Telemedicine Payment Processing: How Prescribing Models Get Underwritten
Why a talk therapy practice and a weight loss prescriber are two different files for an acquirer, what the card schemes ask of prescription sales, and the documents and refund terms that carry an application.
- By the OpenGate underwriting desk
- Updated
- 16 min read
Telemedicine payment processing is card acceptance for care delivered remotely, and acquirers underwrite it by what the card pays for: a consultation, a membership or a prescription medicine. A practice that bills visits is read as a medical practice. A platform that bills for medication is read as a card-not-present pharmacy, a category Visa and Mastercard make acquirers register. This guide covers how each model is classified, what the file must contain and which billing terms survive disputes.
In this guide
What decides how telemedicine payment processing is underwritten
The charge decides, more than the specialty. An underwriter opens a telehealth file by asking what the patient’s card is paying for, who delivers it and which legal entity collects the money. Three answers are possible, and each leads to a different review.
- A clinical service: a video visit, an asynchronous consultation, a therapy session, a care membership.
- A prescription medicine, dispensed by a pharmacy and shipped to the patient.
- A bundle that hides the split: one monthly price covering the clinician, the medication and the shipping.
The first is read as a medical practice that happens to bill card-not-present. Acquirers commonly code it under the physician and medical services categories, MCC 8011 or 8099.
The second is a card-absent pharmacy sale, coded MCC 5912 for retail or 5122 for wholesale. Visa’s Integrity Risk Program guide, published in April 2023, places card-absent pharmacies in Tier 1, the tier with the heaviest due diligence, alongside gambling and adult content. Mastercard’s merchant security manual, in its edition of August 4, 2026, has a section on pharmaceutical merchants (9.4.3). A business that mainly sells prescription drugs card-not-present must be registered by its acquirer, and the acquirer must first verify that what the business does complies with all applicable laws, then reconfirm it at least once a year. Online pharmacy payment processing covers what an acquirer checks first on the pharmacy side.
The word telemedicine appears neither in that manual nor in Visa’s Core Rules. What triggers the registration is the sale of the medicine. Acquirers commonly ask for LegitScript certification as their proof, and Visa’s April 2026 rules waive the merchant registration for a pharmacy accredited by the National Association of Boards of Pharmacy (NABP) or by another body Visa recognizes.
The bundle is where most telehealth platforms sit, and the acquirer resolves it by looking at where the money goes. If most of the monthly price pays for a drug, the file is underwritten as prescription sales, whatever the website calls the product. The documents we ask for in that case are listed on our telehealth merchant account page.
How acquirers read each telehealth model
Acquirers sort telehealth into a handful of models, and the first question differs for each. The table runs from the lightest file to the hardest.
| Model | What the card pays for | How the file is usually read | The underwriter’s first question |
|---|---|---|---|
| Talk therapy and counseling | Sessions or a membership, no medication | Medical or counseling practice with recurring billing | Are the clinicians licensed where the patients are? |
| Primary and urgent care visits | A consultation, with prescriptions sent to the patient’s own pharmacy | Medical practice | Who employs or contracts the clinicians? |
| Sexual health, hair and skin programs | A consultation plus medication shipped by a partner pharmacy | Prescription sales, card-not-present | Which pharmacy dispenses, and is it licensed in every ship-to state? |
| Hormone therapy | Lab work, consultations and medication, often on a monthly plan | Prescription sales, with a controlled-substance layer when testosterone is prescribed | How is the patient evaluated before a controlled medication is prescribed? |
| Weight loss with GLP-1 medication | A membership plus a branded or compounded drug | Prescription sales with supply and marketing risk | Is the drug FDA-approved or compounded, and by whom? |
| ADHD, ketamine and other controlled-substance programs | Visits and prescriptions for scheduled drugs | The narrowest acquirer appetite in the vertical | Where are the DEA registrations, and what is the in-person evaluation policy? |
| Platform connecting patients to independent clinics and pharmacies | Fees collected for several providers | Facilitator or marketplace | Who is the merchant of record for each charge? |
Two rows need a note. Testosterone is a Schedule III controlled substance in the United States, so a hormone clinic is asked what a controlled-substance program is asked. The second note carries a date. The temporary DEA telemedicine flexibilities let a registered practitioner prescribe controlled medications without a prior in-person evaluation when conditions are met. The fourth extension, published on December 31, 2025, set them to expire on December 31, 2026. When we checked in October 2026, the DEA’s permanent rule on special telemedicine registrations had been under White House review as a final rule since August 25, 2026 and had not been published. If you read this after December 2026, check first whether the flexibilities were extended again, replaced or allowed to lapse, because an underwriter will ask every controlled-substance program the same thing. Have a written answer, and confirm the legal position with counsel.
