There’s a question compliance teams at Medicare Advantage organizations keep asking, usually right after something goes wrong. 
 
“We didn’t know they were doing that. Does this still come back on us?” 
 
Yes. Almost every time. Yes. 
 
Third-party marketing organizations — TPMOs — are a cornerstone of how Medicare Advantage plans reach beneficiaries. They’re also one of the biggest compliance risks those plans will ever take on. The rules around what TPMOs can do, what they have to disclose, and who owns the consequences when things go sideways have gotten more detailed every year. And yet, the question of liability still seems to catch plan sponsors off guard. 
 
So let’s be clear about it.

What CMS Actually Says About Who’s Responsible

CMS is not subtle on this point. Medicare Advantage organizations bear ultimate responsibility for TPMO actions. That’s not an interpretation. That’s the regulation. 
 
Under 42 CFR § 422.2272(e), MAOs are required to maintain formal agent and broker monitoring and oversight plans. Those plans must actively monitor TPMOs, identify non-compliance when it occurs, and report it to CMS. The obligation to know what your distribution partners are doing is baked directly into the rules. “We didn’t know” is not a defense — it’s a description of your compliance failure. 
 
What this means practically: if a TPMO working on your behalf tells a beneficiary something inaccurate about your plan, misleads them about enrollment, or uses unapproved marketing materials, CMS can and will hold the plan sponsor accountable. The enforcement action lands on the MAO. 
 
This isn’t theoretical. CMS runs a secret-shopper program specifically targeting sales events. Agents get tested. If a caller finds a problem, the plan sponsor faces the consequences — not just the agent. 

The Material Approval Problem

One of the clearest TPMO liability traps is marketing materials that promote multiple plans. 
 
If a TPMO creates materials that reference more than one plan, those materials must be submitted to CMS through the Health Plan Management System (HPMS) for approval before use. This requirement comes from 42 CFR § 422.2261(a)(2). It doesn’t matter that the TPMO created them. It doesn’t matter that the plan didn’t know. If those materials are out in the market unapproved, that’s a problem. 
 
Most MAOs know this rule. What catches them is the execution. When you’re working through a network of TPMOs — some of whom are working through their own sub-agents — tracking what materials are in use and whether they’ve been properly approved is harder than it sounds. A March 2025 investigation released by Senate Finance Committee Ranking Member Ron Wyden highlighted the challenges of overseeing increasingly complex TPMO networks, describing a system of marketing middlemen that can make meaningful oversight difficult even for well-intentioned plans. 
 
The complexity of the network doesn’t reduce the MAO’s responsibility. It just makes the monitoring job harder. 

TPMOs Have Their Own Reporting Obligations — And Plans Need to Know If They’re Meeting Them

The liability picture gets more layered when you look at what TPMOs are required to do on their end. 
 
Under 42 CFR § 422.2274(g)(2)(iii), TPMOs must submit monthly disciplinary action reports to the carriers they work with. These reports cover agents who have been disciplined, terminated, or flagged for conduct issues. If a TPMO is submitting these reports, the MAO is getting data that should inform its oversight activities. If they’re not submitting them, that’s a compliance failure by the TPMO — and the MAO needs to catch it. 
 
Plans that aren’t actively tracking whether their TPMOs are meeting these reporting requirements are leaving a gap in their oversight programs. That gap is exactly the kind of thing CMS looks for in audits. 
 
There’s also the issue of beneficiary data. CMS regulations restrict TPMOs from sharing beneficiary contact information with other TPMOs without appropriate beneficiary consent. Data sharing between marketing partners without that consent isn’t just a contractual issue — it’s a regulatory violation that lands in the plan’s lap. 

The False Claims Act Is in This Conversation Too

Most compliance discussions about TPMOs focus on CMS marketing rules. The OIG’s Special Fraud Alert from October 2022 expanded that conversation considerably. 
 
The alert flagged suspect payment arrangements between Medicare Advantage organizations, healthcare providers, and agents and brokers — including TPMOs — as potential violations of the Anti-Kickback Statute and the False Claims Act. The arrangements OIG called out include:

• Payments to agents or brokers that exceed the CMS-permitted compensation amounts
• Payments conditioned on enrollment targets
• Payments tied to the health status of enrolled beneficiaries

These arrangements may create Anti-Kickback Statute exposure and, in some circumstances, can give rise to False Claims Act liability. That means the potential exposure isn’t just a CMS warning letter or a corrective action plan. It’s the False Claims Act, which carries treble damages and per-claim penalties. 
 
