Federal health-insurance marketplace controls do not reliably stop agents or brokers from changing consumers’ coverage without authorization, the Government Accountability Office concluded in a July review of the system maintained by the Centers for Medicare & Medicaid Services.
The problem is not licensing alone. CMS validates licenses and restricts system access to registered agents and brokers, but GAO found that those checks do not establish whether a specific consumer approved a specific enrollment or plan change.
GAO identified three connected weaknesses: consent procedures are not always used and include limited identity confirmation; a marketplace record is not restricted to the agent already connected to the enrollment; and consumers are not notified about every agent or broker action.
Those weaknesses can turn a behind-the-scenes record change into a practical loss of care. GAO said unauthorized switches may separate consumers from doctors or medications, increase deductibles and copayments, or produce tax-credit repayment problems when eligibility information is changed.
The complaint trend intensified. Complaints tied to confirmed unauthorized enrollments and plan switches grew more than fourfold from 2023 through 2025. In earlier investigative work, GAO identified at least 160,000 plan-year 2024 applications with likely unauthorized changes.
That 160,000 figure requires care: “likely unauthorized” is an analytical classification, not a final count of individual victims, and multiple applications do not necessarily equal the same number of consumers. The report nevertheless treats the scale and complaint trajectory as evidence that existing controls are insufficient.
GAO compared federal practices with selected state marketplaces in California, Georgia and New Mexico. It found stronger controls in those systems, including one-time passcodes that can bind an agent action to consumer consent.
The watchdog made two recommendations, including stronger controls to ensure consumers consent to and learn about agent or broker actions. HHS concurred with both. CMS said it was exploring options for the 2027 plan-year open enrollment period, but had not selected new controls when GAO reported.
For consumers, the report’s immediate implication is to scrutinize marketplace notices and current-plan details. For CMS, GAO’s test is more structural: an action should require affirmative consumer verification, access should be appropriately constrained and every consequential change should produce a notice.