Does a telehealth company need LegitScript certification?

Current as of October 21, 2026.

The short version

• To run Google ads, a prescribing telehealth company needs LegitScript certification. An online pharmacy needs it or one of two alternatives. LegitScript says Visa recognizes it for card-not-present healthcare merchants.
• LegitScript lists a $975 application fee and a $2,150 annual fee, each per website. It does not commit to a timeline.
• Certification reviews how the business actually runs: licensure, pharmacy partners, service areas, privacy and advertising.

Paul’s take

I’ve led two companies through LegitScript certification. The application is not the hard part. The hard part is that it audits how you actually operate. Treat it as a growth tool, because it is what lets you market.

— Paul Albarrán

What is LegitScript certification?

For prescription-drug ads, Meta requires online pharmacies and telehealth providers to be actively certified with LegitScript. In the United States, Google allows telemedicine providers to advertise if LegitScript accredits them.

LegitScript is a private company that reviews healthcare businesses that sell or advertise online. Its Healthcare Merchant Certification program covers pharmacies, telemedicine providers, digital health platforms and some other healthcare merchants. A business applies, and LegitScript reviews it against published standards. An approved business keeps its status through ongoing monitoring and an annual renewal.

Certification is a private credential. The requirement to hold it usually comes from the companies a health brand depends on. Ad platforms, payment processors and some business partners make it a condition of doing business.

Why do ad platforms and payment processors ask for it?

Major ad platforms restrict ads for prescription drugs, pharmacies and telehealth services. LegitScript says its certification is trusted by Google, Meta, Microsoft, TikTok and others. The platforms’ own policies set the details, and they differ by platform and by country.

In the United States, Google allows online pharmacies accredited by LegitScript or by the National Association of Boards of Pharmacy (NABP). It allows telemedicine providers accredited by LegitScript. Advertisers must also be certified with Google. Meta requires online pharmacies and telehealth providers to hold active LegitScript certification. Once certified, online pharmacies and telehealth providers must also request authorization from Meta. Meta limits those prescription drug ads to the United States, Canada and New Zealand. Each platform also keeps its own ad policies, so a business that holds certification can still have ads disapproved.

Payment processing works in a similar way. Visa’s Core Rules, in section 1.9.5.1 (rule ID 0026383), require an acquirer to register high-integrity risk merchants with Visa before submitting their transactions. That step does not apply to merchants assigned MCC 5122 or 5912 accredited by NABP or another regulatory body Visa recognizes. LegitScript says Visa and Mastercard recognize its certification to streamline high-risk registration for pharmacies and telemedicine providers taking card-not-present payments. LegitScript also says many banks, e-commerce websites, and advertising and social media platforms require certification from a recognized organization.

For a growing company, the practical point is timing. A launch that depends on paid social ads or card payments may also depend on certification. The application belongs on the launch schedule from the start.

Who usually applies for certification?

LegitScript’s healthcare program lists pharmacies, telemedicine providers, digital health platforms, medical spas and pharmaceutical manufacturers among eligible businesses. LegitScript’s certification guide lists internet, mail-order and brick-and-mortar pharmacies. A telehealth company that offers only non-prescription wellness services, with no diagnosis or treatment, may not need certification. LegitScript confirms eligibility for less common business models directly.

LegitScript also runs separate programs for addiction treatment providers and for CBD products. Each has its own scope and limits. The CBD program, for example, excludes ingestible CBD. A wellness company with several product lines may need to check more than one.

What does LegitScript’s review look at?

LegitScript publishes its certification standards. In summary, the current standards ask about:

• licensure and business registration in each place the company operates;
• legal compliance, including authority to prescribe and dispense;
• prior criminal, regulatory and civil matters from the past ten years, which must be disclosed;
• affiliates and partners, including the pharmacies that fill prescriptions;
• a clear statement of where patient services are available;
• privacy, including HIPAA where it applies;
• valid prescriptions from authorized prescribers, with care provided before a prescription is issued;
• transparent and accurate claims about products, services and pricing;
• advertising that follows the law and each platform’s policies.

The standards change from time to time. Read the current version before preparing an application.

Do pharmacy partners need certification too?

Telehealth companies often rely on outside pharmacies to fill prescriptions. LegitScript generally expects those fulfillment partners to hold its certification or accreditation from another recognized body. It may grant limited exceptions at its discretion.

This affects vendor selection early. Before signing with a pharmacy partner, confirm its certification or accreditation status. Then build that status into the contract. The contract can require the partner to keep it, report any change and cooperate with reviews.

The review also reaches the applicant’s own affiliates and domains. An applicant must disclose every affiliate and every website under its control. A related site with weak compliance can slow the main application.

How do companies prepare an application?

Most of the work is gathering documents that a well-run company already keeps. A practical sequence looks like this:

1. Map the licenses. List every state where the company sees patients or ships medication. Match each state to the pharmacy license, prescriber license or registration it requires.
2. Collect the clinical policies. Gather how prescribers are credentialed, how they evaluate patients and when they decline to prescribe.
3. List the partners. Name each pharmacy, medical group and platform in the patient’s path. Note each one’s licenses and certification status.
4. Read the website as a reviewer would. Check product claims, pricing, where services are offered and how the site describes prescribing.
5. Gather the history. Collect the prior criminal, regulatory and civil matters the standards ask applicants to disclose.

Expect follow-up questions. A reviewer may ask why a claim appears on the site. A reviewer may also ask how a prescriber licensed in one state treats a patient in another. Answers prepared in advance make those questions easier to handle.

What does LegitScript certification cost, and how long does it take?

LegitScript lists its Healthcare Certification fees on its website. As of October 20, 2026, LegitScript lists a nonrefundable $975 application fee and a $2,150 annual certification fee, each per website. The annual fee is due only once the application is approved. Each domain to be certified needs its own application fee and annual fee. For probationary certification, which adds heightened monitoring, LegitScript lists a $3,995 annual fee per website. LegitScript says it cannot estimate how long certification will take. It says review times vary with the application’s complexity and completeness, the applicant’s responsiveness and its own application volume. Expedited Processing is available for an added $2,500 per application, as LegitScript lists it. LegitScript says Expedited Processing does not shorten the compliance review itself. LegitScript’s terms let it change its pricing.

What happens after certification?

Certification is ongoing. LegitScript monitors businesses in the program, and the status renews each year with an annual fee. Changes in the business can raise new questions under the standards. A new product line, state, pharmacy partner or website are common examples.

Two kinds of change carry a set deadline. LegitScript’s terms require notice within 30 days of becoming aware of a change in licensure, business or regulatory status. The same 30-day notice applies when the business becomes the subject of an adverse legal or regulatory action.

Ad platform and processor policies also change. A business that holds certification should still watch for policy updates that affect its ads and its payment accounts.

What does certification not change?

Certification is one review by one private company. State pharmacy and medical licensing, FDA rules, FTC advertising rules and privacy laws all still apply. A company can hold certification and still face questions from a regulator. The standards make a useful checklist, and the underlying law governs either way.

Related: Healthcare, Telehealth & Regulated Wellness · Contact

The information on this site is general information, not legal advice.