Medicare Compliance Call Recording: CMS Rules & 10-Year Retention
Hunter Correll, Co-founder, ATHOS ·
Your dialer records every call. That's the easy part.
The hard part shows up later. A recording expires after 90 days. A disclosure gets skipped on call 412 of the week. A chargeback lands, and nobody listened to the call that caused it. Medicare compliance call recording is a storage problem, a coverage problem and a review problem, and most agencies only solve the first one.
This guide covers what CMS expects, how long you keep the audio, where setups quietly fail, and how to review every call instead of a sample. It is operational guidance, not legal advice. Your counsel and compliance lead make the final call on anything below.
Medicare Compliance Call Recording: What CMS Actually Requires
You don't need a law degree to run this part correctly. You need to know which calls are in scope and make sure none of them go unrecorded.
Which calls must be recorded
CMS expects Medicare Advantage and Part D sales, marketing and enrollment calls to be recorded. In practice, that means three buckets:
- Sales calls where an agent discusses plan options with a beneficiary
- Marketing calls, including outbound and callback conversations
- Enrollment calls, from the first question to the confirmation
If you also run Final Expense or ACA/Under-65 lines, don't assume the same rule applies. Ask your compliance lead what governs those calls. Plenty of teams record them anyway, because a recording protects you in a dispute.
Is recording mandatory for telephonic enrollments
Yes. A telephonic enrollment is an enrollment call, so it falls inside the requirement. Record the whole conversation, not only the moment the beneficiary says yes.
That includes calls where an agent takes over mid-conversation. If the enrollment happens on the phone, the recording is your proof of how it happened.
How Long You Must Keep Call Recordings
Recording a call is one obligation. Keeping it is a second one, and it lasts far longer than most phone contracts do.
The 10-year retention figure
CMS requires Medicare call recordings to be stored for a minimum of 10 years. Not 90 days. Not one AEP cycle.
Ten years means a call recorded in 2026 has to be retrievable in 2036. If your agency changes dialers, merges or sells a book of business in that window, the archive has to survive it. You own that problem, not your phone vendor.
Why retention rules vary in what you read
Read three articles on this and you may get three answers. Some describe a single 10-year clock. Others split audio and transcripts into different timelines.
That inconsistency is a reason to verify, not to guess. Have counsel and compliance confirm the current CMS text, and write the result into your retention policy. Until they do, plan to the longer number for everything you store.
What a Compliant Recording Has to Capture
A recording that cuts off early, or starts after the pitch has begun, protects nobody. When a carrier pulls a call, it wants the conversation from greeting to close.
Scope of Appointment, disclosures and required statements
Every covered call should contain the following. Treat it as your minimum checklist:
- Scope of Appointment (SOA): the beneficiary agreeing to the topics you'll discuss
- Required disclosures: the statements about who you represent and which plans you sell
- Required statements your carriers and compliance team mandate for the call type
- Clear enrollment intent: the beneficiary's own confirmation, not the agent's summary
Miss one and you have a gap. A gap can mean a rejected application, a clawed-back commission or a file that fails an audit.
Complete calls, not fragments
Your recording has to cover the entire call. Many setups don't. A transfer drops the audio, a hold cuts the file in two, or a callback lands on a different line.
Fragments are dangerous because they look like compliance. You have a file, so you assume you have proof. Then someone asks for the part where the agent confirmed the SOA, and that part is missing.
Where Recording Setups Break Down
Most failures aren't dramatic. They're defaults nobody changed and phones nobody tracked.
Storage limits and vendor retention gaps
Check your platform's retention setting today. Phone systems are built for business calls, not for a 10-year regulatory clock. For example, RingEX recordings are stored for up to 90 days by default, far below the 10-year minimum, so agencies need a separate archive.
90 days against 10 years. That's the gap, and the platform won't warn you about it. Recordings simply age out, and you find out when someone asks for one.
Independent agents, personal phones and dialer handoffs
Retention isn't the only leak. Watch for these:
- Calls on personal cell phones. Nothing records them, and nobody knows they happened.
- Dialer handoffs. The call moves between systems and the recording stops or splits.
- Dropped recordings. A failed upload leaves no file and no alert.
- No secure archive. Files sit in a shared folder anyone can edit or delete.
Independent agents are the highest-risk group, because you can't see which line they dial from. The fix is structural. The recommended setup for AEP is a dedicated recorded business line connected to a compliance vault. Agents sell on that line, and only on that line.
