LegitScript Certification for Telehealth: Cost, Timeline and What Gets Rejected

What LegitScript certification is

LegitScript is a Portland, Oregon company, founded in 2007, that verifies healthcare businesses selling or facilitating prescription drugs online (LegitScript). Its Healthcare Merchant Certification checks licensing, legal compliance, partners, privacy, prescribing practices, transparency and advertising, then keeps monitoring certified sites after approval (Healthcare Certification 101).

Telehealth brands apply under the telemedicine classification. Pharmacies, med spas that prescribe or take card-not-present payments for prescriptions, wholesalers and manufacturers are also eligible (101 Guide). Certification lasts one year and renews annually, and certified sites get a public verification page (step-by-step guide).

The company is owned by the private equity firm TJC, which lists it as a portfolio company since June 2022 (TJC).

When a telehealth brand needs it

It depends on how you plan to get patients and take payment.

Two points get missed:

• Certification does not make every ad compliant. Google still restricts prescription drug terms in ads, landing pages and keywords (Google), and LegitScript says certification "does not guarantee advertising approval" (FAQ). Its 2026 telehealth advertising webinar named unsubstantiated claims, missing disclosures, restricted drug names and before-and-after imagery as the top reasons certified advertisers still get disapproved (LegitScript).
• If you never plan to run prescription-drug ads, for example a brand that grows through an existing audience, affiliates or organic search and processes with Stripe, certification may be optional. In practice most brands get it eventually, because paid acquisition and high-risk processing both lead back to it.

What it costs in 2026

LegitScript's pricing page is public. Since its move away from the old A/B/C category pricing, it charges one flat rate (LegitScript):

Fees are charged per root domain, and subdomains are covered by the root (FAQ). LegitScript's own example: three websites cost $2,925 to apply and $6,450 a year (101 Guide). Neither fee is refundable "under any circumstances" (terms), so a denied application loses the $975.

Older guides still quote $975 + $1,995 or "Category C" pricing. Those figures are out of date.

What the fee doesn't cover: licenses in every state you serve, pharmacy partners that are themselves certified or accredited, legal review of your site and ads, Google's own certification, and the card networks' high-risk registration fees through your processor. One processor reports Visa's annual registration at $950, which Visa may waive with LegitScript or NABP certification, and Mastercard's at $500 with no waiver (Helcim). Confirm current numbers with your own acquirer.

How long it takes

LegitScript doesn't publish a standard review time. The only official timing is that expedited review starts within two business days (LegitScript). Estimates from consultants and processors range from about four to six weeks up to several months (Rimo, Corepay), and those firms sell help with the process.

What actually controls the time, according to LegitScript, is how complete your documents are and how quickly you answer the analysts' questions (step-by-step guide). Build it into your launch plan: if paid ads are your launch channel, the brand can't start them until certification and the platform authorization are both in place.

The application, step by step

From LegitScript's own guide (step-by-step guide):

1. Create an account in the client portal (desktop Chrome; mobile isn't supported).
2. Pay the nonrefundable application fee.
3. Choose expedited review if you want it.
4. Complete the questionnaire and upload documents. You can save and return.
5. Submit. LegitScript first checks the application is complete.
6. Answer and fix anything the analysts raise.
7. Pay the annual fee once you're approved.

Have these ready before you pay (101 Guide):

• business registration for every jurisdiction you operate in;
• every healthcare license, plus LegitScript's licensure spreadsheet (every applicant completes its Corporate Holdings tab);
• the telemedicine compliance spreadsheet, showing each clinician's compliance in each state;
• the compounding addendum, if any medication you offer is compounded;
• a description of your business model;
• your privacy policy;
• a list of every affiliate, and the certification status of each partner;
• test logins for your patient portal, or wireframes if the site isn't live.

If your site isn't live yet, you'll usually receive Preliminary Certification, which converts once the site launches (step-by-step guide).

The nine certification standards

LegitScript's current standards document lists nine (standards):

1. Licensure and business registration. Licensed where you prescribe or dispense, and where the patient is.
2. Legal compliance. You can't facilitate prescribing or dispensing unapproved medications.
3. Prior discipline and history. Disclose criminal, regulatory and civil violations and litigation from the past ten years, for principals, key staff and clinicians.
4. Affiliates and partners. Every affiliate must comply, fulfilment partners must generally be certified or accredited, and every domain must be disclosed.
5. Patient services. Your site lists every state or country you serve.
6. Privacy. HIPAA where it applies, and encryption for sensitive data.
7. Validity of prescription. No prescribing or dispensing before a licensed clinician has actually provided care.
8. Transparency. No misleading claims, including benefits the FDA or FTC wouldn't support.
9. Advertising. Ads must be accurate and lawful; ads that break a platform's terms can lead to denial or revocation.

The clinical model matters most for DTC brands. LegitScript has said that "the questionnaire-only model where a patient fills out a form and a prescription is generated with no genuine provider review" doesn't pass (LegitScript). Your clinician network's intake and review process has to stand up on its own.

What holds applications up

LegitScript names these as the most common problems (step-by-step guide):

• Incomplete documents, especially a missing licensure spreadsheet, telemedicine sheet or compounding addendum.
• Uncertified partners. Your pharmacy isn't LegitScript-certified or NABP-accredited. Check before you sign with one, using LegitScript's free status lookup.
• A site that isn't live, which usually means Preliminary Certification only.
• Missing disclosures: states served, every domain, every affiliate.
• Unclear policies, such as quality assurance, batch testing and compounding procedures.
• Undisclosed disciplinary history, which also needs a remediation plan.

LegitScript can also deny an application for not disclosing affiliates, not responding in time, or inaccurate information, and it has no obligation to hear appeals (terms). After you're certified, changes to licensure or any disciplinary action must be reported within 30 days.

Compounded GLP-1s and peptides

Two product decisions decide whether a brand can be certified at all.

Compounded GLP-1s. LegitScript treats the FDA's 2025 end dates for 503A compounding of tirzepatide (March 5, 2025) and semaglutide (April 24, 2025) as "hard cutoffs, not suggestions." Compounded versions now need a documented patient-specific clinical need, and a lower price or convenience doesn't count (LegitScript). It also flags describing compounded GLP-1s as "FDA-approved" (GLP-1 FAQ). More in our guide to 503A vs 503B compounding pharmacies.

Peptides. Research-use-only peptide businesses are generally not eligible (FAQ). In September 2026 LegitScript wrote that retatrutide, BPC-157, TB-500 and cagrilintide are "not currently eligible for compounding, sale, or use" in the US, and that dispensing them through a separate partner "doesn't provide a workaround" (LegitScript). If peptides are part of your plan, read our peptide telehealth guide first.

Is it worth it?

For a US telehealth brand that plans to grow with Google or Meta ads for prescription treatments, it isn't optional: no other accreditor is accepted for telemedicine on either platform. The direct cost is small next to ad budgets: $3,125 in year one for one website. The real cost is preparation: licensed clinicians in every state you list, certified pharmacy partners, a clinical model with genuine review, and claims you can support.

The order of operations that avoids a wasted fee:

1. Choose clinician and pharmacy partners that are already certified or accredited.
2. Lock the product list. Drop anything LegitScript won't accept.
3. Write the site, intake and policies to the nine standards.
4. Gather every document on the checklist.
5. Then apply, and plan your ad launch around the review.

---