How Long Do You Actually Have to Keep Medicare Call Recordings?

CMS treats a Medicare sales call and a Medicare enrollment call as different events with different recordkeeping obligations. A sales or marketing call — the outbound dial, the inbound lead-gen call, the appointment-setting conversation — falls under the marketing and communications retention rule. An enrollment call — the call where the beneficiary actually signs up for a plan — falls under a separate enrollment recordkeeping requirement that CMS did not touch in the CY2027 rulemaking.

Those are two different shelves in the same filing cabinet, with two different expiration dates. Competitor content routinely flattens them into a single retention number, which is exactly the confusion this page exists to fix.

Under the CY2027 Final Rule, marketing and sales call recordings move from a flat 10-year hold to a 6-year framework split into two phases:

1. 1Years 1–3: full audio recording must be retained.
2. 2Years 4–6: either the full audio or a written transcript of the call satisfies the requirement — you no longer have to keep the audio file itself for the back half of the window.

This provision applies to marketing and communications activity for contract year 2027 and takes effect October 1, 2026. If you're an agency or call center handling TPMO (Third Party Marketing Organization) calls, this is the rule that changes your storage math — not the enrollment rule below.

The 10-year retention requirement for enrollment records was not shortened. If a call results in an actual plan enrollment — the beneficiary agreeing to and completing enrollment in a Medicare Advantage or Part D plan — that record still needs to sit in your archive for a full decade. Nothing in the CY2027 rule rolls that back.

Use this as a quick sort before you build (or audit) a retention policy:

• Did the call include a sales pitch, plan comparison, or marketing discussion without the beneficiary completing enrollment? → 6-year marketing/sales bucket.
• Did the call end with the beneficiary enrolling in a plan? → 10-year enrollment bucket.
• Was it a lead-generation or appointment-setting call with no plan discussion? → 6-year marketing/sales bucket.
• Is it a follow-up service call after enrollment (billing, ID card, benefits question)? → Confirm with your compliance counsel; these often fall outside both rules and follow your organization's general recordkeeping policy.

A lot of retention guidance circulating right now was written against the old 10-year rule and updated in a hurry once the CY2027 rule published — or written by someone who skimmed a summary rather than the rule itself. The most common error is treating “6 years” as a blanket replacement for “10 years,” instead of a narrower rule that applies only to marketing and sales calls. The second most common error is missing the 3-plus-3 split inside the 6-year window and assuming all 6 years require full audio.

Neither error is malicious — it's just a compressed rule that's easy to oversimplify. But if your agency builds a retention and storage policy off a oversimplified summary, you're either paying to store audio you don't need to keep, or deleting a record you were legally required to hold.

The rule in question is the CY2027 Final Rule — CMS's annual update to Medicare Advantage and Part D program requirements, which included a package of marketing and communications changes alongside the retention shift. Three provisions in that package matter most for call centers and agencies:

• •Marketing/sales call retention drops from 10 years to the 6-year (3+3) framework described above.
• •The 48-hour Scope of Appointment waiting period is eliminated, but a documented SOA is still required before a covered appointment — see the SOA rule breakdown for the full before/after.
• •The TPMO disclaimer trigger moves from “within the first 60 seconds” to “before any discussion of benefits begins” — a timing change, not a removal of the disclaimer requirement.

None of these are reductions in what you have to document — they're changes to when and how long. That distinction matters when you're briefing a compliance team that's used to hearing “CMS relaxed the rules” and assuming that means less recordkeeping across the board.

Full-audio retention is the expensive part — transcripts and metadata are cheap to store by comparison. Cutting the full-audio requirement to 3 years, with years 4–6 satisfied by transcript alone, is a meaningful storage reduction if your vendor contract and your internal policy actually reflect the new split. If your current vendor contract still bills you for 10 years of full audio, or your internal policy hasn't been updated to route years 4–6 to transcript-only storage, you're paying for compliance you no longer need. See what compliant call storage should actually cost for the vendor-contract math, and the BAA checklist if that same vendor also touches protected health information — a Business Associate Agreement is required whenever a vendor creates, receives, maintains, or transmits PHI on your behalf, separate from the retention question.

Every call you're already required to retain — timestamp, duration, disposition, which lead source it came from — is the same data you'd need to answer a much more profitable question: which lead source actually produces policies that stick. ClaimFlow keeps the audit-ready call log CMS requires and ties each call back through the policy it produced to commission, renewal, and chargeback, so the same record that satisfies a CMS audit also tells you which vendor to stop paying for.

That's the practical case for building retention and attribution on one system instead of two: you're capturing the data either way, so it should answer both questions.