Stronger controls are needed at the Centers for Medicare & Medicaid Services to stop agents and brokers from changing Affordable Care Act plans without permission, according to a new Government Accountability Office report. The watchdog found that the agency’s current methods for confirming consumer consent are insufficient, allowing unauthorized actions that have left thousands of people unaware of coverage changes.
Consumer complaints about unauthorized enrollments and plan switches jumped from 66,548 in 2023 to 299,604 in 2025. The rapid increase suggests that existing security measures are failing to keep pace with the volume of activity on federal and state marketplaces. CMS requires agents and brokers to be licensed and registered before they can access enrollment systems, but the GAO report highlights significant gaps in the verification process.
The agency also conducts routine licensing checks, yet it does not limit access to a consumer’s marketplace records to the specific agent or broker associated with that enrollment. Furthermore, the system does not notify consumers about every action taken on their accounts. In 2024, CMS implemented new procedures to ensure agents obtain consent prior to certain actions, but the report notes these procedures are not always used and CMS takes limited steps to confirm the identity of the consumer.
Related: HHS moves to fine health data blockers
State marketplaces show better security
GAO examined three state-based marketplaces—California, Georgia, and New Mexico—and found they employ controls that go beyond those used by the federal government. Those safeguards include requiring a one-time passcode to confirm that a consumer authorized an agent or broker to act on their behalf. The report recommended that CMS adopt similar measures, including passcodes and limits on how much consumer data non-record agents can access during searches.
Unauthorized enrollment activity can leave consumers unaware that their health plans have changed or cause them to lose coverage altogether. This vulnerability is particularly concerning given the recent regulatory actions CMS has taken to address improper enrollments, including income-verification requirements and a new evidentiary standard for terminating noncompliant broker agreements. The agency also finalized expanded authority to immediately suspend agents and brokers suspected of making unauthorized coverage changes, following a July 2024 decision to restrict broker access to HealthCare.gov enrollments.
The watchdog also suggested the agency periodically assess whether its safeguards are effectively preventing unauthorized actions. Department of Health and Human Services officials agreed with both recommendations and stated they will provide more information when ready to implement the changes. CMS told the GAO it is exploring additional safeguards for the 2027 open-enrollment period but has not yet decided which controls to implement.