Siga las instrucciones aquí para traducir esta página a otro idioma usando Chrome.
On October 12, 2026, the Centers for Medicare & Medicaid Services (CMS) implemented a requirement that all agent-driven Affordable Care Act (ACA) enrollments include an agent authorization step.
HealthSherpa allows agents to begin collecting authorizations for plan year 2027 before the Open Enrollment Period (OEP) begins.
In this article we'll cover:
Review CMS' guidance and FAQs released August 7, 2026 to learn more.
Agent authorization at a glance
Agent authorization is a consumer's confirmation that a specific agent is permitted to access their Marketplace application. As of October 12, 2026, CMS requires this authorization for all agent-driven enrollments.
How the process works:
The agent sends a consumer an authorization request by text or email.
The consumer receives the request.
The consumer confirms they want to grant authorization.
CMS requires identity verification for applications flagged as high risk before authorization can be granted.
Authorization is completed.
Agent authorization relies on the agent’s Federally Facilitated Marketplace (FFM) username and is required once per plan year, per agent, per Enhanced Direct Enrollment (EDE) platform.
Authorization is not required each time an authorized agent interacts with a consumer's application. However, only one authorization can be active at a time, and a new authorization replaces any previous authorization.
Agent authorization & consent
Agent authorization & consent
Agent authorization, Consumer Consent, and Eligibility Application Review are three separate requirements that serve different purposes.
Agents need agent authorization annually to access a consumer's Marketplace application. Agent authorization does not meet CMS consent requirements or replace the need to capture consent.
Consent is made up of two separate parts that are collected and documented at different points in the enrollment journey. These parts are called Consumer Consent and Eligibility Application Review.
Agents will still need to obtain and document Consumer Consent & Eligibility Application Review when providing assistance.
Agent authorization & CMS' Invalid Action error
Agent authorization & CMS' Invalid Action error
Agent authorization and CMS' Invalid Action error (now retired for enrollment submissions) occur at different points in the application and rely on different identifiers.
Agent authorization takes place before an agent can begin or access an application. It relies on FFM username, and is required once per plan year, per agent, per EDE platform.
Agent authorization has no impact on the National Producer Number (NPN) associated with a consumer's existing enrollment.
CMS' Invalid Action error occurred at the end of an application and was based on the NPN associated with the enrollment. While CMS' Invalid Action error may still appear when assisting consumers with certain requests (e.g. cancellations), it was retired for enrollment submissions beginning October 12, 2026 to align with the release of the agent authorization requirement.
Agent authorization & National Producer Number (NPN)
Agent authorization & National Producer Number (NPN)
Agent authorization concerns access to a consumer’s application on HealthSherpa. Agent authorization relies on the agent’s FFM username, not the NPN. As a result, agent authorization does not affect the NPN associated with the enrollment or carrier commission relationships.
When an agent’s NPN is already associated with the enrollment, the agent still needs active agent authorization before accessing or servicing the application.
Agents can update the NPN associated with the enrollment, which identifies the Agent of Record (AOR), by completing an enrollment submission on HealthSherpa:
During OEP, agents can actively renew the consumer’s coverage.
Outside of OEP, agents can resubmit the consumer’s enrollment. Application changes and Special Enrollment Period (SEP) eligibility are not required, but agents must resubmit the application and complete the plan confirmation step.
The carrier receives the AOR update only after the enrollment submission is complete.
When agent authorization is required
Agent authorization is required for agent-driven enrollments submitted through the FFM. Authorization is completed once per plan year, per agent, per EDE platform. Authorization is needed from the primary contact on the application only; other household members listed on the application do not need to provide authorization.
Each authorization is valid for a single plan year and does not roll over to the next plan year. Authorization for plan year 2026, including authorization granted through grandfathering, does not apply to plan year 2027 applications. Agents will need to collect a new authorization for each consumer every plan year.
Plan year 2026: Agents only need agent authorization to access or service a non-grandfathered application. When sending a plan year 2026 authorization request, agents can include a plan year 2027 authorization request, allowing the consumer to authorize both plan years using a single email or text.
Plan year 2027: Agent authorization is required for all agent-driven enrollments, including renewals. Agents can begin collecting plan year 2027 authorizations before OEP begins.
Agents can view & service plan year 2026 grandfathered clients without interruption. For all other plan year 2026 & plan year 2027 applications already in the Clients page, the agent has a view-only record until they obtain agent authorization. This is similar to the view available when an application does not have an active EDE sync.
