, a three-way call must be conducted for agent of record changes. However, we found that the Marketplace Call Center’s steps to verify the identity of the consumer on a three-way call are limited and may involve asking only for information that may be publicly available or is readily available through a person search.

Conclusions

Agents and brokers in the federal Marketplace play a key role in helping consumers apply for and enroll in health coverage. However, recent criminal prosecutions and convictions and preliminary findings from our ongoing investigative work highlight concerns about agents and brokers carrying out unauthorized enrollments and plan switching without consumers’ knowledge or consent. As a result, consumers may face unexpected costs, including potential tax liabilities, or lose access to health care providers and prescription medications due to an unauthorized change in coverage.

CMS has requirements for agents and brokers to obtain consumer consent prior to accessing consumer information and assisting consumers with their Marketplace application and enrollment. However, while CMS told us the agency is considering plans to potentially implement stronger controls—such as a one-time passcode—to effectively ensure that consumers have actually authorized and are informed of agent and broker actions, it has not yet implemented them. By implementing stronger controls, such as a consumer one-time passcode, CMS could protect consumers from unauthorized activity by agents and brokers and ensure that they are notified of activity. Further, periodically evaluating any new controls and making changes as needed will help ensure that the controls are effective in protecting consumers from unauthorized agent or broker activity.

Recommendations for Executive Action

We are making two recommendations to CMS:

The Administrator of CMS should design and implement stronger controls to verify consumer consent to agent and broker actions on consumer enrollments, restrict access to consumer information to the agent of record, and notify consumers of agent and broker activity on their federal Marketplace enrollments. Such controls could include use of a one-time passcode and limits to the amount of consumer details agents and brokers who are not the agent of record can see when conducting a person search. (Recommendation 1)

The Administrator of CMS should periodically review the relevance and effectiveness of the controls it implements to ensure consumers authorize, and are informed of, agent and broker activity on their federal Marketplace enrollments and make changes as appropriate based on those reviews. (Recommendation 2)

Agency Comments

We provided a draft of this report to HHS for review and comment. In its written comments (reproduced in appendix I), HHS concurred with both of our recommendations. HHS described its ongoing efforts to identify and prevent unauthorized enrollments and plan switches by unscrupulous agents and brokers. HHS also outlined steps the agency is considering that could address our recommendations. For example, it is in the process of issuing new requirements for EDE entities to require a one-time confirmation, such as a one-time passcode, by all consumers to authorize a specific agent or broker to take actions on their behalf. It also plans to restrict access to an existing consumer’s full application through EDE to the agent or broker of record. In addition, HHS provided technical comments, which we incorporated as appropriate.

If you or your staff have any questions about this report, please contact John E. Dicken at DickenJ@gao.gov or Seto J. Bagdoyan at BagdoyanS@gao.gov. Contact points for our Offices of Congressional Relations and Media Relations may be found on the last page of this report. GAO staff who made key contributions to this report are listed on appendix II.

John E. Dicken

Director, Health Care

Seto J. Bagdoyan

Director of Audits, Forensic Audits and Investigative Services

GAO Contacts

John E. Dicken, DickenJ@gao.gov

Seto J. Bagdoyan, BagdoyanS@gao.gov

Staff Acknowledgments

In addition to contacts named above, Gerardine Brennan (Assistant Director), Katie Mack (Analyst-in-Charge), Sylvia Diaz Jones, and Priyanka Panjwani made key contributions to this report. Sam Amrhein, Dave Bruno, Sauravi Chakrabarty, James Healy, Ariel Landa-Seiersen, Ravi Sharma, and Roxanna Sun also contributed to this report.

GAO’s Mission

The Government Accountability Office, the audit, evaluation, and investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO’s commitment to good government is reflected in its core values of accountability, integrity, and reliability.

Obtaining Copies of GAO Reports and Testimony

The fastest and easiest way to obtain copies of GAO documents at no cost is through our website. Each weekday afternoon, GAO posts on its website newly released reports, testimony, and correspondence. You can also subscribe to GAO’s email updates to receive notification of newly posted products.

Order by Phone

The price of each GAO publication reflects GAO’s actual cost of production and distribution and depends on the number of pages in the publication and whether the publication is printed in color or black and white. Pricing and ordering information is posted on GAO’s website, https://www.gao.gov/ordering.htm.

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or
TDD (202) 512-2537.

Orders may be paid for using American Express, Discover Card, MasterCard, Visa, check, or money order. Call for additional information.

Connect with GAO

Connect with GAO on X, LinkedIn, Instagram, and YouTube.
Subscribe to our Email Updates. Listen to our Podcasts.
Visit GAO on the web at https://www.gao.gov.

To Report Fraud, Waste, and Abuse in Federal Programs

Contact FraudNet:

Website: https://www.gao.gov/about/what-gao-does/fraudnet

Automated answering system: (800) 424-5454

Media Relations

Sarah Kaczmarek, Managing Director, Media@gao.gov

Congressional Relations

David A. Powner, Acting Managing Director, CongRel@gao.gov

General Inquiries

https://www.gao.gov/about/contact-us