Marketplace Complaints Tied to Unauthorized Changes Reached 299,604. CMS's Workforce Is 1,104 Smaller.

The federal health-insurance Marketplace recorded 299,604 consumer complaints tied to confirmed unauthorized enrollments or plan switches in 2025, according to a July 2026 Government Accountability Office report. That was more than four times the 66,548 complaints recorded in 2023.

The number is alarming, but it needs a precise description. It is a count of complaints associated with confirmed unauthorized changes. It is not a count of criminal convictions, unique brokers or distinct consumers. One person can generate more than one complaint, and a complaint does not by itself establish who was responsible.

What the total does establish is the scale of an operating problem inside a system where private agents and brokers help make most HealthCare.gov plan selections. During the 2026 open-enrollment period, 76% of 10.8 million active HealthCare.gov selections involved agent or broker assistance, CMS reported. That private distribution network can help consumers compare complex products, but it also gives federal safeguards an unusually important job: confirming who is acting, whether the consumer consented and whether the consumer knows what changed.

GAO found that the Centers for Medicare & Medicaid Services had not consistently met that standard. Its July report said federal controls did not always verify consumer identity, restrict access to the agent already associated with an enrollment or notify consumers about every agent action. GAO recommended stronger authorization and notification controls. The Department of Health and Human Services agreed.

CMS is now requiring enhanced direct-enrollment partners to add identity proofing and authorization controls before the 2027 open-enrollment period. It has also defended the progress made through earlier system changes, enforcement and faster complaint resolution.

The workforce behind those controls is harder to evaluate. CMS's Center for Consumer Information and Insurance Oversight, known as CCIIO, runs federal Marketplace oversight. Yet the latest comparable public component-level actual FederalHiringData found is 400 full-time-equivalent positions in fiscal 2020. A 2021 figure was an estimate, and a 2022 figure was a budget request. Newer CMS budgets do not continue the same public CCIIO staffing table.

Broader agency data supplies context, but not the missing answer. CMS-wide headcount fell from 6,735 employees in January 2025 to 5,631 in June 2026, a decline of 1,104, or 16.4%. Health-insurance administration, information technology, program analysis and contracting all lost employees over a similar period. Public recruiting recovered in 2026 after collapsing in 2025.

Those figures do not prove that CCIIO lost 1,104 people. They do not establish that staffing caused unauthorized activity. They reveal a narrower accountability gap: the federal government is strengthening a large, broker-assisted enrollment system while the current size and composition of the component responsible for its oversight remain unavailable in a comparable public series.

Complaints rose sharply, but the definitions matter

GAO obtained federal Marketplace complaint data from CMS for calendar years 2023 through 2025. It reported 66,548 complaints tied to confirmed unauthorized enrollments or plan switches in 2023, 258,424 in 2024 and 299,604 in 2025.

That is a 350% increase from the first year to the last. The steepest jump came between 2023 and 2024, when the total nearly quadrupled. The 2025 total was another 16% above 2024.

These annual totals should not be combined casually with every other number CMS has published about unauthorized coverage. Different releases count complaints, applications, plan changes, cancellations, households or enrollees. Their time windows and methods differ. GAO separately reported that at least 160,000 plan-year 2024 federal Marketplace applications had likely unauthorized changes. CMS estimated in January 2026 that about 200,000 consumers had their desired plan selection changed without consent during 2025. Those measures illuminate the same broad risk but are not interchangeable.

CMS has also published evidence of improvement under narrower comparisons. Its January 2026 program-integrity fact sheet reported a 31% decline in complaints from January through October 2024 to the same months of 2025, using a methodology CMS warned was not directly comparable with an earlier fact sheet. HHS's response to GAO cited a 21% decline for January through April 2026 compared with the same 2025 period.

That counterevidence matters. The annual GAO series shows that the 2025 total remained high. The narrower CMS comparisons suggest conditions may have improved after controls changed. Both can be true when the periods, definitions and timing differ. FederalHiringData does not splice them into a false continuous trend.

CMS also said average resolution times had improved to approximately five days for unauthorized-enrollment cases and seven days for unauthorized plan switches. Faster resolution can reduce the time a consumer remains in the wrong coverage. It does not substitute for preventing the change in the first place.