Agent authorization is also required for applications submitted using the Enrollee Assistance Program (EAP).
EAP Shared-Service Model (SSM): Agents need agent authorization when completing enrollment submissions, and follow the same initiation steps outlined in this article.
EAP Full-Service Model (FSM): Agent authorization is also required, and HealthSherpa manages the process.
When agent authorization is not required
When agent authorization is not required
Agent authorization applies to agent-driven enrollments only. Agent authorization is not required for:
Passive renewals, unless or until an agent tries to access or service the application.
Consumer-driven applications, such as those done using an agent’s marketing link, unless or until an agent tries to access or service the application.
Off-exchange applications, since agent authorization is required for FFM applications only.
Authorizations tab
Located within the Clients page of the HealthSherpa account, the PY2027 Authorizations tab provides a single place to view and manage authorizations across an agent’s book of business.
From the PY2027 Authorizations tab, agents can:
Initiate authorization requests
View & track authorization statuses
Search for consumers
Columns & statuses
Columns & statuses
Client: The primary applicant’s name.
Plan year: Plan year associated with the authorization.
Authorization status: The status of the authorization.
Not authorized: An authorization request has either not yet been sent to the consumer, or authorization has been removed.
Not started: An authorization request has not yet been sent to the consumer.
Client declined: The consumer declined the authorization request.
Authorized to another agent: Authorization has been granted to another agent.
Pending authorization: An authorization request has been sent to the consumer, but has not yet been completed.
Request sent: The consumer has not yet clicked the link within the authorization request.
Link clicked: The consumer is attempting to verify their identity, and the application has been flagged as high risk by CMS; or authorization is for plan year 2027, and OEP has not yet started.
ID verification issue: The consumer has experienced at least one issue while attempting to verify their identity, and the application has been flagged as high risk by CMS; or authorization is for plan year 2027, and OEP has not yet started.
Authorized: Authorization is active.
An Authorized status does not indicate Consumer Consent has been granted. When a request for Consumer Consent is included in the authorization request, refer to the Consent library to track consent completion.
Last updated: The most recent date and time the authorization request was updated by the agent or the consumer.
Contact info: The contact information associated with the consumer's application. When available, the order of information displayed is primary phone number, secondary phone number, then email address.
Action: Includes the option to get authorization or resend a request for authorization.
To remove a consumer from view, select Hide or the crossed-out eye icon in the Action column.
To return a consumer to view, select Show hidden from the filter list, then select the eye icon in the Action column.
Consumers who have been archived appear with a grayed-out checkbox, as shown for Donald Duck in the example above.
Initiating authorization requests
Agents can choose to email or text an authorization request to the contact information associated with the consumer's application.
Per CMS regulations, authorization requests can be resent to a consumer up to three times per day. Authorization links expire after fifteen minutes; however, consumers can refresh authorization links without agent assistance.
Plan year 2026
Plan year 2026
As of October 12, 2026, agent authorization is required for plan year 2026 applications.
When a consumer is already connected to the agent's HealthSherpa account, authorization status for plan year 2026 is visible from the All clients tab of the Clients page, the client’s Details tab, the Leads page, and the lead’s Details tab.
For plan year 2026, agents can use the payment filter on the All clients tab to remove terminated or canceled plans from view.
Grandfathered clients
Grandfathered clients
Grandfathering automatically authorizes the writing agent (i.e. FFM username) who last serviced the client's plan year 2026 application. Agents who use more than one HealthSherpa account will find the grandfathered application only in the account where it was last serviced, or claimed.
Grandfathering will only take place when the application is not high risk or the consumer has verified their identity on HealthSherpa in the past.
Grandfathering applies to plan year 2026 only and does not carry over to plan year 2027.
Agents can continue servicing grandfathered clients with their plan year 2026 application without interruption.
When assisting a consumer who is not grandfathered, agents will need to collect agent authorization.
Agents can initiate authorization requests to a single consumer by selecting Get authorization or by conducting a search & claim.
When requesting authorization for plan year 2026, agents can also choose to include an authorization request for plan year 2027, include a request for Consumer Consent, and adjust the language to Spanish.
It is not possible to initiate plan year 2026 authorization requests to more than one consumer at a time.
When a consumer is not already listed on the agent's Clients page, agents will be prompted to collect agent authorization during search & claim.
