Delaware Broker Designation - Designate Broker through Authorization
OE27 Identity Verification & Risk Management: Essential Reference Guide for Agents
1. Overview of the OE27 CMS Policy Updates
The Centers for Medicare & Medicaid Services (CMS) has established significant compliance mandates taking effect for Open Enrollment 2027 (OE27). Under these updated rules, CMS requires Enterprise-Differentiated Enrollment (EDE) partners to enforce risk-based consumer identity proofing and explicit consumer authorization across all agent- and broker-assisted enrollment flows.
To maintain active platform access and ensure regulatory compliance, EDE partners must enforce these identity verification and agent authorization protocols no later than October 12, 2026.
OE27 Primary Agent Directive: Enterprise-Differentiated Enrollment (EDE) partners must enforce risk-based consumer identity proofing and consumer authorization for all broker-assisted applications no later than October 12, 2026. Agents must obtain documented consent, clean up client contact data, and guide members through verification without completing steps on their behalf.
For new and practicing agents, this policy update fundamentally shifts the cadence and execution of consumer interactions. Because high-risk consumers must successfully complete identity proofing before agent authorization can occur, you should anticipate a noticeably slower first conversation during OE27 touchpoints. Dedicated appointment time must be structured to accommodate rigorous contact information cleanup, consent documentation, client identity verification, agent authorization, and potential technical troubleshooting.
Understanding this foundational policy mandate provides essential context for recognizing the specific application conditions that flag an enrollment as high risk.
2. Risk Triggers: Identifying High-Friction Applications
CMS automatically evaluates enrollment transactions to determine their risk profile. Applications flagged as higher risk require the consumer to complete identity proofing before the agent/broker authorization step can be finalized. Lower-risk consumers must still complete the agent/broker authorization step.
To manage workflow friction and proactively prepare consumers, agents must understand the regulatory rationale behind each CMS risk trigger:
Risk Trigger Condition | Practical Agent Strategy |
New Applications & State Transfers: New applications submitted to the Marketplace, including existing policyholders applying for coverage in a different state. | Proactively inform the consumer that identity proofing will be required during enrollment. Prepare the member for potential identity questions or document upload requirements before initiating application work to prevent session abandonment. |
Low Net-Premium Enrollments: Active enrollments where the member's net premium after the Advanced Premium Tax Credit (APTC) is $30 or less per month. | Prioritize early outreach to these clients. CMS targets low net-premium applications for heightened scrutiny due to historical vulnerability to unauthorized broker switches, scheme enrollments, and fraud. Educate members on the regulatory need for identity verification to secure their ongoing subsidies. |
Broker Changes: Applications where the consumer is transitioning to work with a new or different agent/broker. | Recognize that switching brokers automatically triggers high-risk verification flows. Ensure the client is fully briefed, accessible in real-time, and equipped to complete identity proofing before executing the broker-of-record change. |
Recognizing these risk triggers enables agents to prepare members for the specific step-by-step technical workflow and verification mechanics that follow.
3. The Member Identity Verification & Technical Workflow
When an application triggers identity proofing, the member must successfully navigate a defined sequence of verification steps established by CMS and the EDE platform.
Receive Verification Request: The member receives an automated verification request generated by the EDE platform based on the transaction's risk level. Depending on the platform and client preferences, the request is dispatched via text, email, or automated call containing a single-use passcode or confirmation link.
Passcode & Link Expiration Limit: Verification passcodes or confirmation links expire 15 minutes after issuance.
Notification Volume Limit: EDE systems strictly enforce a maximum allowance of 3 notifications per 24 hours for the same agent/broker user and application combination.
Critical Operational Workflow Rule: Agents must confirm that the consumer is live on the phone and actively ready before triggering a verification send. If an agent triggers 3 notifications while a client is away or unavailable, the application will be locked out of automated electronic verification for 24 hours.
Complete Identity Proofing: The member completes electronic verification directly through CMS-provided Experian Remote Identity Proofing or another CMS-approved third-party identity proofing service.
Use Manual Review / Escalation (If Needed): If primary electronic proofing fails or encounters technical issues, the member is routed to secondary support pathways:
Experian Help Desk: Members experiencing identity validation failures with Experian can be directed to the specialized Experian help desk for identity resolution.
HealthCare.gov Manual Review: If electronic proofing cannot be completed through automated channels, the member must be routed into the HealthCare.gov manual review path, where identity documentation must be submitted for manual verification.
While agents are expected to support consumers through technical glitches and escalation pathways, strict operational boundaries govern what an agent can and cannot do during this process.
4. Permitted vs. Prohibited Broker Assistance (Agent Boundaries)
CMS rules strictly define acceptable agent behavior during identity proofing and authorization. Operating outside these boundaries constitutes a severe compliance violation—including unauthorized identity manipulation—which can result in immediate termination of EDE portal access, regulatory sanctions, and potential legal penalties.
