+1 (800) 511-1511
hr@511enterprisespvtlimited.com EST. 2018
Compliance

Built to pass
the audit.

In insurance, "compliant" isn't a checkbox — it's the difference between a campaign and a class-action. Here's how we keep every dial, every transfer, and every recording on the right side of the line.

TCPA · DNC · HIPAA CMS marketing guidelines SOC 2 Type II in progress Last reviewed · MAY 2026
TCPA
All outbound dialing complies with the Telephone Consumer Protection Act, including written consent for autodialed calls.
DNC
Federal and state Do-Not-Call lists scrubbed every 24 hours. Internal DNC honored across every channel.
HIPAA
Encrypted PHI storage, BAA-backed vendors, role-based access controls, annual privacy training.
CMS
Medicare marketing guidelines enforced on every script. SOA capture, PTC verification, TPMO rules.
SECTION 01

TCPA compliance.

The Telephone Consumer Protection Act (47 U.S.C. § 227) governs how and when businesses may contact consumers by phone, text, and fax. 5 11 Enterprise treats TCPA as a foundational constraint, not an afterthought.

Consent capture

Every outbound campaign on autodialed or prerecorded technology requires prior express written consent from the consumer, in compliance with the FCC's one-to-one consent rule (effective January 2025). Consent records include:

  • Timestamp and IP address of consent
  • The specific business or seller authorized to contact
  • The disclosure language presented to the consumer
  • Source URL or origin of the lead

Calling hours

Outbound calls only occur between 8:00 AM and 9:00 PM in the called party's local time zone. Holidays and state-specific restrictions are observed automatically by our dialer platform.

One-to-one consent: we do not accept lead-sharing consent forms that name a "marketing partner" or "third party" without specifically identifying the seller. Every campaign requires an explicit consent record naming the calling party.
SECTION 02

Do-Not-Call scrubbing.

Every outbound list is scrubbed against:

  • The Federal Trade Commission's National Do Not Call Registry
  • State-level DNC registries (where applicable)
  • Our internal DNC list, populated by every consumer who has ever asked to stop being called
  • Wireless number databases (litigator and known-litigator lists)

Lists are re-scrubbed every 24 hours. A number added to any DNC list during an active campaign is automatically removed from the dial queue inside one hour.

SECTION 03

HIPAA safeguards.

For ACA, Medicare, and U65 campaigns where Protected Health Information (PHI) may be discussed, we maintain HIPAA-compliant infrastructure end to end:

  • Encrypted-at-rest storage for all PHI (AES-256)
  • Encrypted-in-transit transmission (TLS 1.3)
  • Business Associate Agreements (BAAs) with every downstream vendor
  • Role-based access controls — agents see only their own caller records
  • Audit logs retained for six years
  • Annual HIPAA training for all staff, refreshed quarterly for floor agents
SECTION 04

CMS marketing
guidelines.

For Medicare Advantage, Medicare Supplement, and Part D campaigns, we follow the CMS Medicare Communications and Marketing Guidelines (MCMG) in full. This includes:

  • Scope of Appointment (SOA) capture before discussing any plan
  • Permission to Contact (PTC) for inbound campaigns
  • Prohibition on unsolicited contact for Medicare beneficiaries
  • Third Party Marketing Organization (TPMO) disclaimer in every recorded call
  • Plan-specific scripting reviewed and approved by each carrier
  • Full call recordings retained for ten years per CMS retention requirements
We are a TPMO registered with carriers we represent. The TPMO disclaimer is read on every Medicare call: "We do not offer every plan available in your area…"
SECTION 05

State licensing.

Where a campaign requires an insurance license to quote, enroll, or recommend a product, the agent on the call is appropriately licensed in the consumer's state of residence. We maintain in-house licensed agents in all 48 contiguous states for Health, Life, and Property & Casualty lines.

Licensing renewals, continuing education, and state-specific bulletins are tracked and paid for by 5 11 Enterprise. No agent dials a state in which they are not currently licensed and appointed where required.

SECTION 06

Call recording.

Every call — inbound, outbound, and live transfer — is recorded in full. Consent to recording is captured per state law, including two-party-consent states. Recordings are:

  • Retained for a minimum of two years (ten years for Medicare)
  • Encrypted at rest with role-based access
  • Available to partners on request for any transfer they paid for
  • Scored against our QA rubric weekly
SECTION 07

Data security.

Our infrastructure is hosted in SOC 2 Type II-certified cloud environments. Production systems are isolated from corporate systems. Access requires SSO, MFA, and hardware key for all administrative roles. We are presently in process for SOC 2 Type II self-certification, target Q4 2026.

SECTION 08

Agent training.

Every new hire goes through a three-week onboarding before taking a live call. Compliance training is a non-negotiable component, refreshed quarterly:

  • TCPA fundamentals and consent capture
  • DNC handling and revocation rights
  • HIPAA and PHI handling
  • State-specific consumer protection laws
  • CMS guidelines (Medicare team only)
  • Vertical-specific script and rebuttal certification
SECTION 09

Report a concern.

If you've received a call you believe was non-compliant, or if you'd like to be added to our internal DNC list, please contact us:

  • Email: compliance@511enterprise.com
  • Phone: 1-800-555-0511
  • Mail: 5 11 Enterprise, Compliance Dept., 1 Market St #1000, San Francisco CA 94103

We respond to every compliance inquiry within two business days.