A private enrollment network operating at public scale

Agents and brokers are not a peripheral pathway on HealthCare.gov. Their role expanded with Marketplace enrollment. CMS's published open-enrollment reports show active HealthCare.gov plan selections rising from 6.5 million in 2021 to 12.7 million in 2024, before settling at 10.6 million in 2025 and 10.8 million in 2026. The assisted share rose from 55% in 2021 to 76% in 2026.

The assisted percentage describes plan selections involving an agent or broker. It does not mean 76% were improper. Most assistance is not identified as unauthorized, and the federal Marketplace requires agents and brokers to be licensed, registered and trained. The scale instead explains why authorization controls have large consequences. A weak safeguard affects a pathway used by millions of people.

The risk is partly structural. A consumer may legitimately ask a new agent for help changing coverage. The system must allow that service while stopping someone who obtained personal information through a misleading advertisement, purchased lead or unrelated contact. A safeguard that is too weak can permit an unauthorized change. One that is too rigid can block legitimate help at a deadline.

GAO compared the federal system with three state-based Marketplaces and identified material differences.

The table is not a verdict that one state system eliminates unauthorized activity. GAO selected three Marketplaces for comparison; they are not a statistical sample of every state platform. The useful lesson is narrower: stronger identity and consent checks were operational in real Marketplace systems, rather than merely theoretical options.

Federal controls changed, and another change is coming

CMS did not wait for the July 2026 GAO report to act. In July 2024 it began blocking an unassociated agent or broker from changing a consumer's federal Marketplace enrollment unless the agent completed a three-way call with the consumer and Marketplace Call Center, directed the consumer to make the change, or used an approved consumer pathway.

Between June 21 and July 10, 2024, CMS said it suspended 200 agent or broker Marketplace agreements based on reasonable suspicion of fraud or abusive conduct involving unauthorized enrollment or switching. Suspension stopped those agents from participating in Marketplace enrollment and receiving associated commissions. A suspension is an administrative protection; it should not be described as a criminal conviction.

GAO nevertheless found that the 2024 procedures were not used for every action and took limited steps to confirm consumer identity. It recommended that CMS design and implement stronger controls to ensure consumers consent to and are informed about agent and broker actions, including a one-time-passcode approach or other effective safeguards.

On Aug. 3, 2026, CMS issued implementation guidance for a new control in the enhanced direct-enrollment, or EDE, pathway. Before the 2027 open-enrollment period, EDE partners must systematically enforce consumer identity proofing and agent or broker authorization. The requirement matters because EDE partners allow consumers to enroll through approved private websites rather than HealthCare.gov itself.

The scope matters too. The guidance applies to the EDE pathway. It should not be read as proof that one identical one-time-passcode control now governs every federal Marketplace interaction. CMS still has to coordinate rules, technical interfaces, partner testing, notices, exception handling and complaint response across several enrollment paths.

HHS concurred with GAO's two recommendations. That is a commitment to address the findings, not evidence that every recommendation is closed. As implementation proceeds, useful public measures would include the share of relevant transactions subject to stronger authorization, failed or abandoned legitimate transactions, complaint rates by pathway, resolution times and confirmed unauthorized changes after controls take effect.

The public CCIIO staffing series stops before the current debate

CCIIO oversees the private health-insurance market and federal Marketplace functions inside CMS. Historic CMS budget justifications reported component FTE, which measures labor over a year rather than employees on board at one moment.

The published series reviewed by FederalHiringData shows 356 actual CCIIO FTE in fiscal 2017, 352 in 2018, 389 in 2019 and 400 in 2020. The fiscal 2021 figure of 416 was an estimate. The fiscal 2022 figure of 486 was a request, not an enacted or actual workforce count.

This series cannot support the claim that CCIIO has 486 people now. It cannot show whether the component gained or lost staff during 2025. It cannot identify how many employees investigate broker conduct, build Marketplace technology, monitor enrollment patterns, answer complaints or coordinate with state regulators.

Those missing denominators limit oversight. A complaint backlog can reflect too little staff, ineffective processes, poor technology, unusually complex cases or a sudden surge that no practical staffing model would absorb immediately. Without current function-level staffing and workload measures, the public cannot separate those explanations.

The gap is especially notable because CCIIO's responsibilities extend beyond unauthorized broker activity. It oversees Marketplace operations, private insurance standards, rate-review and program-integrity work. Not every CCIIO employee works on the federal exchange, and not every federal Marketplace resource appears as a federal employee.