OE27 Broker Assistance Boundaries
PERMITTED ACTIONS (What You CAN Do) | PROHIBITED ACTIONS (What You CANNOT Do) |
Explain Compliance Requirements: Explain why CMS requires identity proofing and agent authorization for OE27 enrollments. | Use Agency or Broker Contact Details: Enter broker, agency, professional, company, placeholder, or dummy phone numbers, emails, or mailing addresses as consumer contact details. |
Assist with Information Preparation: Help the consumer gather and organize the correct demographic and identity information prior to verification. | Impersonate Consumer / Complete Proofing: Complete identity proofing as or on behalf of the consumer (only the consumer or their legal authorized representative may complete it). |
Provide Real-Time Guidance: Stay on the phone or in person with the member while they directly navigate the verification workflow. | Bypass Consumer Authorization: Skip, bypass, or attempt to circumvent required consumer authorization steps. |
Guide Escalation Pathways: Assist members in following platform, Experian help desk, or HealthCare.gov manual review instructions if an error or failure occurs. | Prematurely Execute Application Changes: Proceed with EDE application modifications while required identity proofing or authorization steps remain incomplete. |
Resume Application Completion: Resume and complete the assisted enrollment application after identity proofing and authorization steps are fully finalized. | Substitute Consent for Authorization: Treat EDE agent authorization as a substitute for separate, documented consumer consent. |
To maintain absolute compliance within these operational boundaries, agents must master the fundamental legal distinction between consumer consent and agent authorization.
5. Disambiguation: Consumer Consent vs. EDE Agent Authorization
Consumer Consent and EDE Agent Authorization are distinct, mandatory regulatory requirements. Acquiring one never waives or satisfies the other; both must be independently collected and documented.
Compliance Component | Primary Purpose | Timing Requirement | Duration / Expiration |
Consumer Consent | Grants documented legal permission for an agent/broker to search for, access, update, or submit Marketplace application details. | Prior Mandatory Action: Must be collected and documented before conducting any Marketplace search, access, or application updates. | Ongoing Mandate: Continuous requirement across all broker-assisted application activities; never expires or waives based on authorization steps. |
EDE Agent/Broker Authorization | Confirms that the consumer formally authorizes a specific agent, broker, or web-broker user to assist on their EDE application. | Workflow Step: Collected directly during the EDE application workflow (following identity proofing for high-risk applications). | Plan Year Basis: Collected each plan year and lasts for that plan year (unless the consumer authorizes a different broker). Crucial Distinction: EDE Identity Proofing itself may be evergreen on a platform when tied to user account credentials, or confirmed per coverage year. |
Clear comprehension of these regulatory standards enables agents to build a proactive, compliant pre-enrollment execution strategy.
6. Agent Action Plan & Platform Workflows
To prepare operations before the October 12, 2026 enforcement deadline, agents should execute a systematic compliance cleanup, target high-risk client segments, and utilize integrated platform tools.
Pre-October 12, 2026 Agent Compliance Checklist
[ ] Audit Client Contact Details: Review existing client rosters to confirm current mobile phone numbers, email addresses, and physical mailing addresses.
[ ] Verify Direct Contact Access: Ensure the client or their legal authorized representative has direct, personal access to the phone number and email address listed on the application.
[ ] Purge Placeholder Information: Remove all broker, agency, professional, company, placeholder, or dummy contact details from existing consumer applications.
[ ] Secure Written Consumer Consent: Collect and document valid consumer consent before searching for, accessing, updating, or submitting any Marketplace application details.
[ ] Educate Clients on Verification Protocols: Inform clients in advance about receiving 15-minute one-time passcodes, confirmation links, identity verification questions, or document submission steps.
[ ] Monitor Carrier & Platform Bulletins: Review Oscar emails, Broker Portal notices, webinars, and official toolkit updates for evolving workflow rules and at-risk member flags.
Priority Client Outreach Groups
Agents should prioritize early outreach to client populations facing the highest likelihood of OE27 workflow friction:
Clients submitting new applications or applying for coverage in a different state.
Members with active plan enrollments resulting in a net premium of $30 or less per month after APTC.
Clients who are transitioning from a different broker or switching to your management.
Clients with stale, missing, or unverified contact information.
Individuals who have historically relied entirely on their broker to navigate every application step without personal platform interaction.
HealthSherpa Enrollment Advantage: To dramatically streamline administrative overhead and eliminate drop-off friction, agents utilizing the HealthSherpa platform can leverage an integrated multi-authorization send. Instead of managing fragmented outreach, agents have the option to collect Consumer Consent, PY26 Authorization, and PY27 Authorization in a single, consolidated send. Consolidating three separate signature friction points into one single client touchpoint maximizes completion rates and ensures seamless client readiness ahead of open enrollment.