This doesn't work if agents can bypass it. A controlled line only counts if every covered call goes through it.
Recording Isn't Compliance: The Review Gap
A recording proves what happened. It doesn't tell you that a disclosure was skipped.
Nobody reads the file until something goes wrong. By then you're reconstructing a mistake that has already cost you a commission, a carrier relationship or worse. Recording without review is a filing cabinet, and compliance needs something that looks inside it.
ATHOS was founded by Medicare agency owners Hunter Correll and Jason Paradise, who built call scoring to fix their own compliance and QA problems. They had the recordings. What they lacked was any way to listen to all of them.
Why random sampling misses violations
Most QA teams pull a handful of calls per agent per month. That sample says almost nothing about the calls you didn't pull, because a missed disclosure doesn't happen on a schedule. It happens on the call you skipped.
Here is the contrast:
- Sampling: a reviewer hears a small slice and extrapolates. Violations in the rest stay invisible until a complaint or an audit surfaces them.
- Scoring 100%: every call is transcribed and checked for CMS compliance gaps, missed disclosures and script deviations. Flagged calls rise to the top of the queue.
AI scoring for insurance call centers works on that second model. If you want the mechanics, read about AI call scoring for insurance call centers. For the broader tooling picture, see CMS compliance software for Medicare agents.
Be clear about the limit. Scoring finds gaps faster and covers every call. It doesn't make your agency compliant, and it doesn't replace a human who decides what a flag means.
A Step-by-Step Call Recording Compliance Workflow
Here is the whole loop. Build it once and run it on every covered call.
Record, store, score, coach
- Record every covered call on a controlled line. Use a dedicated recorded business line. Block covered calls from personal phones.
- Archive securely, with a retention schedule. Move recordings out of platform storage into a compliance vault. Set the retention period to your confirmed CMS timeline, not the vendor default.
- Transcribe and score every call. Check each one for SOA, required disclosures, script deviations and CMS gaps. Not a sample. Every call.
- Route flagged calls to coaching. A flag that sits in a queue fixes nothing. Send it to the manager, play the call back to the agent and log the fix.
- Keep the audit trail. Record who reviewed what, when and what happened next.
Coaching works better when it starts before the first live call. New agents can practice disclosures in AI role-play before live calls, so the habit is built before a paid lead is at stake.
Audit-ready documentation
When a carrier or regulator asks, you want one answer, fast. Keep these together for each call:
- The recording and its transcript
- The compliance score and any flagged items
- Coaching notes and the date of follow-up
- Your retention schedule and access log
If you can't produce those in an afternoon, you aren't audit-ready yet. Fix that before the request arrives.
Can a Customer Refuse Recording, and Other Common Questions
Tell the beneficiary up front that the call is recorded. Put that notice in the first seconds, on the recording itself. It sets expectations and gives you a clean record that they were told.
If someone objects, don't quietly carry on. Follow your agency's written procedure, and escalate to compliance when you don't have one. Consent rules also differ by state, so your counsel needs to review how your notice and your objection process line up with the states you sell in.
Start with the gap you can measure. Pull your platform's retention setting, count how many covered calls last month were actually reviewed, and compare the answer with your compliance lead. If you want to see what reviewing every one of them looks like, see how call compliance scoring works.
Frequently asked questions
Can a prospect refuse to be recorded and still enroll by phone?
Tell every caller about the recording at the start of the call. If someone objects, don't continue as if nothing happened. Follow your written procedure and escalate to compliance, because state consent rules differ and your counsel should review how you handle objections.
Do agents on personal phones have to record calls?
The requirement attaches to the Medicare sales, marketing and enrollment call, not to the device. A personal cell phone that records nothing leaves you with no proof of a covered call. Route agents onto a dedicated recorded business line and confirm the details with your compliance lead.
Do I keep audio and transcripts for the same length of time?
Published sources describe this differently, with some splitting audio and transcript timelines. Have counsel confirm the current CMS text. Until then, keep both for the longer period, which is the 10-year minimum.
What should I do if my phone system only keeps recordings for 90 days?
Set up a separate archive now. Move recordings into a secure compliance vault and apply a retention schedule that matches your confirmed CMS timeline. Don't rely on the platform default, because recordings age out without warning.
Does AI call scoring make my agency compliant?
No. Scoring checks every recorded call for CMS gaps, missed disclosures and script deviations, so problems surface early. People still decide what each flag means and coach the agent, and your counsel decides what compliance requires.