OE27 Policy Updates for Brokers
What brokers need to know
What's changing
CMS is requiring EDE partners to add risk-based consumer identity proofing and consumer authorization for agent/broker-assisted EDE applications.Applications CMS may flag as higher risk
New applications, including applications for a different coverage state. Applications where the active enrollment has a net premium after APTC of $30 or less per month. Applications where the consumer is working with a different or new broker.What happens next
High-risk consumers must complete identity proofing before broker authorization can be completed. Lower-risk consumers must also complete the broker authorization step.
What the member will experience
The exact flow depends on the EDE platform and the transaction risk level.
Receive a verification request
Depending on the EDE platform and risk level, the member may get a text, email, or automated call with a single-use passcode or confirmation link. It expires in 15 minutes; only three notifications may be sent in 24 hours for the same agent/broker user and application.
Complete identity proofing
The member may be routed through CMS-provided Experian Remote Identity Proofing or another CMS-approved third-party identity proofing service.
Use manual review if needed
If electronic proofing fails, the member may be routed to a HealthCare.gov manual review path.
What brokers need to do now
Prepare every client before October 12, 2026
CMS is requiring EDE partners to enforce consumer identity proofing and agent/broker authorization for OE27. EDE partners must implement these requirements no later than October 12, 2026. Before October 12, brokers should: - Confirm each client's current mobile phone number, email address, and mailing address. - Make sure the client or authorized representative can directly access the phone number and email address on the application. - Remove broker, agency, professional, company, placeholder, or dummy contact information from consumer applications. - Collect and document consumer consent before searching for, accessing, updating, or submitting Marketplace application information. Prepare clients for a one-time passcode, confirmation link, identity questions, or a document review if the EDE platform requires it. - Prioritize outreach to clients most likely to hit friction: new applications, applications in a different coverage state, members with very low net premiums after APTC, clients changing brokers, clients with stale contact information, and anyone who has historically relied on their broker to complete every step. - Watch Oscar emails, Broker Portal updates, webinars, and toolkit materials for updated workflows and any at-risk member indicators.Keep consent and authorization separate
CMS identity proofing and EDE agent/broker authorization do not replace consumer consent. Before you work on a Marketplace application, you still need to obtain and document the consumer's consent. The new EDE authorization step confirms that the consumer authorizes a specific agent, broker, or web-broker user to assist on that application. Both matter.Plan for a slower first conversation
For OE27, the first assisted enrollment touch may take longer. Build time into your appointment for contact information cleanup, consent confirmation, identity proofing, authorization, and any troubleshooting.What brokers can and cannot do
Brokers can:
- Explain why CMS is requiring the step. - Help the member prepare the right information. - Stay with the member while they complete the process. - Help the member follow EDE platform, Experian, or Marketplace instructions if there is a failure. - Resume the application after identity proofing and authorization are complete.Brokers cannot:
- Use their own phone number, email address, mailing address, agency contact information, or placeholder information as the consumer's contact information. - Complete identity proofing as the consumer. - Bypass consumer authorization. - Proceed with EDE application changes when the required identity proofing or authorization step is incomplete. - Treat EDE authorization as a substitute for documented consumer consent.
Watch the OE27 policy updates webinar
Watch our webinar recording for key takeaways on identity proofing, high-risk applications, One-Time Password requirements, and steps to take before the October 12 deadline.
Important Documents
- Open Enrollment 2027 Policy Updates Webinar
- Broker ID Proofing Checklist
- Columbus II Updates
Frequently asked questions
- What if contact information is wrong after October 12?
After October 12, if a consumer's contact information is wrong, the consumer or authorized representative must correct it. CMS guidance says consumers can update incorrect information through the Marketplace Call Center or through the consumer pathway. Brokers should guide the member, but the consumer must have direct access to the application contact channels used for verification.
- What if identity proofing fails?
If electronic identity proofing fails, the member may need to use the Experian help desk, the EDE partner's approved third-party process, or a HealthCare.gov manual review path. Brokers should set expectations that the application cannot move forward through broker-assisted EDE until the required proofing and authorization are complete.
- How long does authorization last?
CMS guidance indicates that identity proofing may be evergreen on a given EDE platform when tied to the consumer's account and credentials. Otherwise, identity proofing may need to be confirmed for a coverage year.
Agent/broker authorization is collected each plan year and generally lasts for that plan year unless the consumer authorizes a different agent, broker, or web-broker.
- Does EDE authorization replace consumer consent?
No. Brokers must still collect and document consumer consent before accessing, searching, updating, or submitting Marketplace application information.
- Can I use my agency phone number or email if the client prefers it?
No. CMS guidance says brokers must not enter their own professional, personal, company, or dummy contact information as the consumer's application contact information.
- Can I complete identity proofing for the member?
No. The consumer or authorized representative must complete the identity proofing step. Brokers can explain and guide, but the member must complete the verification.
- What if the code expires?
Follow the EDE platform's resend process. CMS guidance says passcodes and links expire in 15 minutes and are limited to three notifications in 24 hours for the same agent/broker user and application.
- What if a member fails identity proofing?
Follow the platform instructions. The member may need the Experian help desk, a CMS-approved third-party identity proofing process, or HealthCare.gov manual review.
- Are the Columbus II stays final?
No. The stays apply while litigation continues and may change through appeal, additional court action, CMS guidance, or state DOI guidance.
Columbus II: What is stayed for now
On July 16, 2026, a federal court in City of Columbus v. Kennedy stayed several 2027 Notice of Benefit and Payment Parameters provisions while litigation continues. CMS issued guidance explaining that certain provisions scheduled for July 20, 2026 or plan year 2027 did not or will not go into effect as finalized while the stay remains in place.