If the consumer is new to the Marketplace, the agent will be prompted to obtain authorization once contact information has been entered.
Plan year 2027
Plan year 2027
HealthSherpa allows agents to begin collecting authorizations for plan year 2027 even before the OEP begins.
From the PY2027 Authorizations tab on the Clients page, an agent can initiate authorization requests to a single consumer or multiple consumers at once.
The PY2027 authorizations tab includes all clients in the HealthSherpa account, including those that may be canceled or terminated.
Initiate a request to a single consumer
Initiate a request to a single consumer
To initiate an authorization request to a single consumer, select Get authorization from the Action column.
Choose whether to send the authorization request by text or email. Agents can also choose to include a request for Consumer Consent, and adjust the language to Spanish.
Customizing the request
Customizing the request
The email subject line and body can be customized as needed. To customize the email prior to sending, select the pencil icon.
Select Send to generate the customized authorization request, or Back to return to the previous screen.
Select Text link or Email link to to generate an authorization request.
After sending an authorization request, agents will see an authorization status box.
From the authorization status box, agents can wait for the client to complete the request, resend the request, refresh the status of the request, or choose to send the request using whichever method, email or text, was not used initially. Sending the request using email or text instead will cancel the current, pending request.
Close the authorization status box to return to the PY2027 Authorizations tab.
Initiating requests to multiple consumers at once
Initiating requests to multiple consumers at once
When initiating authorization requests to more than one consumer at a time, each consumer will receive their own secure authorization request.
The Bulk authorize option can be used to email or text up to 1,000 consumers at a time. To narrow the list of recipients, use the filters or select the checkbox next to a consumer's name to identify consumers who should receive a request.
Once desired consumers are selected, choose Bulk authorize.
Choose whether to send the authorization requests by text or email. Agents can also adjust the language to Spanish.
The email subject line and body can be customized as needed. It is not possible to include requests for Consumer Consent using the bulk authorize function.
Select Send preview to send a test email or text to yourself. Preview emails will be sent to the email address associated with the HealthSherpa account, and preview texts will be sent to the phone number listed on the agent's Marketing page.
Select Send to generate the authorization requests. Agents will be returned to the PY2027 Authorizations tab where a success message will appear.
Ask the consumer to open the authorization request from their own device. Review the consumer experience when completing an agent authorization request to learn more.
Identity verification & high risk applications
Before agent authorization can be granted, CMS requires identity verification for applications flagged as high risk. Not all consumers are required to verify their identity.
Applications flagged as high risk by CMS include:
Applications for consumers who are new to the Marketplace or new to the state
Applications with an active enrollment and a net monthly premium of $30 or less. Net premium is the premium amount a consumer pays after advance premium tax credit (APTC) has been applied. In contrast, gross premium is the full premium amount before APTC is applied.
Applications for consumers working with a different or new agent
Identity verification could also be required if an application moves from low risk to high risk during the enrollment journey.
Plan year 2027 plan data is not available until OEP begins, so risk levels cannot yet be determined for plan year 2027 applications. As a result, all plan year 2027 authorizations collected before OEP begins are treated as high risk and require identity verification. Once OEP begins, only plan year 2027 applications CMS flags as high risk will require identity verification.
When identity verification is required, several identity verification pathways are available on HealthSherpa. Consumers are able to complete agent authorization and identity verification in one step.
Consumers who have verified their identity using HealthSherpa and created an account will not need to repeat verification on HealthSherpa each year unless their contact information changes.
Identity verification completed through HealthSherpa is valid only through HealthSherpa and does not transfer to other EDE platforms. If a consumer is moved to a different EDE platform, the consumer will need to complete that platform’s identity verification process as required.
Tracking & reporting
Agents can view and track the progress of authorization requests for consumers using the Clients and Leads pages.
Plan year 2026: Visible from the All clients tab of the Clients page, the client’s Details tab, the Leads page, and the lead’s Details tab.
Plan year 2027: Visible from the PY2027 Authorizations tab of the Clients page.
Agents and agencies can also export agent authorization data for clients.
Authorization status update notifications
HealthSherpa sends agents a weekly email with an overview of authorization statuses.
To disable Authorization status updates, go to the Settings page and uncheck the Enable box.
Frequently asked questions
What is an Enhanced Direct Enrollment (EDE) platform?
Enhanced Direct Enrollment (EDE) is a CMS-approved technology that creates a secure backend connection to the Marketplace. An EDE platform is an enrollment platform approved to use that connection, which allows agents to complete the full Marketplace enrollment process directly on the platform rather than on HealthCare.gov. HealthSherpa is an EDE platform.
