Medicare Advantage Marketing: Is It Getting Enough Attention in Your Compliance Risk Assessment?

I recently listened to an AHLA podcast on Medicare Advantage marketing, based on an excellent article by Devon Minnick and Helaine Fingold of Epstein Becker Green.

I expected the discussion to be interesting. What I didn't expect was to come away thinking that I had probably been looking at Medicare Advantage marketing compliance too narrowly.

I've spent much of my career in managed care compliance. I understand the importance of Medicare marketing requirements, agent and broker oversight, approved materials, beneficiary communications and the many other rules surrounding the sales and enrollment process. But the article and subsequent podcast discussion made me think about the risk more broadly.

Because Medicare Advantage marketing isn't simply about whether a marketing piece meets CMS requirements. It is also about compensation and incentives. Beneficiary access and choice. Agent and broker behavior. State licensing requirements. Consumer protection. Federal preemption. Third-party oversight.

And increasingly, artificial intelligence.

That raises a question worth considering:

When was the last time your compliance risk assessment took a serious look at Medicare Advantage marketing?

Marketing risk extends well beyond marketing materials.

One of the issues discussed in the podcast involved changes some Medicare Advantage plans have made to agent and broker compensation. Plans may decide not to pay commissions on certain products while continuing to make those products available to beneficiaries.

On its face, that may look like a compensation or business decision. The plan is still available. A beneficiary can still enroll. But look at the issue from the beneficiary's perspective.

Many beneficiaries rely on agents and brokers to help them understand what can be an extraordinarily complicated set of choices. If an agent isn't being compensated to enroll beneficiaries in a particular plan, will that plan receive the same attention as one for which the agent is compensated?

The podcast participants acknowledged that the answer isn't necessarily straightforward. Plans have legitimate business and financial considerations. Agents and brokers have economic realities of their own. CMS wants to maintain beneficiary access to plans and keep plans participating in the Medicare Advantage market. State regulators are concerned about consumer protection and whether compensation practices could affect what beneficiaries are offered.

There doesn't have to be a bad actor for there to be a compliance risk. Sometimes the risk exists because perfectly legitimate interests create incentives that may produce unintended consequences. And that is exactly the kind of issue a good compliance risk assessment should be looking for.

Then there's the question of who regulates what.

The regulatory structure makes the issue even more complicated.

CMS has taken the position that federal Medicare law broadly preempts state regulation of Medicare Advantage marketing, including areas such as agent and broker compensation, communications and marketing requirements, and enrollment standards. States, however, retain authority over insurance producer licensing. They also have broader responsibilities around consumer protection and unfair trade practices.

So we end up with an interesting division of responsibility. CMS regulates the Medicare Advantage plan. States regulate the licenses of the agents and brokers selling the product. And both have an interest in what happens to the beneficiary.

Several states have attempted to address practices they believe could limit beneficiary access or constitute unfair trade practices. CMS, in turn, has reminded states of the broad federal preemption applicable to Medicare Advantage.

For compliance professionals, the practical lesson is important.

“What does CMS require?” may not always be the only question we need to ask.

Depending on the activity, we may also need to understand state licensing requirements, consumer protection laws and the responsibilities of the various parties involved in the marketing process.

What are your agents, brokers and marketing partners actually doing?

There is another familiar compliance issue embedded in all of this: third-party oversight. A significant amount of the interaction with beneficiaries may occur outside the four walls of the Medicare Advantage organization.

Agents, brokers and other marketing partners are speaking with beneficiaries, explaining products, answering questions and helping individuals make enrollment decisions. That makes oversight particularly important.

It isn't enough to know what the approved script says or what the marketing materials look like. What is actually happening during beneficiary interactions? What are complaints telling us? Are certain products being recommended disproportionately? Could compensation arrangements or other incentives be influencing behavior? Are there patterns that deserve further review?

Are we monitoring our marketing partners based on risk, or simply checking that required oversight activities have been completed?

These are the kinds of questions that move compliance beyond checking whether a requirement exists and toward understanding whether the controls are actually working.

And now we're adding AI

As if the existing environment weren't complicated enough, artificial intelligence introduces another layer.

AI can already assist with marketing content, beneficiary communications, plan comparisons and customer support. Over time, these tools will become increasingly capable of performing functions historically performed by agents and brokers.

That creates some interesting compliance questions.

• At what point does an AI tool stop providing general information and begin making an individualized recommendation?

• At what point does it move from supporting a licensed agent to effectively performing work that ordinarily requires a license?

• If an AI tool recommends one plan over another, how do we know what influenced that recommendation?

• Could the design, training or configuration of the system create its own form of steering?

• And if the AI provides inaccurate information or an inappropriate recommendation, who is accountable?

There isn't yet a comprehensive regulatory framework that answers all of these questions.

But organizations using AI cannot wait for every regulatory question to be resolved before deciding how to govern its use.

Start with the activity, not the technology

This is where I think traditional compliance principles remain incredibly useful. Rather than starting with:

“Is there an AI regulation that addresses this?”

Start with:

“What is the AI actually doing?”

Then ask what rules would apply if a person were performing the same activity.

If AI is creating Medicare marketing content, the requirements governing that content still matter. If it is communicating with beneficiaries, the rules governing those communications still matter. If it is making individualized recommendations, consider what requirements ordinarily apply to someone performing that function. If it is supporting an activity requiring a licensed professional, determine what meaningful involvement by that professional needs to look like.

The technology may be new. Many of the underlying risks are not.

AI may also give compliance a better way to monitor marketing.

There is an important opportunity here as well. AI isn't only something compliance needs to govern. It could also significantly improve how compliance monitors Medicare Advantage marketing.

Consider call monitoring. Traditional auditing typically means selecting a sample of calls and reviewing them against defined criteria. There are practical limits to how many interactions a compliance team can review.

AI potentially changes that. Organizations may increasingly be able to analyze much larger volumes of recorded calls and written communications, identify deviations from approved messaging, detect unusual patterns and flag higher-risk interactions for human review.

That could allow compliance teams to move toward more comprehensive and risk-based oversight rather than relying as heavily on relatively small samples.

There is an important distinction, though, between using AI to monitor a regulated activity and using AI to perform the regulated activity itself.

Both may be appropriate. But they present different risks and require different controls.

So, back to the risk assessment.

The article and podcast made me reconsider what I would expect to see when Medicare Advantage marketing appears on a compliance risk assessment.

Is the organization looking primarily at marketing materials and CMS requirements?

Or does the assessment also consider:

• agent and broker compensation and incentives;

• potential steering and beneficiary access;

• agent, broker and marketing partner oversight;

• beneficiary complaints and other indicators of actual marketing practices;

• state licensing and consumer protection requirements;

• federal and state regulatory responsibilities;

• monitoring of beneficiary interactions;

• emerging uses of AI in marketing and enrollment; and

• accountability when technology becomes part of the process?

Not every organization will have the same risk profile, and not every one of these issues will warrant the same level of attention. But that is the purpose of the risk assessment: to ask the questions, understand how the organization actually operates and determine where the meaningful risks lie. For me, the bigger takeaway from this discussion wasn't simply that Medicare Advantage marketing is complicated. It was that “marketing compliance” may be a much broader category of risk than the label suggests.

And as AI becomes increasingly integrated into how plans and their partners communicate with beneficiaries, that category is likely to become broader still.

If Medicare Advantage is part of your organization's business, it may be worth taking another look at what sits underneath the words “marketing risk” on your compliance risk assessment.