President Joe Biden counts among his accomplishments the record-high number of people, more than 21 million, who enrolled in Obamacare plans this year. Behind the scenes, however, federal regulators are contending with a problem that affects people’s coverage: rogue brokers who have signed people up for Affordable Care Act plans, or switched them into new ones, without their permission.

Fighting the problem presents tension for the administration: how to thwart the bad actors without affecting ACA sign-ups.

Complaints about these unauthorized changes — which can cause affected policyholders to lose access to medical care, pay higher deductibles or even incur surprise tax bills — rose sharply in recent months, according to brokers who contacted KFF Health News and federal workers who asked not to be identified.

Ronnell Nolan, president and CEO of the trade association Health Agents for America, said her group has suggested to the Centers for Medicare & Medicaid Services that it add two-factor authentication to healthcare.gov or send text alerts to consumers if an agent tries to access their accounts. But the agency told her it doesn’t always have up-to-date contact information.

“We’ve given them a whole host of ideas,” she said. “They say, ‘Be careful what you wish for.’ But we don’t mind going an extra step if you can stop this fraud and abuse, because clients are being hurt.”

Some consumers are pursued when they respond to misleading social media marketing ads promising government subsidies, but most have no idea how they fell victim to plan-switching. Problems seem concentrated in the 32 states using the federal exchange.

Federal regulators have declined to say how many complaints about unauthorized sign-ups or plan switches they’ve received, or how many insurance agents they’ve sanctioned as a result. But the problem is big enough that CMS says it’s working on technological and regulatory solutions. Affected consumers and agents have filed a civil lawsuit in federal district court in Florida against private-sector firms allegedly involved in unauthorized switching schemes.

Biden has pushed hard to make permanent the enhanced subsidies first put in place during the covid pandemic that, along with other steps including increased federal funding for outreach, helped fuel the strong enrollment growth. Biden contrasts his support for the ACA with the stance of former President Donald Trump, who supported attempts to repeal most of the law and presided over funding cuts and declining enrollment.

Most proposed solutions to the rogue-agent problem involve making it more difficult for agents to access policyholder information or requiring wider use of identity questions tied to enrollees’ credit history. The latter could be stumbling blocks for low-income people or those with limited financial records, said Sabrina Corlette, co-director of the Center on Health Insurance Reforms at Georgetown University.

“That is the knife edge the administration has to walk,” said Corlette, “protecting consumers from fraudulent behavior while at the same time making sure there aren’t too many barriers.”

Jeff Wu, acting director of the Center for Consumer Information & Insurance Oversight, said in a statement that the agency is evaluating options on such factors as how effective they would be, their impact on consumers’ ability to enroll, and how fast they could be implemented.

The agency is also working closely, he wrote, with insurance companies, state insurance departments, and law enforcement “so that agents violating CMS rules or committing fraud face consequences.” And it is reaching out to states that run their own ACA markets for ideas.

That’s because Washington, D.C., and the 18 states that run their own ACA marketplaces have reported far fewer complaints about unauthorized enrollment and plan-switching. Most include layers of security in addition to those the federal marketplace has in place — some use two-factor authentication — before agents can access policyholder information.

California, for example, allows consumers to designate an agent and to “log in and add or remove an agent at will,” said Robert Kingston, interim director of outreach and sales for Covered California, the state’s ACA marketplace. The state can also send consumers a one-time passcode to share with an agent of their choice. Consumers in Colorado and Pennsylvania can similarly designate specific agents to access their accounts.

By contrast, agents can more easily access policyholder information when using private-sector websites that link them to the federal ACA market — all they need is a person’s name, date of birth, and state of residence — to enroll them or switch their coverage.

CMS has approved dozens of such “enhanced direct enrollment” websites run by private companies, which are designed to make it easier and faster for agents certified to offer insurance through healthcare.gov.

Rules went into effect last June requiring agents to get written or recorded consent from clients before enrolling them or changing their coverage, but brokers say they’re rarely asked to produce the documentation. If CMS makes changes to healthcare.gov — such as adding passcodes, as California has — it would need to require all alternative-enrollment partners to do the same.

The largest is San Francisco-based HealthSherpa, which assisted 52% of active enrollments nationally for this year, said CEO George Kalogeropoulos.

The company has a 10-person fraud investigation team, he said, which has seen “a significant spike in concerns about unauthorized switching.” They report problems to state insurance departments, insurance carriers, and federal regulators “and refer consumers to advocates on our team to make sure their plans are corrected.”

Solutions must be “targeted,” he said. “The issue with some of the solutions proposed is it negatively impacts the ability of all consumers to get enrolled.”

Most people who sign up for ACA plans are aided by agents or platforms like HealthSherpa, rather than doing it themselves or seeking help from nonprofit organizations. Brokers don’t charge consumers; instead, they receive commissions from insurers participating in state and federal marketplaces for each person they enroll in a plan.

While California officials say their additional layers of authentication have not noticeably affected enrollment numbers, the state’s recent enrollment growth has been slower than in states served by healthcare.gov.

Still, Covered California’s Kingston pointed to a decreased number of uninsured people in the state. In 2014, when much of the ACA was implemented, 12.5% of Californians were uninsured, falling to 6.5% in 2022, according to data compiled by KFF. That year, the share of people uninsured nationwide was 8%.

Corlette said insurers have a role to play, as do states and CMS.

“Are there algorithms that can say, ‘This is a broker with outlier behavior’?” Insurance companies could then withhold commissions “until they can figure it out,” she said.

Kelley Schultz, vice president of commercial policy at AHIP, the trade association for large insurance companies, said sharing more information from the government marketplace about which policies are being switched could help insurers spot patterns.

CMS could also set limits on plan switches, as there is generally no legitimate need for multiple changes in a given month, Schultz said.

KFF Health News is a national newsroom that produces in-depth journalism about health issues and is one of the core operating programs at KFF—an independent source of health policy research, polling, and journalism. Learn more about KFF.