Health Law Daily Wrap Up, AUDITS AND MONITORING—GAO REPORTS: Weaknesses in CMS controls are leaving consumers vulnerable to unauthorized Marketplace agent or broker actions, (Jul 16, 2026)

By Jeffrey H. Brochin, J.D.

Although CMS controls can help ensure agents and brokers are licensed and registered, the agency’s other controls are insufficient for preventing unauthorized activity by agents and brokers, leaving consumers vulnerable to unauthorized enrollments and plan changes made by unscrupulous agents and brokers.

The U.S. Government Accountability Office (GAO) has issued its report on CMS’s program integrity practices as to the oversight of agents and brokers in the health insurance Marketplaces. The report found that CMS’s current controls do not adequately protect consumers from unauthorized activity by unscrupulous agents and brokers. Although CMS implemented new procedures in 2024 to better ensure that agents and brokers obtain consumers’ consent prior to taking certain actions, the GAO found that the procedures do not prevent all unauthorized actions because they are not always used, and CMS takes limited steps to confirm the identity of the consumer. Consumer vulnerability led to a fourfold increase in consumer complaints of unauthorized enrollments between 2023 and 2025 (GAO Report, GAO-26-108041 and GAO Report, GAO-26-108297 (July 13, 2026)).

Marketplace enrollment pathways. The federal Marketplace offers multiple pathways to enroll in health insurance coverage—primarily through HealthCare.gov (also known as the Marketplace pathway) or through a CMS-approved, non-Marketplace website hosted by an enhanced direct enrollment (EDE) entity. Through the Marketplace pathway, the consumer typically completes the application and enrollment steps with verbal advice and guidance by an agent or broker. In contrast, through the EDE pathway, the agent or broker typically completes the steps on behalf of the consumer. Most enrollments in the federal Marketplace are assisted by an agent or broker through the EDE pathway.

Agents and brokers can provide assistance to consumers who are trying to decide among their Marketplace plan options and can help them apply for coverage and related financial assistance. Agents and brokers must be licensed in the state in which they sell plans; and, to work with consumers in states that use the federal Marketplace, agents and brokers must be registered, and execute required agreements, with the federal Marketplace.

CMS oversight role. CMS is responsible for overseeing agents and brokers in the federal Marketplace and ensuring that they comply with federal rules. As part of its oversight responsibilities, CMS investigates complaints, referrals, and other leads reported to CMS from various sources, including consumers, other agents and brokers, issuers, and state insurance regulators. CMS’s contractor, the Marketplace Program Integrity Contractor (MPIC), supports the agency in its investigations, with both entities analyzing various data sources, such as person search activity and enrollment trends.

Why the GAO did the study. Recent federal fraud cases highlighted concerns about certain agents and brokers in the federal Marketplace making unauthorized enrollments and plan changes to receive compensation from health plan issuers. Based on previous (yet ongoing) investigative work, GAO found at least 160,000 federal Marketplace applications in plan year 2024 had likely unauthorized changes. GAO was therefore asked to review program integrity practices in health insurance Marketplaces. The report examines the extent to which CMS has controls to ensure (1) agents and brokers in the federal Marketplace are licensed and registered, and (2) consumers authorize, and are informed of, agent and broker activity.

How the study was conducted. To perform the evaluation, GAO compared CMS controls to federal regulations and CMS policies and procedures by reviewing CMS documentation and interviewing CMS officials. GAO also interviewed organizations representing stakeholders—including agents and brokers, state insurance regulators, and consumers—and reviewed documentation and interviewed officials from three selected state-based Marketplaces—California, Georgia, and New Mexico—about their controls. The performance audit was conducted from January 2025 to July 2026 in accordance with generally accepted government auditing standards.

What the study found. According to CMS, as of January 2026, there were about 96,000 agents and brokers who were registered with the federal Marketplace, with CMS restricting access to the agency’s systems only to registered agents and brokers. As per CMS guidance, the agency requires EDE entities to restrict system access to agents and brokers who--when they registered with the federal Marketplace--created a CMS Enterprise Portal account with unique login credentials and multi-factor authentication. Furthermore, CMS policies prohibit agents and brokers from having more than one CMS Enterprise Portal account or sharing login credentials. But the study also found that notwithstanding those guardrails:

In 2024 the agency observed a high volume of login sessions on EDE platforms, and through its routine data analysis, MPIC reports showed that CMS identified cases of potential credential sharing. For example, CMS identified agents or brokers who conducted between 600 to 1,000 person searches in a single day or who submitted over 800 enrollments per day, which was likely an indication of potential credential sharing; and,

While CMS controls can help ensure agents and brokers are licensed and registered, the agency’s other controls were found to be insufficient for preventing unauthorized activity by agents and brokers. The auditors found weaknesses in CMS controls to: (1) verify consumer consent authorizing agent and broker activity on their accounts, (2) restrict agent and broker access to consumer information, and (3) ensure consumers were notified of agent and broker actions. Together those weaknesses left consumers vulnerable to unauthorized activity by unscrupulous agents and brokers. This resulted in at least 160,000 federal Marketplace applications in plan year 2024 likely having unauthorized changes.

Recommendations going forward. As a result of the study, GAO made two recommendations: first, that CMS design and implement stronger controls to ensure consumers consent to, and are informed of, agent and broker actions, such as with a one-time passcode and other controls; and, second, that the Administrator of CMS should periodically review the relevance and effectiveness of the controls it implements to ensure consumers authorize, and are informed of, agent and broker activity on their federal Marketplace enrollments and make changes as appropriate based on those reviews.

HHS concurred with both of the recommendations, and described its ongoing efforts to identify and prevent unauthorized enrollments and plan switches by unscrupulous agents and brokers. HHS also outlined steps the agency is considering that could address the recommendations.

ReportsLetters: GAOReports AuditNews HealthReformNews