Dependable Verification and Monitoring of Merchants, Advertisers and Websites.

LegitScript Internet Pharmacy Certification Standards

A website is designated by LegitScript as an Internet pharmacy website if the website facilitates the sale or dispensing of a prescription drug or medical device, either via the website or by directing the Internet user to another website or pharmacy.

Defining Internet Pharmacies and Applicable Laws

In determining legitimacy classifications, LegitScript applies the applicable laws to LegitScript International Internet Pharmacy Certification Standards. In this context, "applicable laws” refers to both the laws and regulations where the website operates from (e.g., dispenses or supplies medicines from) and the laws and regulations of any jurisdiction where the website offers to ship drugs to. Internet pharmacy websites must adhere to the laws and regulations in both sets of jurisdictions. (If an Internet pharmacy website is not fully legal in a particular jurisdiction, that area should be removed from the list of possible shipping destinations.)

Legitimate Internet Pharmacy Websites

Websites designated by LegitScript as legitimate are those that have been through the LegitScript certification process and are confirmed to meet LegitScript standards. Legitimate Internet pharmacy websites are monitored on an ongoing basis with quarterly reviews and are subject to a full re-review on at least an annual basis.

LegitScript international Internet pharmacy certification standards are:

Pharmacy Licensure

The website must only facilitate the dispensing of drugs by pharmacies that are licensed or registered in good standing to operate a pharmacy or engage in the practice of pharmacy in all required jurisdictions. This includes the jurisdiction that the drugs are dispensed from and the jurisdiction where the drugs are offered to be shipped to, except where reciprocity exists or other legal authority does not require such licensure.

Controlled Substances

Controlled substance laws vary by country. The dispensing pharmacy must be in compliance with all applicable laws and regulations for controlled substances.

For example, any dispensing pharmacy, if dispensing controlled substances to US locations, must be registered with the US Drug Enforcement Administration (DEA) and must be in compliance with DEA rules and regulations.

Prior discipline

The pharmacy, which may also include its pharmacists and any physician associated with the website, must not have been subject to significant recent and/or repeated disciplinary sanctions.

Pharmacy location

All pharmacies that dispense drugs on behalf of the website must be domiciled in the jurisdiction where the website offers to ship drugs to, except where reciprocity exists, drug importation is expressly permitted as a matter of law, or other legal authority permits or does not require the pharmacy to be domiciled in the jurisdiction.

Validity of prescription

The pharmacy shall dispense or offer to dispense prescription drugs only upon receipt of a valid prescription, as defined below, issued by a person authorized to prescribe under applicable laws. The pharmacy must not distribute or offer to distribute prescriptions or prescription drugs solely on the basis of an online questionnaire or consultation without a pre-existing patient-prescriber relationship that has included a face to face physical examination, except as explicitly permitted under applicable telemedicine laws or regulations.

Definition: A valid prescription is one issued pursuant to a legitimate patient-prescriber relationship, which requires the following to have been established: a) The patient has a legitimate medical complaint; b) A face-to-face physical examination adequate to establish the legitimacy of the medical complaint has been performed by the prescribing practitioner, or through a telemedicine practice approved by the appropriate practitioner board; and c) A logical connection exists between the medical complaint, the medical history, and the physical examination and the drug prescribed.

This requirement may be waived upon a showing that the prescribing and dispensing of the drug, as well as the location of the patient, all occur or exist within a jurisdiction that has expressly authorized, by statute, regulation or other applicable law, prescribing based on an online questionnaire or consultation without a pre-existing patient-prescriber relationship that has included a face-to-face physical examination.

Legal compliance

The website and any dispensing pharmacy must comply with all provisions of applicable laws. For the US, this includes but is not limited to state laws and regulations, the Federal Food, Drug, and Cosmetic Act and the Federal Controlled Substances Act, and the website must not facilitate the dispensing of, or offer to facilitate the dispensing of, medications that have not been approved by the US Food and Drug Administration (FDA). For countries other than the United States, the website and any dispensing pharmacy must adhere to all applicable pharmacy licensure, drug safety and supply chain laws and regulations.


Websites must adhere to all privacy laws and regulations in the jurisdictions where the website offers to ship drugs from and to.

For any website offering to facilitate the dispensing of drugs to the US, if the pharmacy website transmits information that would be considered Protected Health Information (PHI) under the HIPAA Privacy Rule (45 CFR 164), the information must be transmitted in accordance with HIPAA requirements, including the use of Secure-Socket Layer or equivalent technology for the transmission of PHI, and the pharmacy must display its privacy policy that accords with the requirements of the HIPAA Privacy Rule.

