Healthcare Certification

Standards

Our healthcare certification process is trusted around the world because it is rigorous and thorough. This page details what we look for.

Apply Now

Registration & Compliance Internal Practices External Practices

Registration & Compliance

Our first step is making sure you are who you say you are and that you have the necessary documentation.

1. Licensure and Business Registration

Merchants must be adequately licensed for the services they offer and in the jurisdictions they serve. For example, applicants who facilitate the prescribing or dispensing of medications must only utilize medical providers and/or pharmacies that are duly licensed or registered in the jurisdictions the applicant serves. This includes the jurisdiction from which medications are prescribed and/or dispensed as well as the jurisdiction in which the patient is located, except in circumstances permitted by law.

2. Legal Compliance

The applicant must comply with all provisions of applicable laws and regulations. Additionally, the website or business must not facilitate the prescribing or dispensing of medications that do not hold the necessary authorization or approval from the applicable regulatory body in that jurisdiction or medications that are otherwise considered unapproved by relevant regulatory bodies.

The applicant must also be in compliance with all applicable laws and regulations related to the prescribing or dispensing of controlled substances. This includes any necessary licensing, registration, or authorizations required to prescribe or dispense controlled substances, as defined by the relevant jurisdiction(s).

3. Domain Name Registration

For applicants with a website, the domain name registration information of the website must be accurate, and the domain name registrant must have a logical nexus to the applicant’s business, such as the dispensing pharmacy or medical practice. This Standard may be met by making the domain name registration information public, acquiring and maintaining a valid EVSSL certificate, or providing LegitScript with adequate documentation showing non-privacy protected domain name registration information for your website. Documentation that satisfies this requirement may be a screenshot directly from the registrar displaying Whois registrant information. The applicant must also provide all domain names and websites under its control.

Internal Practices

We check to see that your affiliates and staff have the required qualifications.

4. Prior Discipline and History

The applicant or their business, including principals, key staff, and any medical or pharmacy practitioner associated with the website or business must disclose any prior criminal, regulatory, or civil violations, along with any ongoing, resolved or otherwise addressed litigation, that involves the applicant at any time over the past ten years.

Applicants must not have been subject to recent and/or repeated disciplinary sanctions, warning letters, or similar regulatory action. Prior offenses or other bad acts, may be a disqualifying factor in LegitScript’s sole discretion.

External Practices

We make sure your patient services or treatment practices are in compliance with applicable laws.

5. Affiliates and Partners

A merchant’s affiliates must comply with all program standards. Affiliates are any individual, business, or entity who previously, currently, or is expected to have a commercial and/or professional relationship with the applicant organization or its principals. This means any person or entity that exercises control over or participates in the business must not be affiliated with or control any other entity that violates these standards. This includes but is not limited to partner pharmacies, businesses or medical practices, supplying wholesalers, co-owned companies, staff, any associated medical personnel, and may include entities that are promoted on the domain seeking certification. All affiliates and partners must be operating legally.

A merchant's partners, defined as organizations essential to supporting the applicant’s continuum of care, such as partner pharmacies responsible for the fulfillment of prescription medication to patients, are generally required to be LegitScript-certified or accredited by another recognized body, with limited exceptions permitted only at LegitScript's sole discretion.

6. Patient Services

Applicants’ websites must clearly disclose all states, territories, provinces, and/or countries in which applicants’ services are available. Where required by law, this Standard also requires that practitioners with an internet presence must display an accurate street address and the identity and location of medical practitioners engaged in providing medical care or advice to patients on their website.

The website must also display an accurate street address for any dispensing pharmacy or pharmacies. In certain circumstances, applicants may post the address for their corporate headquarters. The applicant must also provide an accurate, readily accessible, and responsive phone number or secure contact mechanism via the website, allowing patients to contact or consult with a provider and/or pharmacist regarding complaints or concerns, or in the event of a possible adverse event involving their medication or treatment.

7. Privacy

The applicant must comply with all provisions of applicable laws and regulations pertaining to protected information or protected health information, including privacy provisions. When required by law, the applicant must post its privacy policy on its website.

For example, US-based applicants who collect, store, or transmit Protected Health Information (PHI) must be in compliance with all applicable HIPAA requirements.

8. Validity of Prescription

The applicant shall only dispense or offer to dispense prescription drugs upon receipt of a valid prescription issued by a person authorized to prescribe under applicable laws. A valid prescription is defined by applicable statutes, regulations, or laws in the jurisdictions served by the applicant. A pharmacy must not distribute or offer to distribute, and a practitioner must not prescribe or offer to prescribe, prescriptions or prescription drugs in a way that violates the laws of the jurisdiction(s) they serve and must comply with all applicable telemedicine laws or regulations. A prescription or prescription drug must not be prescribed or dispensed prior to the provision of care by a licensed medical professional.

9. Transparency

The applicant or affiliates may not engage in practices or extend offers that may deceive or defraud patients or the public in any way, including but not limited to any material detail regarding the pharmacy, pharmacy staff, medical practitioners, drugs, treatments, or financial transactions.

Failure to provide full and accurate information as requested, in LegitScript’s sole discretion, will result in denial. Applicants may undertake reasonable remedial action during the certification process without penalty.

An applicant’s business practices may not pose a reputational risk to LegitScript or the LegitScript Healthcare Certification program.

10. Advertising

Applicants and certified clients must advertise in a manner that is transparent and in accordance with all applicable laws and regulations. Advertisements must not deceive, mislead, or defraud the public in any way.

Applicants advertising on internet platforms in apparent violation of the platforms' terms of service may be considered to be attempting to circumvent the goals of the LegitScript certification program. If LegitScript discovers such advertising, it may be grounds for certification denial or revocation.