CMS-wide workforce data shows contraction, not a CCIIO count

FederalHiringData analyzed Office of Personnel Management workforce records for CMS agency subelement code HE70. The long-run series rose from 4,561 employees in September 2000 to 6,557 in September 2024. It then fell to 5,628 in September 2025 and stood at 5,631 in June 2026.

The sharper monthly comparison is January 2025 to June 2026: 6,735 to 5,631, a decline of 1,104 employees, or 16.4%. Personnel-action records show 1,451 separations and 263 accessions during calendar 2025, a net flow of minus 1,188. In the first half of 2026, CMS recorded 279 accessions and 163 separations, a positive net flow of 116.

The partial rebound is important. It shows that the agency was hiring again. It does not erase the preceding reduction, and six months of actions cannot be compared as a full-year total without qualification.

Most importantly, HE70 is the whole Centers for Medicare & Medicaid Services. It includes work involving Medicare, Medicaid, CHIP, program integrity, data, policy, operations and administration in addition to CCIIO. The series excludes contractor personnel. FederalHiringData found no defensible crosswalk that assigns the agency-wide loss to Marketplace oversight, so it does not attempt one.

Health-insurance administration and technical groups also declined

Occupation data provides another CMS-wide view. Between September 2024 and June 2026, the Health Insurance Administration series fell from 2,823 employees to 2,428, a decline of 395. Information Technology Management fell by 96, Management and Program Analysis by 89, Miscellaneous Administration and Program by 80, and Contracting by 49.

These groups contain skills relevant to Marketplace operations. Health-insurance specialists can interpret plan and program requirements. IT staff can build authentication, enrollment and monitoring systems. Program analysts can evaluate performance. Contracting staff can oversee vendors.

Relevance is not allocation. OPM occupation records do not say which CMS program each employee supported. A health-insurance specialist may work on Medicare rather than the Marketplace. An IT specialist may support infrastructure used across the agency. The chart therefore shows where the broad agency contraction occurred, not the staffing of GAO's recommendations.

The distinction also prevents a tempting but unsupported conclusion: losing 395 health-insurance administration employees did not necessarily cause 299,604 complaints. The periods overlap only partly, and complaint growth began before the measured occupation endpoint. Controls, incentives, enrollment volume, marketing practices and system design all influence unauthorized activity.

What the occupation data can support is a management question. As CMS implements stronger identity and authorization controls, does it have enough federal capacity in policy, technology, analysis and contract oversight to specify the work, test it, monitor it and respond when it fails? Public data does not currently answer that question at the program level.

Public recruiting recovered after a one-year collapse

FederalHiringData also counted distinct CMS USAJOBS announcements opened from Jan. 1 through Aug. 26 in each year from 2018 through 2026. That same-window method avoids comparing eight months of 2026 with a full prior year.

CMS posted 419 announcements in the 2024 window, 51 in 2025 and 338 in 2026. The 2026 rebound was substantial, although the count remained below every year from 2018 through 2024.

Within the archive, the 2026 window included 111 announcements associated with Health Insurance Administration, 56 with Information Technology Management and 38 with selected administrative and program-analysis series. In 2025, those counts were 17, 14 and two. One announcement can list more than one occupation, so categories should not be added to produce a total.

An announcement is not a vacancy, application, selection or hire. Some announcements cover multiple positions or locations. Others produce no hire. The count measures public recruiting activity, not workforce replacement.

Only three archived announcements explicitly named CCIIO as the organization, all opened in March 2026: a Health Insurance Specialist, a Supervisory Health Insurance Specialist division director and another Supervisory Health Insurance Specialist. That tiny explicit set is useful as examples but not as a complete CCIIO recruiting series. Organization names are not consistently exposed at the same level in every announcement.

Related research

Put this finding in context

All articles

Data investigations/August 25, 2026

CFPB Lost 670 Covered Employees as Complaint Intake Reached 6.6 Million

Covered CFPB employment fell 38.2% while complaint intake reached 6.6 million and leadership narrowed supervision and enforcement priorities.

Data investigations/August 24, 2026

EPA Has $10.2 Billion in IRA Awards to Oversee. Its Workforce Is 26% Smaller.

EPA entered years of post-award monitoring with $10.2 billion in unaffected IRA obligations and 4,326 fewer covered employees than in September 2024.

