A Fraud Filter Is Not a Finding.

The enforcement action is large. The public record is more precise than the headline.

On September 22, CMS announced several related Marketplace actions. Its interim final rule says that on August 31 the agency canceled approximately 315,000 plan-year 2026 policies covering more than 760,000 individuals. Those enrollments involved agent or broker assistance, lacked verified citizenship or immigration documentation, and concerned people whom issuers could not contact or for whom issuers could not identify claims. Reuters reported that CMS expects the cancellations to recoup about $2.2 billion in advance premium tax-credit payments.

CMS also said it had issued 569 notices of intent to terminate Exchange agreements to agents and brokers whose activity included statistically implausible rates of applications without identifying information such as Social Security numbers. The first 100 response periods had concluded when CMS published its fact sheet, and 66 of those agents or brokers had received final termination notices. The remaining notices were still moving through their response periods.

A third action reaches people who were not accused of anything. Effective immediately, CMS paused plan-year 2027 registration for agents and brokers who lacked current plan-year 2026 Exchange agreements. The moratorium runs until February 1, 2027 unless lifted earlier. It does not apply to state-based Exchange registration, and the rule preserves an exception when a prior termination or denial is reversed or an agreement is reinstated.

A risk marker, a compliance case, and a fraud finding are different things

The agency's data support attention to newly registered brokers. CMS says brokers who first registered for 2026 represented about 11 percent of registered agents and brokers with at least one active enrollment, but about 30 percent of the 569 recipients of intent-to-terminate notices. The same group had higher rates of unresolved income verification, missing Social Security numbers, unresolved citizenship or immigration verification, and other anomalies. Those comparisons describe risk concentration. They do not establish that every new broker, every flagged application, or every person without a claim was illegitimate.

That distinction matters because the indicators do not all mean the same thing. No claims may suggest a phantom enrollment, or it may describe a healthy person who never used coverage. Failed contact may expose fabricated data, an abandoned phone number, a language barrier, a move, or ordinary nonresponse. Missing or unresolved immigration documentation can reflect ineligibility, but it can also reflect a data-matching or submission problem. Statistical screening is valuable precisely because it identifies where to investigate. Calling the signal the conclusion collapses the investigation into the filter.

CMS's own structure recognizes this. The 569 broker matters began with notices of intent, not a statement that all 569 had been finally found noncompliant. The regulation provides rebuttal and reconsideration procedures for broker suspensions and terminations. CMS's fact sheet says the agency will investigate potentially unauthorized enrollments and cancel those confirmed as unauthorized. Each verb identifies a different stage of proof.

There are three process tracks, and they should not be confused

The first track concerns consumers. Marketplace eligibility decisions can generally be appealed within 90 days of the eligibility notice, and HealthCare.gov directs people asked for supporting documents to submit them so that the Marketplace can issue an updated decision. An enrollee's practical problem is immediate: determine what notice was sent, whether the cancellation concerns eligibility or an unauthorized enrollment, what documents are missing, whether coverage can continue during review, and whether medical care or prescriptions create an urgent timeline.

The second track concerns identified agents and brokers. Under 45 C.F.R. section 155.220, an agent or broker may submit evidence during certain suspensions and may request reconsideration of a termination within 30 calendar days of written notice. The regulation gives CMS 60 calendar days to issue the reconsideration decision. That is a professional-compliance process, not a substitute for correcting an individual consumer's record.

The third track is structural. The moratorium applies prospectively to a category of brokers based on the risk CMS identified in the cohort. It does not depend on proof that each affected would-be registrant engaged in misconduct. CMS estimates that 6,956 brokers who otherwise would have produced active enrollments during open enrollment will be affected and that $71 million to $98 million in commission revenue will shift to existing brokers. The agency characterizes much of that amount as a transfer, not a social cost. For the excluded entrant, however, it is still lost business opportunity.

The system weaknesses are documented, not hypothetical

The case for stronger controls does not rest only on agency suspicion. In July, the Government Accountability Office reported that consumer complaints tied to confirmed unauthorized enrollments and plan switches grew more than fourfold from 2023 through 2025. GAO found that CMS's processes did not always prevent unauthorized activity, did not consistently restrict access to the agent already associated with an enrollment, and did not inform consumers of every agent action. Its review identified at least 160,000 plan-year 2024 applications with likely unauthorized changes.

GAO's recommendations focused on the point of action: verify that the consumer actually consented and tell the consumer what the broker did. CMS now says it will require renewed identity proofing for existing brokers, verifiable Social Security or immigration document numbers on broker-assisted applications for non-newborn applicants, restrictions on adding brokers to consumer-completed applications, and electronic consumer authorization before a broker acts.

Those controls operate differently from a retrospective purge. They attempt to establish identity, authority, and consent while the transaction occurs. That produces better evidence for both sides. It can stop an unauthorized change before coverage moves, and it can protect a compliant broker from being judged later only by patterns in a large book of business.

Immediate rulemaking changes the market before the comments arrive

CMS issued the moratorium through an interim final rule effective immediately while inviting public comment afterward. The Administrative Procedure Act generally contemplates notice and an opportunity to comment before a legislative rule takes effect, but it permits an agency to proceed without that sequence when it finds good cause that prior notice would be impracticable, unnecessary, or contrary to the public interest. CMS says prompt action is necessary because unauthorized enrollments have persisted and the next open-enrollment period is close.

The rule also acknowledges the tradeoff. It estimates transfers of commission revenue, possible operational losses, and potential job losses. It says consumers will retain access to tens of thousands of existing registered agents and brokers, while industry representatives quoted by Reuters argue that a blanket pause may burden legitimate entrants rather than only bad actors. Those positions concern the fit between the documented risk and the breadth of the temporary response. The comment process will build the record; it does not postpone the response.

Nothing about that sequence proves that the moratorium is lawful or unlawful. No court has adjudicated the new rule. The relevant point for lawyers is classification: an interim final rule, a fact sheet, a notice of intent, a final termination, and an individual eligibility determination carry different legal weight. Treating them as interchangeable makes both advice and public explanation less accurate.

The notice is where system-level confidence meets an individual record

A lawyer helping an affected person needs to resist two opposite shortcuts. The first is to assume that a mass enforcement action must be arbitrary because some individual records will be wrong. The second is to assume that strong aggregate evidence resolves every individual case. Neither follows. A well-founded fraud model can produce false positives. A person who ultimately proves eligible can still have incomplete documentation. A compliant broker can work within a cohort that presents elevated risk.

The useful file begins with dates and documents: the eligibility notice, proof of attempted contact, the application history, the identity of any associated broker, authorization records, data-matching notices, immigration or citizenship documents where applicable, tax-credit information, plan usage, and any pending treatment. That record reveals whether the dispute concerns consent, identity, eligibility, documentation, broker conduct, or several of them at once.

The September 22 action is important because of its scale, but scale is not its most instructive feature. The same institution is using aggregate data to redesign access, case-specific processes to discipline professionals, and eligibility mechanisms to alter individual coverage. The law asks different questions at each layer. A fraud filter can tell the government where to look. The legitimacy of the result depends on what happens after it looks.

This article analyzes CMS and GAO materials, federal regulations, and public reporting. It does not determine any enrollee's eligibility, any broker's compliance, or the legality of the interim final rule, and it is not individualized health-insurance or legal advice.