GAO’s bottom line is about how Marketplace controls work. It does not allege wrongdoing by any specific agent or broker, but it warns that weaknesses can leave consumers unaware of changes to their plans or even at risk of losing coverage.

GAO’s three Marketplace control gaps

GAO highlights three areas where CMS controls fall short:

• Consent checks: GAO says processes to ensure consumer consent for agent or broker actions are weak.
• Enrollment-record access: GAO says CMS does not restrict access to consumer Marketplace records to the agent or broker already associated with a consumer’s enrollment.
• Consumer notifications: GAO says CMS does not inform consumers of all agent or broker actions.

What CMS changed in 2024—and why GAO still found gaps

In 2024, CMS implemented new procedures to better ensure agents and brokers obtain consumers’ consent before certain actions. CMS also said that starting July 19, 2024, it would block an agent or broker from making changes to a consumer’s federally-facilitated Marketplace (FFM) enrollment unless the agent was already associated with that consumer’s enrollment.

GAO acknowledges these steps, but concludes additional improvements are still needed—GAO says the procedures do not prevent all unauthorized actions because they are not always used, and CMS takes limited steps to confirm the consumer’s identity.

Why this can hit households

If a consumer’s plan enrollment or plan selection is changed without their authorization, the impact can be more than administrative. GAO warns consumers may not realize changes happened, and in the worst case could face loss of coverage.

GAO’s recommendations: tighter safeguards and ongoing review

GAO recommends CMS strengthen controls to ensure consumers consent to, and are informed of, agent and broker actions. GAO specifically points to safeguards that could include a one-time passcode and limits on what consumer details an agent can access, along with clearer consumer notifications about agent activity. GAO also recommends CMS periodically review the relevance and effectiveness of the controls it implements.

What consumers should do now

• Monitor your Marketplace account activity for plan and enrollment changes you did not request.
• Double-check any renewal or plan switch, especially if you worked with an agent or broker to make changes.
• Act quickly if something looks wrong: review the change details promptly and contact the Marketplace and/or your insurer to get clarity and correction.

What to watch next

The immediate question for consumers is whether CMS will implement GAO’s recommended stronger consent verification, tighten access to enrollment records, and improve consumer notifications—then verify over time that those safeguards work as intended.

Sources

• U.S. Government Accountability Office (GAO) — ACA Marketplace: Agents’ scams and efforts to prevent them (GAO-26-108297)
• CMS statement on system changes to stop unauthorized agent/broker Marketplace activity (effective July 19, 2024)