What LegitScript Healthcare Certification actually is

Most operators meet LegitScript the same way. An acquiring bank, a payment gateway or an advertising platform says the account cannot go live without certification, and nobody in the business has heard of it. The instinct is to file it alongside the state licences, chase a number, and move on. That misreading is where most of the wasted time in an application starts.

A private standard, not a public licence

A state pharmacy board licenses a pharmacy. A state medical board licenses a physician. Those are public bodies exercising statutory authority, and their decisions run through a public process.

LegitScript is a private company. It sells a certification that other private companies have chosen to require before they will do business with a healthcare merchant: card networks and the banks that acquire for them, advertising platforms, marketplaces and some payment service providers. No law compels you to hold it. What compels you is that the counterparties you need will not transact without it.

Two consequences follow, and both catch people out.

Your licences do not substitute for it. A clinic with a clean board record, credentialed prescribers and a registered pharmacy partner still fails if the copy on its landing page describes a compounded drug the way the reviewer knows it may not be described. Certification looks at how the business presents itself to patients, not only at whether it is lawful.

There is no regulator to appeal to. A denial is a commercial decision by a private company applying its own published standards. The remedy is a better application, not a hearing, and the application fee is spent either way.

The unit of certification is a website

This is the single most expensive assumption to get wrong. Certification attaches to a domain rather than to a legal entity. A company running a clinical site, a separate landing domain for one product category and a legacy brand it never retired is looking at three applications, not one, and the arithmetic is worth doing before anything is submitted. The cost page sets out what actually drives that bill.

Retiring a domain is cheap while it is still a decision. It is expensive once it is named in a submitted application, because changing the shape of the business mid-review is exactly the kind of inconsistency that generates questions.

What the reviewer is actually looking at

A certification review is closer to an investigation than to a form check. The reviewer is comparing four accounts of your business against each other:

• What you say in the application. Ownership, entity, prescribing model, fulfilment, the domains you operate.
• What your website says. Product claims, pricing structure, provider identity, refund and cancellation terms, privacy disclosures.
• What the public record says. Corporate filings, licence lookups, pharmacy registrations, prior enforcement history.
• What your partners say. The pharmacy that dispenses, the provider network that prescribes, the platform that hosts.

Applications fail on the gaps between those four far more often than on anything disqualifying. A clinic that describes itself as physician-led in the application and as an AI-powered platform on the home page has not lied anywhere. It has simply told two stories, and a reviewer whose job is to resolve the difference will ask, which is time.

What certification does for you once you hold it

The credential is a gate, not a benefit in itself. Holding it is what makes the following possible rather than blocked:

• Card acceptance in the high-risk healthcare categories. Acquirers use it as the evidence that a merchant coded into a healthcare category has been vetted.
• Advertising on the major platforms. Certification is a prerequisite for the platform-level healthcare approvals, and those are separate applications with their own review, filed at the ad account level.
• Marketplace and partner access. Fulfilment partners, telehealth marketplaces and some pharmacy networks use it as a screening credential before diligence even opens.

Notably absent from that list: certification is not a defence to a regulator. It does not make a claim compliant, it does not make an unlicensed prescription lawful, and it does not stop an FDA warning letter. It is evidence that a private standard was met on the day it was granted, and it is monitored after that.

Certification is a state you maintain, not a certificate you file

Certified merchants are monitored. Websites change, product lines change, and a certification granted against one set of pages continues to be assessed against whatever those pages become. Merchants whose risk profile warrants closer watching may be certified on a probationary basis instead, which carries heavier monitoring.

The practical version of that: whoever ships marketing copy needs to know that the site is inside a compliance perimeter. The most common way a certified merchant gets into trouble is not a decision anyone made about compliance. It is a landing page written by someone who had never been told the rules applied to them.

Where to start

If you are working out whether this applies to you at all, the honest first question is not what it costs, it is what you would have to change to pass. Read what disqualifies an application next, then look at your own site with that list in hand. Most of the work is there.

Three misreadings that cost the most time

"We are licensed, so we qualify." Licensure is necessary and not sufficient. The certification asks a broader question about how the business presents and operates, and the most common failure in a fully licensed business is a sentence on a landing page.

"It is one application for the company." It is one application per website, and the domain list is nearly always longer than the people filing remember. Pull it from the registrar account rather than from the marketing team, and pull it before you decide anything else, because it changes the shape of the whole exercise.

"We will fix the website if they ask." Fixing claims copy during a review means the file is now blocked on an engineering backlog owned by somebody with different priorities, and the response time counts against you. Fixing it first costs a sprint. Fixing it later costs the review.

What good preparation actually produces

Two artefacts, and both outlive the application.

The first is a claims allowlist: one page per product saying what the preparation is, what may be said about it and what may not, approved by whoever owns clinical. Give it to every copywriter, agency and affiliate, and new landing pages stop reintroducing the problem you just fixed.

The second is a document set that stays current: entity and ownership, the provider roster with licences by state, the pharmacy entity and its registration, and the domain decisions. Assembled once, it answers most of what a reviewer asks, and it answers the same questions when a bank or a partner asks them next quarter.