Does authorization transfer to other EDE platforms?
No. Authorization is specific to the EDE platform where it is completed, so authorization completed through HealthSherpa is valid only through HealthSherpa and does not transfer to other EDE platforms.
If a consumer is moved to a different EDE platform, the consumer will need to complete that platform's authorization process.
Does an agent's authorization transfer between all of an agent's HealthSherpa accounts?
No. Agents may have multiple HealthSherpa accounts, but each account functions separately for authorization purposes. Authorization completed in one account is not valid in another.
Can agent authorization requests be sent in Spanish?
When initiating a plan year 2026 or plan year 2027 authorization request, agents can adjust the language to Spanish prior to sending. Language adjustment is not yet available when resending an authorization request.
Can emails and texts be customized?
The email subject line and body can be customized as needed. Texts cannot be customized.
Can agents customize the agent phone number that displays within the authorization request?
Yes. Agents can customize the agent phone number that displays from the Branding tab of the Marketing page.
What email and number do authorization requests come from?
Authorization requests sent by email will come from no_reply@healthsherpa.com. Authorization requests sent by text will come from (628) 222-2905.
How can agents increase response rates to authorization requests?
Consumers are more likely to respond to an authorization request that is personal, clear, and easy to verify. Agents can customize the email subject line and body before sending. When customizing the request, agents can:
Write in their own voice and remind the consumer who they are. Consumers are more likely to respond to a message from their agent than to one that reads like an automated notice. For example: "Hi, this is [agent name], and I helped you with your current health insurance coverage."
Explain the request in plain language. State what the consumer needs to do and how it helps them, and avoid industry terms the consumer may not recognize. For example: "Please complete this form so I can make sure your information is up to date and you receive the savings you qualify for."
Tell the consumer where the link goes. For example: "You'll be taken to HealthSherpa, the platform I use to manage your health insurance application, to complete this request."
Give the consumer a way to confirm the request is legitimate. This can reassure consumers who are unsure whether the message is genuine. For example: "Have questions about this request? Call my office at [phone number]."
What if a consumer's contact information no longer matches what is listed on their application?
If a consumer has lost access to both the phone number and the email address listed on the Marketplace application, agents can send the consumer a Change contact info link.
Can an agent create a new application if a consumer's contact information is outdated?
No. Agents should not create a new application to avoid outdated contact information. CMS may cancel applications they determine are duplicative.
Will agents be able to send authorization requests to consumers who share the same phone number or email address?
Enhanced Direct Enrollment (EDE) partners are required to have protections in place that limit the reuse of contact information and restrict the use of temporary phone numbers. As a result, a request may not be able to be sent to a phone number or email address that has already been used, and requests sent to temporary or disposable numbers may be blocked. Agents are also not able to substitute their own contact information for the consumer's.
Can another agent or an agency administrator send an authorization request on behalf of an agent?
No. Authorization requests can only be sent by the agent requesting authorization.
How does agent authorization work with shared book & full book access?
Agencies using these features can expect them to provide view-only access. Each agent who wants to service or interact with a consumer's application needs agent authorization to do so. Only one authorization can be active at a time, and a new authorization replaces any previous authorization.
Does agent authorization impact NPN override?
No. NPN override functionality will still be available within HealthSherpa.
Can agents complete enrollment submissions by contacting the Marketplace Call Center?
Beginning OEP for plan year 2027, the Marketplace Call Center will no longer support changes requested by an agent, except in complex cases. For more information from CMS, review question 11 here.
Will the Marketplace Call Center remove an agent's NPN if a consumer calls the Marketplace?
According to CMS, the Marketplace Call Center will only remove an existing NPN from an application in two situations:
The consumer asks for the NPN to be removed, or says they are no longer working with an agent or broker.
The consumer is updating their application but does not provide a verifiable Social Security Number (SSN) or immigration documentation. In this case, the consumer can choose to submit the application without the NPN, and the application will go through the standard Data Matching Issue (DMI) process.
In all other cases, the existing NPN stays on the application. Review CMS' Marketplace Call Center tip sheet to learn more.
Additional resources
For help using HealthSherpa or for other assistance, contact Agent Support. Agent Support is available by phone at (888) 684-1373, by email at Support@HealthSherpa.com, or by chat directly from your account.