Medicare Scope of Appointment (SOA): Rules, Storage Requirements, and Best Practices for Agents

If you’re a Medicare agent or broker, you know that CMS compliance isn’t optional. One misstep during the Annual Enrollment Period can trigger an audit, put your contracts at risk, or result in hefty fines. Among the many compliance requirements you must juggle, the Medicare Scope of Appointment stands out as both critical and commonly misunderstood.

Whether you’re an independent agent, part of a small agency, or supported by an FMO, understanding SOA rules isn’t just about checking a box. It’s about protecting your business, staying audit-ready, and building trust with your clients. In this guide, we’ll break down everything you need to know about the Medicare Scope of Appointment, including when it’s required, how to collect it properly, storage requirements, and best practices that keep you compliant year-round.

What Is a Medicare Scope of Appointment (SOA)?

A Medicare Scope of Appointment is a mandatory CMS form that documents what products you’re allowed to discuss with a beneficiary during a sales appointment. Think of it as a permission slip that sets clear boundaries for your conversation.

The purpose is simple: CMS wants to ensure beneficiaries aren’t ambushed with sales pitches for products they didn’t agree to discuss. The SOA protects both the consumer and the agent by creating a documented record of intent.

Here’s what makes an SOA valid:

• It must be signed before the appointment begins
• It lists the specific product types you’ll discuss (Medicare Advantage, Part D, Medicare Supplement, etc.)
• It includes the date and beneficiary’s signature
• It documents whether the appointment is in-person, by phone, or virtual

When collected properly, the Medicare Scope of Appointment becomes a critical piece of your compliance documentation and proves you followed CMS marketing rules.

When Is a Medicare SOA Required?

Not every interaction requires a Medicare Scope of Appointment, but most sales-related activities do. Here’s when you must collect one:

Sales Appointments

Any scheduled meeting where you plan to discuss or enroll a beneficiary in Medicare products requires an SOA. This includes:

• In-person appointments at a beneficiary’s home, your office, or a public location
• Phone appointments where you intend to present plan options
• Virtual meetings conducted via Zoom, Teams, or other platforms

Educational Events vs. Sales Events

If you’re hosting an educational seminar and won’t be discussing specific plans or collecting applications, an SOA isn’t required. However, the moment the conversation shifts to plan recommendations or enrollment, you must have a signed SOA on file.

Walk-Ins

If a beneficiary walks into your office without an appointment, you still need to collect a Medicare Scope of Appointment before discussing plans. You can do this on the spot, but it must happen before the sales conversation begins.

Phone Calls

Cold calls and unsolicited outreach require verbal SOAs documented in your notes. If a beneficiary calls you asking about plans, you should still confirm scope before diving into product details.

The key rule: when in doubt, collect the SOA. It’s far better to have documentation you didn’t need than to face an audit without it.

Medicare SOA CMS Rules Agents Must Follow

CMS has clear expectations for how agents collect and document the Medicare Scope of Appointment. Here are the rules you must follow:

Timing Requirements

The SOA must be collected before the sales appointment begins. If you’re meeting in person, get it signed when you arrive. For phone appointments, complete the verbal SOA at the start of the call and document it immediately.

Product Types Allowed

The SOA must specify which product types you’ll discuss. You cannot discuss products that weren’t listed on the form. Common categories include:

• Medicare Advantage Plans (Part C)
• Medicare Prescription Drug Plans (Part D)
• Medicare Supplement Insurance (Medigap)

If you initially list only Medicare Advantage but the beneficiary asks about Part D, you must update the SOA before proceeding.

Verbal vs. Written SOA

CMS allows verbal SOAs for phone appointments, but you must document:

• The date and time of the call
• The products the beneficiary agreed to discuss
• The beneficiary’s verbal consent

Written SOAs are required for in-person and most virtual appointments.

Documentation Expectations

Your SOA records must include enough detail to reconstruct the appointment if questioned during an audit. This means capturing:

• Full name of the beneficiary
• Date of the appointment
• Agent name and National Producer Number (NPN)
• Clear indication of which products were within scope

Missing any of these elements can result in compliance issues, even if you technically collected an SOA.

Medicare SOA Storage Requirements

Collecting the Medicare Scope of Appointment is only half the battle. How you store it matters just as much, especially when CMS comes knocking during an audit.

Retention Period

CMS requires agents to retain SOA documentation for at least 10 years from the date of the appointment. This applies whether the appointment resulted in an enrollment or not.

Acceptable Storage Formats

You can store SOAs in multiple formats, including:

• Physical paper files (must be organized and secure)
• Scanned PDFs (ensure they’re legible and backed up)
• Digital forms collected via compliant platforms
• Dedicated SOA management software

The format doesn’t matter as long as you can retrieve the document quickly during an audit.

Audit-Readiness Expectations

During a CMS audit, you’ll need to produce SOAs for specific beneficiaries within a short timeframe. This means your storage system must be:

• Searchable by beneficiary name or date
• Secure and protected from unauthorized access
• Backed up to prevent data loss

If you can’t produce an SOA when requested, CMS may assume the appointment was non-compliant, even if you collected it properly.

