Medicare Annual Enrollment 2026: What Practices Can Tell Patients (and What They Can't)

The Medicare Annual Enrollment Period runs from 15 October to 7 December 2026, with the coverage people choose taking effect on 1 January 2027. The Medicare Advantage Open Enrollment Period then runs from 1 January to 31 March, for people already in a Medicare Advantage plan who want to switch.

Those dates are the easy part. The hard part is that for eight weeks your front desk will be asked, several times a day, which plan a patient should pick — and the honest answer is that your practice is not allowed to tell them.

This is the compliance question US practices most often get wrong, and they get it wrong quietly, through a brochure rack and a helpful receptionist.

01The rules bind plans. You get exposed by acting like one.

CMS marketing and communications requirements sit in 42 CFR Part 422 Subpart V for Medicare Advantage and Part 423 Subpart V for Part D, and are restated each year in the CMS Medicare Communications and Marketing Guidelines. They bind plan sponsors and the entities that market on their behalf, including agents, brokers and third-party marketing organisations.

A physician practice is not, by default, one of those entities. It becomes one — or becomes a problem for the plan it contracts with — when it starts performing enrollment activity. That distinction is the whole of your compliance posture, and it is easier to hold than it looks.

02What a practice can generally do

Provide objective, plan-neutral information about how Medicare works, including the enrollment dates themselves.

Tell patients which plans the practice participates in, and which it will participate in for the coming year. This is not marketing; it is a material fact about their care.

Display or make available materials for the plans it contracts with — for all of them, not a selected one.

Point patients at the neutral sources: medicare.gov, 1-800-MEDICARE, and the State Health Insurance Assistance Program, the federally funded, free counselling service that exists in every state precisely for this.

Host an educational session on how Medicare works, provided it stays plan-neutral and does not turn into a sales event.

03What it must not do

Accept or collect enrollment applications, or help complete one.

Steer. That includes recommending a specific plan, ranking plans, or making plan-to-plan comparisons for a patient.

Offer anything of value — a gift, a waived fee, a service — to induce someone to enroll in a particular plan.

Accept compensation from a plan for enrollment-related activity.

Distribute plan marketing materials in areas where care is delivered. Exam rooms and treatment areas are out. Common areas such as waiting rooms are treated differently, but the material still has to cover every contracted plan rather than one.

Imply that CMS or Medicare endorses the practice or a plan.

If your ads generate leads that are passed or sold to agents, look carefully at whether you have become a third-party marketing organisation, with the disclaimer and contract obligations that follow. Parts of the 2024 CMS rule on agent and broker compensation have been litigated, so check the current status before you build anything on it.

04The most valuable page you can publish is boring

Not a Medicare explainer. Those exist in their thousands and you will not outrank the government on them.

Publish an accurate, dated plans we accept page, updated for the coming year, with a short change log at the bottom saying what moved and when. Add a plain sentence about what a patient should do if their plan is leaving your network.

This ranks for the query people actually type — your practice name plus a plan name — it answers the question your phone lines are being asked, and it is the one page on this subject where you are the authoritative source. The structure that makes it work is the same one we use across geriatrics practice pages and senior living marketing: answer the specific question the searcher has, on a page they can verify.

05The event that works is plan-neutral

Invite a SHIP counsellor. Provide the room, the coffee and the audience. Do not provide the recommendation.

You get the goodwill, the older adults in your community get genuinely independent advice, and nobody in the room is compensated for an enrollment. It is also the only version of a Medicare event that a compliance officer will sign off without a long conversation.

Promote it as education, not as an enrollment opportunity, and keep plan logos off the flyer.

06What patients are actually searching in October

Not Medicare Annual Enrollment Period. The government owns that query and you will not take it.

What they search is narrower and far more useful to you: your practice name plus a plan name. Does [practice] accept [plan]. Doctors near me that take [plan] 2027. [Plan] leaving [area] 2027. Do I have to change doctors if I change plans.

Every one of those is a question only you can answer authoritatively, and most practice websites answer none of them. The network status page, written properly and kept current, is the asset. Add a short FAQ underneath it covering the question people are really asking — whether switching plans means switching doctors — and you have covered the whole of the high-intent search set for your own panel.

Keep the tone factual. The moment the page starts characterising plans as better or worse, you have moved from information into the steering the rules prohibit.

07Advertising mechanics, and where the tracking risk actually sits

Google and Meta both treat health insurance as a restricted advertising category with certification and policy requirements that change. Read the current policy pages before you build the campaign rather than after your account is limited in the middle of AEP.

On tracking: practices are covered entities, and the analytics question here is genuinely unsettled. The HHS Office for Civil Rights bulletin on online tracking technologies was revised in March 2024 and then partly vacated in June 2024 in American Hospital Association v. Becerra. Building your position solely on that bulletin is out of date in both directions.

The live exposure for a practice is FTC Section 5 enforcement over deceptive data practices, the Health Breach Notification Rule, and state privacy law. Neither Google nor Meta signs a business associate agreement, so identifying data should not reach either one regardless of how the HIPAA question resolves. Our HIPAA compliance page and the HIPAA-compliant marketing guide cover how to configure a stack that survives both readings.

08Using your own patient list

This is where the HIPAA line sits, and it is a clean one.

HIPAA defines marketing at 45 CFR 164.501 as a communication about a product or service that encourages its purchase or use. Where a covered entity receives payment from a third party in exchange for making that communication, it needs a patient authorization.

Applied here: a letter to your own panel telling them which plans you will accept next year, paid for by you, is a treatment and operations communication. A letter to the same panel paid for by a plan, encouraging enrollment in that plan, is marketing and needs authorization. The money is what changes the analysis, not the wording.

The same logic applies to a text message or an email campaign, with the TCPA sitting on top of it for anything sent to a phone.

09The mistake that is easiest to make and hardest to undo

An agent or a broker offers to run a Medicare seminar in your waiting room, pay for the catering, and bring their own materials. It sounds like free community outreach and it converts your practice into part of a plan's sales operation.

Once that has happened, the compliance exposure is no longer theoretical, and neither is the patient-trust problem: an older adult who enrolled in a plan after a session held in their doctor's office will reasonably believe their doctor recommended it.

If you want the room used, use it for a SHIP session or for your own plan-neutral education. If an agent asks, the answer is a polite no with the SHIP number attached.

10Give the front desk a script

Three sentences, printed, at every desk:

We accept these plans for 2027 — here is the list. We are not allowed to tell you which plan to choose. Here is the SHIP number and medicare.gov, and they are free.

Then a handout with the plan list, the SHIP contact, and 1-800-MEDICARE. Nothing else. No plan brochures behind the desk, no personal opinions, no my mother went with this one.

Train it in September. In November it is too late, because the habit is already formed.

11What to build before 15 October

The plans we accept page, dated, with next year's list confirmed against your contracts.

A network-change notice for any plan you are leaving or that is leaving you, sent early, in plain language.

The front desk script and handout.

One SHIP-led education session on the calendar.

A quick audit of every page and ad that mentions Medicare, checking for language that ranks or compares plans, and for tracking tags on pages where an insurance selection happens. That last check catches more problems than the rest of the list combined, and it is the one nobody runs. The same audit sits inside our work on getting insurance patients and on healthcare SEO for practices with a large Medicare panel.

Done once, this set carries forward every year. The dates move, the plan list changes, the boundary does not.

---

If you want a review of your Medicare-facing pages, your tracking configuration and your front-desk materials before enrollment opens, get a free audit and we will send the findings whether or not you work with us. Or book a strategy call to plan the season with your compliance officer on the line.