The Marketplace runs on technology and contracts as well as payroll

A federal headcount analysis captures only part of operating capacity. CMS's fiscal 2027 budget justification lists $2.18 billion in enacted fiscal 2026 Marketplace resources across technology, consumer information, eligibility and enrollment, administration, plan oversight, payments, quality and other activities.

Information technology accounted for about $729 million. Consumer information and outreach accounted for $663 million, including call-center operations within that line. Eligibility and enrollment accounted for $411 million. Federal administration was $149 million, while health-plan review and oversight was $89 million.

These are dollars, not people. They can pay for systems, contracts, call centers and other operations. Dividing the total by an assumed salary would manufacture a workforce count. Conversely, a decline in federal employees does not necessarily mean total operating capacity fell by the same percentage if contractors or technology absorbed work.

Contractor dependence creates its own oversight needs. Federal employees must define requirements, protect data, test changes, monitor performance, enforce agreements and decide how exceptions are handled. A control can be technically present yet operationally weak if some pathways bypass it, notices are incomplete or complaint data is not used to identify patterns.

What stronger oversight would look like in public data

The debate should not collapse into a single question about whether CMS has enough employees. It is a control-system problem with workforce consequences.

First, authorization should be measurable. CMS could report what share of agent-initiated transactions received identity proofing, an explicit consumer authorization step and a timely notice. It could distinguish routine renewal activity from a new agent gaining access or changing a plan.

Second, complaint data should use stable definitions. Separate counts for complaints, confirmed cases, unique consumers, plan switches, unauthorized enrollments and implicated agents would prevent one total from being mistaken for another. Publishing rates per assisted enrollment would add a denominator that raw complaint counts lack.

Third, the agency could publish operational results for the new EDE controls: successful authorizations, failed attempts, exception pathways, consumer abandonment, reversals and time to resolution. Stronger security that locks legitimate consumers out is not a complete success; friction and protection have to be measured together.

Fourth, current CCIIO staffing should reappear in budget materials, at least at a level that separates actual, enacted and requested FTE. Function-level workforce data for Marketplace technology, program integrity, consumer assistance and contract oversight would be more useful, provided it can be published without exposing security-sensitive operations.

Finally, workforce measures should sit beside contractor and technology measures. The federal Marketplace is not operated by federal payroll alone. The public needs enough information to see who is accountable for the work even when private partners perform it.

Methodology and limitations

FederalHiringData reviewed GAO-26-108041, CMS open-enrollment reports, CMS budget justifications, current CMS program-integrity and enrollment-control materials, OPM federal workforce data, and FederalHiringData's historical USAJOBS archive. The reporting cutoff was Aug. 26, 2026.

The complaint figures are GAO's totals tied to confirmed unauthorized enrollments or plan switches. They are not unique people, unique brokers, findings of criminal liability or a measure of all Marketplace transactions. CMS's other complaint and cancellation measures use different definitions and periods; this analysis does not combine them.

HealthCare.gov plan-selection totals and assisted shares are rounded published values. They cover the federal platform, not every state-based Marketplace.

CCIIO figures are FTE from historic CMS budget tables. Fiscal 2017 through fiscal 2020 are actuals; fiscal 2021 is an estimate and fiscal 2022 is a request. They are not employee headcounts, and they are not current.

CMS-wide employee counts and occupation totals come from OPM records for agency subelement HE70. September snapshots are used for the annual series through 2025; 2026 uses June, the latest available month in the research warehouse. The January 2025-to-June 2026 comparison uses monthly endpoints. The data excludes contractors and cannot allocate employees to CCIIO.

USAJOBS counts are distinct public announcements opened Jan. 1 through Aug. 26 in each year. They are not vacancies, applications or hires. The current archive may not expose CCIIO consistently as a component name.

Budget dollars include non-payroll operations and cannot be converted into a contractor or federal headcount. No causal test in this analysis links workforce change to unauthorized Marketplace activity.

The evidence supports a careful conclusion. CMS has documented faster response, enforcement and new authentication requirements. GAO has documented control weaknesses and a high complaint total. Broader CMS staffing fell sharply before beginning a partial 2026 recovery. What remains missing is the current program-level workforce denominator needed to judge whether the people responsible for Marketplace oversight match the work now being demanded of them.