LegitScript certification for telehealth: what it takes, how long, and why applications fail
You cannot run Google or Meta ads for prescription telehealth without it, and most first applications go back with questions. Here is what the reviewers are actually looking for.
Lithos Staff
Photograph via UnsplashLegitScript certifies that a telehealth or pharmacy business operates lawfully: licensed clinicians and pharmacies, a valid prescriber-patient relationship, honest marketing, and compliant handling of prescriptions and data. Google, Meta, and others require it before running ads for prescription services. Budget six to twelve weeks from a complete application, longer if the reviewers come back with questions. Applications fail most often on marketing claims (efficacy, pricing, drug names on the page), unclear corporate structure between the brand and the medical group, unlicensed or unlisted pharmacies, and missing policies. Build the program to be certifiable from the start rather than retrofitting.
What it is and why the platforms require it
LegitScript is a third-party verification service that reviews healthcare and pharmacy businesses against a standard covering licensure, prescribing practices, marketing, and data handling. Ad platforms adopted it as a gate: Google and Meta will not run ads for prescription telehealth or online pharmacy services from an uncertified advertiser. Payment processors, pharmacy partners, and acquirers use it as a shorthand for “this business is real.”
What the reviewers look at
| Area | What they want to see | Where applications stumble |
|---|---|---|
| Corporate structure | Who owns the brand, who owns the medical group, and how they relate (MSO agreement, CPOM compliance) | The brand cannot explain who employs the clinicians |
| Clinicians | Licenses in every state served; DEA where applicable; collaboration agreements where required | A state on the marketing map with no licensed clinician |
| Prescriber-patient relationship | How intake, identity verification, and clinician review establish a valid relationship in each state | Questionnaire-only flows in states that require more |
| Pharmacies | Every pharmacy used, with licensure in the states it ships to; compounding permits | An unlisted pharmacy, or one shipping where it is not licensed |
| Marketing and website | No unsupported efficacy claims, no guaranteed outcomes, no misleading pricing, careful handling of drug names | “Lose 20 lbs in 8 weeks”; compounded drug names in headlines |
| Privacy and data | HIPAA posture, BAAs with vendors, a real privacy policy | Analytics pixels on pages that collect health information |
| Policies and disclosures | Terms of service, telehealth consent, refund policy, contact information, physical address | Boilerplate copied from a non-healthcare template |
A realistic timeline
- Weeks 0–2: preparation. Gather the corporate documents, clinician and pharmacy license lists, policies, and a website that already reads the way the reviewers expect. This is where most of the work is; the application itself is a form.
- Week 2: submission and fee. Application fees and annual monitoring fees are published on LegitScript’s site and vary by program type.
- Weeks 3–8: review. Reviewers examine the submission and the live website. Expect at least one round of questions; answer them completely and quickly, since each round adds a week or two.
- Weeks 6–12: decision. Certification, with a listing in the LegitScript directory that the ad platforms check.
- Ongoing: monitoring. Website changes, new products, and new states are all in scope. Certified businesses get flagged when a landing page drifts.
The five most common reasons applications go back
- Marketing claims. Outcome promises, before-and-after imagery, “doctor-approved” language without a doctor, and compounded drug names used like brand names.
- Structure the applicant cannot explain. If you cannot draw the brand–medical group–pharmacy diagram on a whiteboard, the reviewers cannot either.
- Pharmacy gaps. A pharmacy on the bench that is not licensed for a state you advertise in. See non-resident pharmacy licensing.
- Relationship establishment. Async flows without identity proofing, or used in states that require a synchronous visit. See asynchronous telehealth.
- Missing or generic policies. Telehealth consent, privacy, and refund policies that do not match how the program actually operates.
Build to be certifiable
The businesses that pass quickly are the ones whose infrastructure already answers the questions: a medical group with a clear MSO relationship, clinicians whose licensure map matches the marketing map, pharmacies with verified licenses, intake flows that establish a valid relationship per state, and a website written to the platforms’ rules before the first ad runs. Retrofitting any of these after a rejection is slower than building them in.
Frequently asked questions
Do I need LegitScript certification to run telehealth ads?
For prescription-related telehealth and online pharmacy advertising on Google and Meta, yes — both require certification (or a comparable program) before ads are approved. Organic and affiliate channels do not require it, but partners and payment processors increasingly ask for it too.
How long does LegitScript certification take?
Plan on six to twelve weeks from a complete submission. Incomplete applications, follow-up questions, or website changes required by reviewers extend that. Certification is then maintained through ongoing monitoring and annual renewal.
What does LegitScript check?
Corporate and ownership structure, clinician licensure, the medical group and its relationship to the brand, pharmacies used and their licensure, how the prescriber-patient relationship is established, marketing and website content, privacy and data practices, and required policies and disclosures.
Can we advertise compounded medications after certification?
Certification does not override platform ad policies or FDA rules on compounded-drug marketing. Certified programs still have to keep drug names, dosing, and efficacy claims off ads and landing pages in ways the platforms and regulators expect.
From first call to first patient, in weeks.
A 15-minute intro call, sandbox credentials the same day, go-live in 3–4 weeks — new launches and existing patient bases alike.