The Centers for Medicare & Medicaid Services has found a very large problem in the federal health insurance Marketplace.
It just hasn’t made particularly clear who was responsible for it.
On September 22, CMS announced that approximately 315,000 Marketplace enrollments covering more than 760,000 people had been investigated and confirmed as unauthorized. Those enrollments were canceled August 31, and CMS expects roughly $2.2 billion in advance premium tax credits associated with them to be returned to the federal government.
That is not an accounting error hiding behind a decimal point. It is roughly $2.2 billion in federal subsidies attached to health insurance enrollments CMS says consumers did not authorize.
CMS also announced that it had been busy with the people who help consumers enroll.
More than 200 agents and brokers had received termination notices since January, the agency said. Another 569 agents and brokers received Notices of Intent to Terminate during July and August after their enrollment activity raised compliance concerns.
Put all those numbers together and the announcement sounds relatively straightforward: hundreds of brokers, hundreds of thousands of unauthorized enrollments, and billions of dollars headed back to the Treasury.
Pull the numbers apart, however, and something curious happens.
CMS does not publicly connect them.
The agency’s September 22 fact sheet describes the canceled enrollments and its agent-and-broker enforcement efforts alongside one another, but it does not say that the 200-plus terminated brokers caused the 315,000 unauthorized enrollments. It does not say how many agents or brokers were responsible for those enrollments. Nor does it establish that the 569 brokers placed into termination proceedings were responsible for any particular portion of them.
In other words, CMS has disclosed the scale of several problems without providing the connective tissue showing how those problems intersect.
That distinction becomes more important the deeper one gets into the agency’s numbers.
The 569 agents and brokers were themselves divided into two groups.
CMS sent Notices of Intent to 100 agents and brokers in July after identifying enrollment activity indicating potential violations of Marketplace standards. Among the conduct drawing scrutiny were applications repeatedly submitted without required applicant information at rates CMS considered statistically implausible.
By September 22, the response period for those 100 agents had concluded. Sixty-six received termination notices.
Another 469 agents and brokers received Notices of Intent in late August based on similarly unusual rates of applications lacking identifying information. Their response periods had not yet concluded when CMS made its announcement.
That means 569 is not the number of agents CMS found guilty of fraud. It is an enforcement population assembled through statistical screening and subjected to an administrative process.
The distinction is rather important when the word “fraud” is doing as much work as it is in the agency’s announcement.
Then there is another number.
In an interim final rule published in the Federal Register the following day, CMS said it had issued 160 final terminations for Plan Year 2026 noncompliant behavior.
Those 160 do not neatly reconcile with the 66 terminations from the first group of 100, nor does CMS’s published material provide a crosswalk showing exactly how the 160 overlap with the more than 200 termination notices issued since January.
So we have at least four populations operating simultaneously: 315,000 unauthorized enrollments; more than 200 agents and brokers receiving termination notices since January; 569 agents and brokers receiving Notices of Intent during the summer; and 160 final Plan Year 2026 terminations.
CMS has published the numbers.
It has not published the ledger connecting them.
The New-Broker Problem
There is another wrinkle buried in the Federal Register.
CMS has temporarily stopped agents and brokers without Plan Year 2026 Exchange agreements from registering to participate in the federally facilitated Marketplace for Plan Year 2027. The moratorium took effect September 22 and is scheduled to remain in place until February 1, 2027, unless CMS ends, extends or modifies it earlier.
The agency’s reasoning is not difficult to understand.
CMS says newly registered agents and brokers have appeared disproportionately among enrollment activity raising serious compliance concerns. About 30 percent of the 569 agents and brokers receiving the July and August Notices of Intent were newly registered for Plan Year 2026, according to the agency.
New agents, however, accounted for only about 11 percent of registered agents and brokers with active enrollments.
That is a meaningful disparity, and CMS cited it as evidence supporting additional safeguards and the temporary moratorium.
But another CMS statistic complicates the picture.