What CMS Looks for During Audits

Auditors typically review:

• Whether SOAs were collected before appointments
• If the products discussed matched the scope
• How quickly you can retrieve documentation
• Whether your storage system is organized and secure

Failing any of these checks can result in corrective action plans, contract sanctions, or termination.

Common Medicare SOA Compliance Mistakes

Even experienced agents make SOA mistakes. Here are the most common pitfalls and how to avoid them:

Missing Timestamps

Many agents collect SOAs but forget to include the date or time. Without a timestamp, you can’t prove the SOA was collected before the appointment.

Wrong Product Scope

Listing the wrong products on the SOA is a red flag. If you discuss Medicare Advantage but only listed Part D on the form, that’s a violation. Always double-check the boxes before the beneficiary signs.

Lost Paper SOAs

Paper forms are easy to misplace, especially during busy enrollment periods. One lost SOA can derail an entire audit. If you’re still using paper, implement a same-day scanning process.

No Retrieval System

Storing SOAs in random folders or unlabeled boxes makes retrieval nearly impossible. Without a clear naming convention or database, you’re gambling with your compliance.

Expired SOAs

Some agents mistakenly believe SOAs don’t expire. While CMS doesn’t specify an expiration date, best practice is to collect a new Medicare Scope of Appointment for each appointment or enrollment period.

Paper vs Digital SOA Collection

How you collect the Medicare Scope of Appointment impacts your efficiency and compliance risk. Here’s a breakdown:

If you’re still relying on paper or generic PDFs, you’re working harder than necessary. Digital SOA collection tools streamline the process, reduce errors, and ensure you’re audit-ready at all times.

Best Practices for Medicare SOA Management

Managing the Medicare Scope of Appointment doesn’t have to be overwhelming. Follow these best practices to stay organized and compliant:

Use Consistent Naming Conventions

If you’re storing SOAs digitally, create a naming system like: (LastName_FirstName_MMDDYYYY_SOA.pdf) . This makes retrieval fast and reduces the risk of duplicate or misfiled documents.

Link SOAs to Client Records

Connect each SOA to the beneficiary’s profile in your CRM or database. This ensures you can pull up all related documentation in one place.

Track Expiration and Updates

Set reminders to collect new SOAs at the start of each enrollment period or before follow-up appointments. This prevents you from relying on outdated documentation.

Prepare Audit Packets in Advance

Don’t wait for an audit notice to organize your records. Build quarterly audit packets that include SOAs, enrollment forms, and communication logs for a sample of clients.

Train Your Team

If you work with other agents or support staff, ensure everyone understands Medicare Scope of Appointment rules. Consistency across your team reduces compliance risk.

Tools to Collect and Store Medicare SOAs

The right tools can transform your SOA process from a compliance headache into a streamlined workflow.

Spreadsheets

Many agents start with Excel or Google Sheets to track SOAs. While better than nothing, spreadsheets fail when you need to:

• Retrieve specific documents quickly
• Prove secure storage during an audit
• Scale as your book of business grows

Generic CRMs

Most CRMs allow document uploads, but they’re not built for Medicare compliance. You’ll still need to manually organize, name, and track SOAs, which leaves room for error.

Purpose-Built SOA Collection & Storage Tools

Dedicated SOA platforms are designed specifically for Medicare agents. They offer:

• Compliant digital collection (e-signature ready)
• Automatic timestamping and product tracking
• Searchable, audit-ready storage
• Secure cloud backups
• Integration with enrollment workflows

These tools position you as compliance-first and eliminate the guesswork around CMS requirements.

Medicare SOA FAQ

Q1. How long must SOAs be retained?

A1. CMS requires agents to retain the Medicare Scope of Appointment for at least 10 years from the date of the appointment.

Q2. Can SOAs be collected electronically?

A2. Yes. Electronic SOAs are compliant as long as they include all required elements (date, signature, product scope) and are stored securely.

Q3. Are verbal SOAs allowed?

A3. Verbal SOAs are permitted for phone appointments, but you must document the beneficiary’s consent, the date, and the products discussed in your records.

Q4. Do SOAs expire?

A4. CMS doesn’t specify an expiration date, but best practice is to collect a new SOA for each appointment or enrollment period.

Q5. What happens if an SOA is missing?

A5. A missing Medicare Scope of Appointment during an audit can result in compliance violations, corrective action plans, or contract sanctions. Always collect and store SOAs properly.

Final Thoughts

The Medicare Scope of Appointment isn’t just a form—it’s your first line of defense in a CMS audit. By understanding the rules, implementing best practices, and using the right tools, you can protect your business and focus on what you do best: helping beneficiaries find the right Medicare coverage.

If you’re still collecting or storing Medicare SOAs manually, now is the time to upgrade your process. Download our free compliance checklist or try our SOA collection and storage tool