The line between a compliant broker compensation structure and a kickback arrangement is not always obvious. That’s precisely why MAOs need to audit their TPMO payment arrangements the same way they audit marketing materials — regularly, not just at contracting. 

The Compensation Rule Fight (and Why It Doesn’t Change the Underlying Obligation

In 2024, a Texas federal court issued an injunction halting enforcement of the broker compensation cap provisions CMS had tried to implement. The rule had attempted to limit what plans could pay TPMOs for enrollment-related services beyond the standard agent and broker compensation amounts. The court found the plaintiffs were likely to succeed on the merits. 
 
Plans and TPMOs that were watching the litigation closely may have felt some relief. But here’s what that injunction didn’t change: the OIG’s analysis of kickback risk. The fraud alert predates the CMS compensation rule fight. Arrangements that look like performance-based payments tied to enrollment still carry Anti-Kickback risk regardless of what happens to the compensation cap rule. 
 
The litigation outcome removed one specific regulatory restriction. It didn’t eliminate the underlying liability exposure for arrangements that cross the line into kickback territory. 

What a Real TPMO Oversight Program Looks Like

Given all of this — CMS marketing rules, OIG fraud risk, FCA exposure, and the general complexity of multi-layered distribution networks — what does an actual TPMO oversight program need to include? 
 
At minimum, plans need to be doing four things. 
 
Active monitoring of marketing materials. Not just at contracting, and not just when materials get submitted for approval. Unapproved materials circulate. Agents use old versions. Sub-agents use things that were never submitted at all. Continuous monitoring of what’s actually appearing in the market — on websites, in ads, across social media — is the only way to find problems before CMS does. 
 
Regular audits of TPMO reporting compliance. Are TPMOs submitting monthly disciplinary action reports? Are those reports complete? Are the agents they cover consistent with what the plan’s own records show? These audits should be scheduled and documented. 
 
Payment arrangement reviews. Every compensation structure with a TPMO should be reviewed against both the permitted compensation rules and the OIG’s red flags for kickback risk. Any arrangement with enrollment targets, health status components, or escalating bonuses tied to plan selection deserves extra scrutiny. 
 
Defined escalation procedures. When a TPMO has a pattern of non-compliance, the plan is required to report it to CMS. Most plans have vague policies here. “Patterns of misconduct must be elevated” is not an oversight program. There should be defined thresholds, documented review processes, and clear accountability for who makes the reporting call. 

The Part Nobody Wants to Talk About

Here’s the honest version of how TPMO oversight often works in practice: plans rely heavily on the TPMO’s own compliance representations, conduct periodic reviews of submitted materials, and trust that the contracted obligations are being followed. 
 
That’s not enough. The Senate Finance Committee report from March 2025 documented in detail how the layers between a plan and the consumers being marketed to can obscure what’s actually happening on the ground. The committee found beneficiaries being misled, unapproved materials in circulation, and compensation arrangements that raised serious questions — across a system where MAOs were formally responsible but operationally distant from the front-line marketing activity. 
 
CMS is not sympathetic to operational distance as an explanation for compliance failures. If your name is on the plan, you own the distribution network’s conduct. 
 
The plans that manage this best aren’t just contracting better. They’re monitoring continuously. They’re getting real-time visibility into what their TPMOs and their TPMOs’ agents are actually putting in front of beneficiaries. 

This Is a Technology Problem As Much As a Policy Problem

The scale of the TPMO distribution ecosystem for a mid-size Medicare Advantage plan is not something a compliance team can manually review. There are too many agents, too many sub-agents, too many websites and ads and social posts and scripts. 
 
At IntegriShield, we monitor 100M+ pages per month across every consumer-facing channel. Medicare Advantage clients use us specifically because they need to know what’s actually in the market — not what was submitted for approval three months ago. We eliminate 100% of client review burden through full-service remediation, which means when something is wrong, we don’t just flag it. We handle it. 
 
No competitor covers the Medicare and healthcare compliance vertical the way we do. Most compliance monitoring tools are built for banking and fintech. The Medicare distribution network is its own thing, with its own rules, its own enforcement risks, and its own scale challenges. 
 
If you’re running a Medicare Advantage plan and your TPMO oversight program consists mostly of contracts and periodic check-ins, you already know there are gaps. We can help you find them before CMS does. 
 
Learn more at integrishield.com.