You applied for a merchant account, or for a Google Ads account, and somebody told you to come back when you are LegitScript certified. So you went looking for what that takes, and you found a standards page, a pricing page, and not much else.
That is where most clinic owners I talk to get stuck. They run a real practice with real providers. They are not doing anything wrong. Nobody has handed them the whole list in one place.
So here is the whole list. It is the same one I walk clinics through before they apply, in the order I would do it.
Who needs LegitScript certification?
Any business that prescribes, sells, or helps sell prescription medication online. LegitScript’s Healthcare Certification covers telemedicine providers whose visits can end in a prescription, online and compounding pharmacies, and the platforms that connect patients with either one.
In plain terms: if you run a telehealth weight-loss program, a hormone or peptide clinic, or a med spa that takes online payments for prescription treatments, this is you. If every patient is seen in person and pays in person, you are generally outside of it. So are businesses that only sell supplements.
It matters because it opens two doors at once. Visa and Mastercard recognize it, which is what lets a processor say yes to you. Google, Meta, Microsoft, and TikTok look for it before you can apply to run healthcare ads. One certification, both doors.
How do you get LegitScript certified?
LegitScript describes five steps: check that you are eligible, gather your documentation, submit the application, go through their review, and receive your certification. You create the account and you contract with LegitScript directly. Nobody can do that part for you, including me.
The review is the step everyone worries about. The step that decides how long this takes is the second one. Whatever is missing when you hit submit comes back later as a deficiency notice, and every notice adds a round of back and forth.
Here is what to have ready before you pay the application fee.
The LegitScript readiness checklist
Your clinical model
If any of these four is a no, fix it before you apply. No amount of paperwork gets around them.
- A licensed provider (MD, DO, NP, or PA) evaluates every patient and makes the prescribing decision. A questionnaire by itself does not count.
- Your prescribers hold an active license in every state where your patients live, not only the state your clinic is in.
- Everything you prescribe is legal to prescribe and compound today. No research-use-only products, nothing labeled “not for human consumption,” nothing on the FDA’s do-not-compound list.
- Your pharmacy is a licensed 503A or 503B, and you can give its name and license number. “We use accredited pharmacies” is not an answer.
Your paperwork
Put all of this in one folder before you start the application.
- Business formation documents, your state registration, proof of your physical address, and a government-issued ID for every owner.
- License numbers for every prescriber, listed state by state.
- The name and license number of every pharmacy you work with.
- A signed Business Associate Agreement with every vendor that touches patient data. That means your records system, your telehealth platform, your email provider, your scheduling tool, and your payment processor.
- HIPAA training records, written privacy and security policies, and a written plan for what you do if there is a breach.
- Written policies for refunds, cancellations, patient complaints, adverse event reporting, and telehealth informed consent.
- The disciplinary history for the business, every owner, and every practitioner, going back ten years. Disclose it up front. A history you disclose gets reviewed. One they find by themselves usually ends in a denial.
Your website and ads
This is where most deficiency notices come from, and it is the easiest section to fix.
- “Prescription required” sits next to every medication and every price.
- Your privacy policy is a real HIPAA Notice of Privacy Practices, not a generic template.
- Your terms of service work, and a patient can find a way to contact you.
- Pricing and cancellation terms are visible before checkout.
- Nothing reads as though medication can be bought without a consultation. “Get semaglutide online” will be flagged. So will guaranteed results and before-and-after photos with no context.
- Your ads and your social media say the same thing your website says.
“I am one provider with one website. Is this really meant for me?”
Yes, and in some ways you have the easier job.
The application does not change with the size of the clinic. A solo nurse practitioner running a telehealth practice fills out the same one as a national platform. What changes is how much you have to gather. One provider’s licenses. One pharmacy. One website to clean up.
The cost works out like this. Going direct, the first year is $3,125, which is about $260 a month. Through EMS it is $2,000, about $167 a month.
Now compare that to the other path. A clinic that gets approved without certification can process for a few months, until the processor’s risk team reads the website. Then the account is closed and the reserve is held, often for six months or longer. For a small clinic, that is payroll.
How much does LegitScript certification cost, and how long does it take?
Going to LegitScript directly, there is a $975 application fee per website, which is not refundable, plus a $2,150 annual certification fee that is due once you are approved. They also offer an expedited review for an added $2,500.
Through EMS, it is $2,000 per year through our processor’s enterprise program with LegitScript, and your application goes into a priority queue. There are two conditions, and I would rather say them out loud: you process with us for at least one year, and the agreement carries a personal guaranty. If you leave early, the fee reverts to the non-discounted $6,000.
On timing, LegitScript says most applicants are certified in under four weeks once a complete application is in, and about half are done in two. The word doing the work in that sentence is complete. A prepared clinic is looking at two to four weeks. A clinic that finds out what is missing one notice at a time is looking at three to four months.
That is also why I would not pay to expedite an application that is not ready. A faster review of an incomplete file gets you a faster deficiency notice.
Frequently asked questions
Does my pharmacy have to be LegitScript certified too?
In most cases, yes. LegitScript’s standards say your partners have to meet the same standards you do, and partner pharmacies generally need their own certification. Ask your pharmacy before you apply. If the answer is no, that is worth knowing before you pay a nonrefundable fee.
Should I get certified before I apply for a merchant account?
Start both conversations at the same time. I would rather look at your website and your paperwork before you submit anything to LegitScript, because that is when fixing things is free. Processing starts once the certification is in hand.
I have more than one website. Do I need to certify each one?
Yes. Certification is per website, and so are the fees. Subdomains of a certified site are covered with it. A second domain is a second certification.
What happens if I just keep processing without it?
It usually works until somebody at the processor looks closely. Then the account is closed, the reserve is held, and some owners are added to the MATCH list, which follows you to every application after that. I wrote about what the MATCH list is and how long it lasts if you want the full picture.
Start with the one-page version
I put this checklist on a single page you can print and hand to whoever runs your compliance. Download the EMS LegitScript Readiness Check (PDF).
If you can already check every box, the next step is the EMS application. There is no application fee, and we will tell you what LegitScript is going to ask for before they ask.
If peptides are part of what you prescribe, read why peptide businesses keep getting declined first. It explains which peptide businesses can get certified and which cannot.
About the author: Julie Franke is a Certified Payments Professional (CPP) and has led Electronic Merchant Services since 2015. She has worked in payments since 2009 and specializes in helping high-risk and high-ticket businesses get approved, stay approved, and keep their money moving. EMS has served business owners since 2001.