Among the 160 agents and brokers receiving final terminations for Plan Year 2026 noncompliant behavior, only about 11 percent were newly registered.
Which means roughly 89 percent were not.
Using CMS’s percentage as an approximation, that works out to about 18 newly registered agents and brokers and roughly 142 who were already established Marketplace participants. The exact counts may differ slightly because CMS published percentages rather than raw figures.
So the agency’s data tell two stories at once.
New brokers were substantially overrepresented among the people whose behavior initially triggered CMS’s statistical alarms.
Established brokers, meanwhile, constituted the overwhelming majority of the agents and brokers whose cases had actually reached final termination.
That does not invalidate CMS’s concern about newcomers. Statistical screening and final enforcement are different stages of the process, and CMS says continued onboarding presents risks while it installs additional safeguards.
But it does raise an obvious question about where the larger vulnerability actually resides.
CMS’s immediate answer has been to close the front door.
Its own final-termination numbers suggest there may be plenty to examine among the people already inside.
Building the Locks After the Burglary
The safeguards CMS is now installing are revealing in their own right.
For Plan Year 2027, the agency says agents and brokers will face renewed identity proofing and authentication through Login.gov or ID.me. Applications involving agents or brokers will have to contain verifiable Social Security numbers or immigration-document numbers for non-newborn applicants. CMS is changing its systems to prevent agents and brokers from being attached to applications consumers are supposed to complete themselves through HealthCare.gov.
Enhanced Direct Enrollment partners will also have to obtain electronic consumer authorization before an agent or broker can act on an application or enrollment.
These are prospective safeguards, but they also illuminate the vulnerabilities CMS is trying to close.
The agency itself acknowledged that existing safeguards do not adequately address vulnerabilities involving agent and broker access to federal Exchange systems, enrollment functions and consumer personally identifiable information. CMS said existing enforcement mechanisms generally operate after an agent or broker has already registered and begun conducting transactions.
That makes the timing difficult to ignore.
The federal government is adding stronger identity verification, authentication and consumer-authorization controls after identifying hundreds of thousands of unauthorized enrollments and billions of dollars in associated subsidies.
The locks are being improved.
The interesting question is how long the door was open.
Plenty of Numbers, Few Names
CMS does maintain a public suspension and termination database containing National Producer Numbers, registration information, enforcement dates and reconsideration information.
But reconstructing the current crackdown from that database is not as simple as pulling down a list of 160 names.
National Producer Numbers can correspond to different kinds of producers or entities, historical enforcement records coexist with current ones, and suspensions, terminations and subsequent reinstatements can appear in the same broader dataset.
More importantly, CMS’s September announcement does not provide the crosswalk necessary to determine which agents or brokers were associated with the 315,000 confirmed unauthorized enrollments.
That leaves an unusually basic question unanswered after an unusually large federal enforcement announcement:
Who did it?
Bureaucracy Times submitted a media inquiry to CMS on September 22 requesting, among other things, the names and National Producer Numbers of terminated agents and brokers, their affiliations, effective dates and grounds for termination, clarification of CMS’s enforcement classifications, and the disposition of the 569 Notices of Intent.
CMS had not provided those answers as of publication.
The absence of a response does not erase what the agency has already documented.
There were 315,000 confirmed unauthorized enrollments involving more than 760,000 people. Approximately $2.2 billion in advance premium tax credits is expected to be returned. Hundreds of agents and brokers have entered various stages of enforcement proceedings. CMS has concluded that existing safeguards are insufficient and has temporarily barred new entrants while it builds stronger ones.
Those are substantial findings.
But they are not yet a map.
CMS has told the public how many unauthorized enrollments it found, how many people they affected, how much money was involved, how many brokers have been targeted through several different enforcement mechanisms, and why the agency believes additional controls are necessary.
What it has not shown is which brokers belong to which numbers.
For an enforcement campaign built around identifying unauthorized activity, that seems like a particularly useful identity check.
