Non-US operations, cross-border shipping and certification

Two different situations get filed under the same heading, and they have very different answers. One is a business incorporated outside the United States serving American patients. The other is a business serving patients outside the United States that needs certification for commercial reasons. Sorting out which one you are is the first step.

The review follows the patient, not the company

Where you are incorporated is a fact the reviewer records. It is not the fact that decides the application.

What decides it is where your patients are, because that determines which prescribing rules apply, which licensure is required, and which shipping restrictions bite. A company registered anywhere can serve American patients provided the clinicians treating them are licensed in the states those patients are in and the medicine is dispensed by a pharmacy licensed to ship there.

So the questions are the same questions, applied to a more complicated set of facts:

• Which states or countries do your patients live in?
• Where are your prescribers licensed, and does that cover those patients?
• Which pharmacy dispenses, where is it licensed, and where may it ship?
• Does your product cross a border on the way to a patient?

That last one is where non-US operators most often discover a genuine problem.

Cross-border shipping is the hard constraint

Importing prescription medicines into the United States for consumer sale is restricted, and the restrictions are not resolved by a well-drafted terms of service page. A model where medicine is dispatched from outside the United States to American patients is a structural issue rather than a presentational one, and it is the version of this question that most often ends with a change to the model rather than to the website.

The workable pattern for a non-US company serving American patients is domestic: prescribers licensed in the states served, a pharmacy licensed and shipping domestically, and a corporate structure that does not obscure who is responsible for what.

Structure that obscures is worse than structure that is complex

Non-US operations frequently involve several entities: a holding company in one jurisdiction, an operating company in another, a professional corporation employing clinicians, a technology entity licensing the platform.

That is unremarkable and reviewers see it constantly. What causes problems is a structure that cannot be explained, or that appears designed to make responsibility hard to locate. Ownership through jurisdictions with limited public registries invites the reviewer to ask who is behind the business, and the answer needs to be available.

State it plainly, with a diagram if it helps, in the submission. The alternative is a request for information that starts from suspicion.

What non-US operators consistently underestimate

State-level licensure. Operators from single-regulator jurisdictions routinely expect one national approval. Clinical practice in the United States is licensed state by state, and coverage gaps against the states you market to are visible in a lookup.

The privacy layer. Compliance with a data protection regime elsewhere is not compliance with the American health privacy framework. A Notice of Privacy Practices is a distinct document from a website privacy policy and from a European-style privacy notice.

Payments. Cross-border acquiring for high integrity risk healthcare categories is harder than domestic acquiring, and the certification requirement arrives through the acquiring bank either way, which the payments article explains.

Language and localisation. Sites serving several markets from one domain carry claims in several languages, and every one of them is part of the application. A translated page that overstates the product is exactly the same problem as an English one, and it is the page nobody in the head office reads.

Serving patients outside the United States

The mirror situation. A business treating patients elsewhere may still need certification, because the counterparties requiring it, card networks, acquirers, advertising platforms, operate internationally. Who actually requires it is the same list wherever you are.

Here the review assesses your model against the rules that apply where your patients are: local prescribing requirements, local pharmacy regulation, local advertising restrictions on medicines, which are frequently stricter than American ones.

The domain question is bigger for you

Multi-market operators tend to have more domains: country domains, language subdomains, legacy brands from earlier markets. Certification attaches to a website, so the estate decides the arithmetic, and what drives the cost is worth reading with the registrar list open.

Consolidating markets onto fewer certified domains, where the business allows it, is usually the cheaper answer, and how brands should think about domain architecture applies with more force here than anywhere else.

Where to start

Map patients to prescribers to pharmacies to shipping routes, and find the gaps. If a medicine crosses a border to reach a patient, resolve that before anything else, because it is the one item on the list that a better application cannot fix. Everything else on this page is preparation, and preparation is what separates a short review from the constraints that accumulate without certification.

The documents that take longest to obtain from abroad

Start these first, because they are the ones with a lead time you do not control.

• Certified corporate documents from a non-English registry, with translations.
• Ownership evidence where the chain passes through a jurisdiction with a limited public registry.
• Identity verification for principals who are not resident in the market you are certifying for.
• Licensure evidence for clinicians credentialed through a third party.
• The pharmacy agreement, where the pharmacy is domestic and the contracting entity is not.

None of these is difficult. All of them take longer than the applicant expects, and all of them are the kind of thing that turns into a request for information if the submission goes in without them.

A structure diagram is worth writing

One page: the entities, where each is registered, what each does, who owns what, and which one contracts with the pharmacy and employs or contracts the clinicians.

Reviewers are not hostile to complexity, they are hostile to opacity, and a diagram supplied unprompted converts a suspicious-looking structure into a documented one. It also has a second life: acquirers, partners and buyers ask the same question, and the same page answers it.

If you would rather have all of this prepared and filed on your behalf, that is what the expedited application service is, and the honest scope of it is set out in what we actually do.