GAO: HealthCare.gov safeguards may not stop unauthorized agent/broker changes—what to do

The U.S. Government Accountability Office (GAO) released a new report on July 13, 2026, finding that safeguards used on HealthCare.gov to manage agent and broker access and consumer consent don’t always protect people from unauthorized plan changes.

For consumers who use a licensed agent or broker to enroll or switch Marketplace coverage—especially during open enrollment or a special enrollment event—the practical takeaway is simple: don’t rely on an intermediary alone. Check what was submitted and what your HealthCare.gov account shows.

What changed: GAO’s new report on HealthCare.gov agent/broker controls

GAO-26-108041, titled “Health Insurance Marketplaces: CMS Needs Stronger Controls to Prevent Unauthorized Actions by Agents and Brokers,” was published and publicly released on July 13, 2026. GAO examined whether the Centers for Medicare & Medicaid Services (CMS) has effective controls to ensure that (1) agents and brokers are properly authorized to help, and (2) consumers authorize—and are informed of—agent and broker activity.

GAO’s core finding: consent, access, and consumer notification gaps

GAO says CMS controls fall short in three areas:

• Consumer consent processes are weak for some agent or broker actions.
• CMS does not restrict access to consumer Marketplace records to the agent or broker already tied to an enrollment.
• Consumers are not informed of all agent or broker actions.

GAO also notes that CMS implemented procedures in 2024 meant to better ensure agents and brokers obtain consumers’ consent prior to certain actions. But GAO says those procedures do not prevent all unauthorized actions because they are not always used, and CMS takes limited steps to confirm the consumer’s identity.

GAO warns this could leave consumers unaware of changes to their health plan—or even lead to losing coverage.

How big is the problem? GAO cites thousands-level risk signals

GAO points to its earlier investigative work and ongoing analytical estimates, including:

• At least 160,000 federal Marketplace applications in plan year 2024 that GAO says had “likely unauthorized changes.”
• Consumer complaints tied to confirmed unauthorized enrollments and plan switches that GAO says grew more than fourfold from 2023 through 2025.

Read these figures as GAO’s assessment of risk and reported patterns—not proof that every unusual-looking case reflects the same cause or actor in every situation.

Who is affected: people using agents/brokers during enrollment and plan changes

This report is most relevant to consumers who:

• Use an agent or broker to apply for coverage or make changes on HealthCare.gov.
• Rely on someone else to submit a plan choice, then wait for confirmation.
• Are switching plans when premiums, eligibility, or effective dates can change costs and coverage.

GAO’s point isn’t that licensed professionals always misuse access. It’s that the federal process doesn’t consistently lock in consumer consent and visibility before certain changes take effect.

What to do now: a checklist based on HealthCare.gov’s fraud guidance

HealthCare.gov’s fraud-prevention tips pair well with GAO’s warnings. Here’s what to do after any agent/broker-assisted change:

• Log in and verify your selections—the plan, premium, and effective date—after you expect a change to be completed.
• Set up security codes for your Marketplace account so you get a unique login security code each time.
• Never share your password or security code with anyone, even if they claim to be with the Marketplace.
• Be cautious about unexpected contact: HealthCare.gov says no one can enroll you in a Marketplace plan outside open enrollment unless you qualify for a special enrollment period.
• Report suspected fraud or scams if someone requests money, asks for sensitive information (like your SSN), or threatens you—then contact the Marketplace Call Center for help.

What GAO recommended—and what HHS said

GAO is making two recommendations to CMS to strengthen controls that verify consumer consent, restrict access to consumer information, and notify consumers of agent and broker activity. GAO specifically points to approaches such as a one-time passcode and other safeguards.

GAO reports that the Department of Health and Human Services (HHS) concurred and described steps it is considering to address the recommendations.

What to watch next

GAO says CMS officials were exploring options to potentially implement new controls for the open enrollment period for plan year 2027, but that they had not yet made decisions at the time of the report. For consumers, that means the safest habit is to keep verifying your account activity and plan details throughout enrollment and any special enrollment changes.

Sources

• GAO: Health Insurance Marketplaces (GAO-26-108041)
• HealthCare.gov: Protect yourself from Marketplace fraud & scams

Related News

• EPA Seeks Public Comment on Potential Interim CCR Permitting Approach (Deadline July 29)
• FTC orders Rollins to stop enforcing noncompetes—what the deadlines require
• June 2026 housing starts rise, permits fall: Census/HUD pipeline signals
• FTC settlement: Hopper to pay $35M over fees—what to check before booking