FFM Session Management Best Practices
Best-practice guidance for managing your HealthSherpa and FFM session following the updated CMS inactivity window.
Agent EMPowerment
Best Practice Advisory
FFM Session Management Best Practices
Effective August 4, 2026, CMS reduced the FFM integration inactivity window from 12 hours to 30 minutes for Enhanced Direct Enrollment platforms. Below are optional workflow suggestions to help agents manage this change.

Hi {{contact.first_name}},

HealthSherpa has advised that agents may remain integrated with the FFM for up to 12 hours when there is active platform usage. If the FFM session becomes inactive for more than 30 minutes, re-authentication may be required before continuing certain Marketplace activities.

Agent EMPowerment is sharing the following information as an optional best-practice resource. We do not require or enforce the use of any particular browser extension, workflow, or session-management method. Agents should follow their own agency procedures and all applicable CMS, Marketplace, EDE platform, carrier, and data-security requirements.

Optional Resources
Session Management Resources
We created a tutorial showing one optional browser workflow using the Easy Auto Refresh Chrome extension. This third-party tool may be useful for general browser page management, but it should not be considered a substitute for required activity, authentication, or re-authentication.
Optional Workflow Suggestion

If you choose to use a browser refresh tool as part of your normal workflow, you may configure it according to your own operational needs. For example, the tutorial demonstrates a 180-second refresh interval. This is an optional workflow suggestion only and is not an Agent EMPowerment requirement.

Security & Compliance

Important: A browser refresh tool does not replace actual platform activity, required FFM authentication, CMS security controls, or re-authentication when requested. Agents should never attempt to bypass security or authentication requirements.

Consumer PII or other sensitive information should not be left visible on an unattended, unlocked, or unsecured device. Agents remain responsible for following applicable CMS, Marketplace, carrier, agency, privacy, and data-security requirements.

We are providing this information to help agents better understand the operational change and evaluate workflow options that may work for their individual business.

Best regards,
Agent EMPowerment Support Team

© 2026 Agent EMPowerment. All rights reserved.
Questions? Reply to this email and our team will get back to you.
Agent EMPowerment Terms & Conditions

Disclaimer: This communication is provided for general informational and best-practice purposes only. Agent EMPowerment is not an insurance carrier, insurance agency, Marketplace, CMS, HealthSherpa, or Enhanced Direct Enrollment platform, and does not provide legal, regulatory, or insurance advice. Agent EMPowerment does not require or enforce the use of any third-party browser extension or session-management method. Agents and agencies are independently responsible for their licensing, Marketplace registration, carrier requirements, consumer authorization, privacy and data security practices, and compliance with all applicable laws, regulations, CMS requirements, and platform policies. Third-party tools and links are provided solely for convenience and are not controlled or warranted by Agent EMPowerment. Where any guidance conflicts with CMS, Marketplace, carrier, or platform requirements, the applicable official requirements control. Use of Agent EMPowerment services is subject to our Terms & Conditions.