GAO Finds Gaps in ACA Broker Safeguards

CMS lacks adequate ACA broker fraud safeguards to stop agents and brokers from enrolling individuals into ACA coverage or switching their plans without consent, according to a report from the Government Accountability Office published July 13. More than 19 million people were enrolled in ACA coverage as of February, and about 96,000 agents and brokers were registered with the federal marketplace as of January.

CMS’s Prior Steps to Strengthen ACA Broker Fraud Safeguards

In 2024, CMS began blocking unassociated agents and brokers from making changes to marketplace enrollments and requiring three-way verification calls after a wave of consumer complaints, then proposed broader marketplace integrity rules that year, including a standardized consent form and expanded authority to hold agents accountable. In 2025, the agency finalized the tougher measures and updated its consent documentation requirements as part of a wider push under the Trump administration to tighten ACA program integrity.

A Sharp Rise in Confirmed Unauthorized Enrollments

Consumer complaints that CMS received and later confirmed as unauthorized ACA enrollments or plan switches rose from 66,548 in 2023 to 258,424 in 2024 and 299,604 in 2025, despite these prior ACA broker fraud safeguards already being in place.

Scope of Unauthorized Activity Found by GAO

GAO reported in December that at least 160,000 federal marketplace applications for plan year 2024 had likely unauthorized changes by agents or brokers. This figure suggests that even with earlier integrity measures in place, gaps in ACA broker fraud safeguards allowed a substantial volume of unauthorized activity to continue.

Three Core Weaknesses Identified

GAO identified three core weaknesses in CMS controls: the agency’s processes to verify consumer consent are weak, it does not limit access to a consumer’s enrollment record to the agent or broker already tied to that enrollment, and it does not notify consumers of all agent and broker activity.

How the Person Search Tool Exposes Gaps in ACA Broker Fraud Safeguards

The report also noted that the person search tool is easy to exploit. Any registered agent or broker, not only the agent of record, can pull a consumer’s full enrollment record by entering a first name, last name and date of birth. The record includes contact details, employment and income information, and the last four digits of household members’ Social Security numbers, a significant privacy exposure tied directly to weak ACA broker fraud safeguards.

Verification Calls Remain Inconsistent

Despite the previously implemented integrity measures, GAO found the three-way calls among the consumer, the agent or broker and the marketplace call center are not required for all enrollments or changes, and identity is verified using information that may be public. CMS officials and other stakeholders said unauthorized individuals have posed as consumers on those calls, and GAO previously found brokers submitted applications for two fictitious consumers with invalid Social Security numbers.

State Exchanges Show Stronger ACA Broker Fraud Safeguards

GAO reviewed exchange policies in California, Georgia and New Mexico and found controls that exceed the federal marketplace, including one-time passcodes to confirm consumer consent and consumer notifications of enrollments and agent-of-record changes. In California specifically, there is no person search function. Officials from two of the states said unauthorized activity is not a major problem on the state exchanges, suggesting that stronger ACA broker fraud safeguards at the state level may be measurably more effective.

GAO’s Recommendations and HHS’s Response

GAO made two recommendations, and HHS agreed with both. HHS said it is working on new requirements that would require a one-time consumer confirmation, such as a passcode, before an agent or broker can act on a consumer’s behalf, and would restrict access to a consumer’s full application to the agent or broker of record, ahead of open enrollment for 2027 coverage. CMS also told GAO in March that it was still weighing other new policies and had not made final decisions.

What Stronger ACA Broker Fraud Safeguards Could Mean Going Forward

With HHS committing to implement passcode-based verification and tighter access restrictions ahead of the 2027 open enrollment period, consumers may see more consistent ACA broker fraud safeguards at the federal level in the near future. Given the scale of confirmed unauthorized activity, from roughly 66,500 cases in 2023 to nearly 300,000 in 2025, the effectiveness of these upcoming changes will likely be closely tracked by consumer advocates, state regulators, and industry stakeholders alike.

For more healthcare industry updates, insights and news, visit DistilINFO. Click here to subscribe to stay informed.