Patient services

The website must display an accurate street address for the dispensing pharmacy or pharmacies. The pharmacy must provide on the website an accurate, readily accessible and responsive phone number or secure mechanism via the website, allowing patients to contact or consult with a pharmacist regarding complaints or concerns or in the event of a possible adverse event involving their medication.

This requirement may be modified to permit the listing of a pharmacy’s corporate headquarters, but only in cases in which the pharmacy business has multiple dispensing pharmacies, or in cases in which the corporate headquarters’ address is listed with the applicable government agency that licenses and regulates the pharmacy.

Website transparency

Neither the website nor the pharmacy may engage in practices or extend offers that may deceive or defraud patients in any way, including but not limited to, any material detail regarding the pharmacy, pharmacy staff, prescription drugs, or financial transactions.

Domain name registration

The domain name registration information of the website must be accurate, and the domain name registrant must have a logical nexus to the dispensing pharmacy. Pharmacy websites utilizing anonymous domain name registration services will not be eligible for approval.

Affiliated websites

The pharmacy, website, pharmacy staff, any associated medical personnel, domain name registrant, and any person or entity that exercises control over, or participates in, the pharmacy business must not be affiliated with or control any other website or group of websites that violates these standards.

Unapproved and Unverified Internet Pharmacy Websites

Most Internet pharmacies that do not comply with LegitScript international Internet pharmacy certification standards are "rogue.” However, a failure to comply with LegitScript’s Internet pharmacy certification standards does not necessarily mean that the website is a rogue Internet pharmacy. Some are classified as "unverified” or "unapproved” but not "rogue.”

"Unverified” Internet pharmacies are those that, based on a brief, initial review, appear likely to comply with LegitScript requirements but have not been subject to the LegitScript certification process, or appear likely to be easily able to comply with our standards with minimum adjustments. "Unverified” is a neutral descriptor.

"Unapproved” Internet pharmacies are those for which LegitScript has verified some lack of compliance with LegitScript’s international Internet pharmacy certification standards or applicable laws or regulations. For example, if the lack of compliance is minor or appears unintentional, a website may be designated as "unapproved” but not "rogue.” Some unapproved Internet pharmacies are additionally designated as "rogue” based on the criteria below.

Rogue Internet Pharmacy Website Criteria

The literal definition of "rogue” in this context is "operating outside normal or desirable controls.” (See, e.g., thefreedictionary.com/rogue.) Because the practice of pharmacy and the sale of drugs should be, and are normally, regulated for safety, websites that facilitate the sale of drugs in a way that is not subject to sufficient regulatory oversight, or that reasonably appears to constitute knowing or intentional violation of applicable laws, may be considered "rogue.”

LegitScript often recommends that domain name registrars, Internet service providers, payment facilitators and other third-party platforms consider disabling services to websites designated as “rogue” Internet pharmacies upon direct verification by LegitScript that the website is not legally compliant.

An Internet pharmacy (as defined above) is rogue if it qualifies as unapproved, and:

Definition of a Rogue Internet Pharmacy

An Internet pharmacy is rogue if it qualifies as unapproved, and:

  • The sale, prescribing or dispensing of prescription or other drugs reasonably appears to intentionally or knowingly violate, facilitate the violation of, or offer to facilitate the violation of applicable laws or regulations, defined as the laws and regulations where the drugs are dispensed from or where they are offered to be shipped to;
  • Does not adhere to accepted standards of medical and/or pharmacy practice, including standards of safety; and/or
  • Engages in fraudulent or deceptive business practices.

The most common scenarios in which an unapproved website is additionally designated as a rogue Internet pharmacy are if one or more of the following three scenarios are true:

  • The website sells prescription drugs without a valid prescription (as the term “valid prescription” is defined in LegitScript’s international Internet pharmacy certification standards), except where expressly permitted or authorized by applicable laws.
  • The website sells unapproved drugs, which includes but is not limited to drugs that are considered unapproved under applicable law by virtue of being shipped or dispensed outside of authorized drug supply chains.
  • The website facilitates the sale of drugs by pharmacies or non-pharmacy entities that do not have pharmacy licenses required under applicable laws.

Did you know?

LegitScript's online pharmacy certification standards as to the US and Canada are recognized by the NABP.

Is it Legit?

Check online pharmacy legitimacy.

Report a Rogue Pharmacy