Talk therapy is the calm end of the table. No drug changes hands, the scheme registration for pharmacies does not apply, and the open questions are the ordinary ones for recurring billing: consent, renewal reminders and cancellation.
What Stripe and PayPal publish about telehealth
Both treat the category as one that needs their approval first, and the detail differs. As of October 2026: Their HIPAA statements, set beside Square’s, are in Is Stripe HIPAA compliant?
- Stripe’s list of restricted businesses, last updated in September 2026, puts telemedicine and telehealth services, online pharmacies, card-not-present prescription-only products and prescription delivery services among businesses that need additional due diligence. Stripe says it might be unable to approve a business in those categories and can revoke an approval it has given.
- Stripe’s support FAQ defines telemedicine as synchronous or asynchronous patient communication involving diagnosis or treatment, and says education and wellness resources fall outside it.
- PayPal’s Acceptable Use Policy, last updated on October 29, 2022, requires pre-approval for telemedicine services, for prescription items and for medical items or services generally. The same policy prohibits transactions involving steroids and certain controlled substances.
The practical reading: a visit-only practice can often pass a mainstream review, and a prescribing platform is assessed product by product. When an approval covered consultations and the account later bills for medication, the account is processing something nobody approved. That sequence is a common route to a closure, and the recovery steps are in the guide to a closed Stripe or PayPal account.
Compounded GLP-1 programs: what changed and what acquirers ask
Compounded semaglutide and tirzepatide are the least settled products in telehealth billing in 2026, because the legal ground under them moved. The dated facts, from the FDA:
- The FDA determined that the tirzepatide injection shortage was resolved on December 19, 2024, and the semaglutide injection shortage on February 21, 2025. The enforcement discretion it had extended to compounders ended in stages, the last of them on March 19, 2025 for tirzepatide and May 22, 2025 for semaglutide.
- On February 6, 2026, the FDA announced its intent to restrict GLP-1 active ingredients destined for non-approved compounded drugs that are mass-marketed as alternatives to approved products. The statement says promotional material cannot present a compounded product as a generic or as the same as an approved drug, say it uses the same active ingredient, or claim clinically proven results.
- On March 3, 2026, the FDA announced 30 warning letters to telehealth companies over claims about compounded GLP-1 products, the second group since September 2025. The violations it cited included selling the drug under the telehealth firm’s own brand in a way that implied the firm was the compounder.
- An FDA update dated April 1, 2026 reminds compounders that a state-licensed pharmacy may not regularly compound what is essentially a copy of a commercially available drug, unless a prescriber documents a change that makes a significant difference for an identified patient. It notes that neither drug is on the shortage list.
- The FDA’s page on unapproved GLP-1 drugs, revised on October 1, 2026, says federal law does not allow retatrutide or cagrilintide in compounding, and that the agency has warned telehealth companies for marketing retatrutide.
These rules bind the pharmacy and the prescriber. The payment consequences land on the merchant, and an underwriter turns them into four questions.
- Can the supply stop? If the pharmacy loses access to the ingredient or stops compounding, every prepaid month becomes a refund or a dispute.
- What do the ads and landing pages say? Underwriters read them against the FDA’s list, and they look for the compounding pharmacy’s name on the page.
- Who is the pharmacy? Its licenses for each ship-to state, whether it is a state-licensed pharmacy or an outsourcing facility, and its own certification or accreditation.
- What is the fallback? A program that can move patients to an FDA-approved product at a disclosed price is a different risk from one with no second option.
We cannot tell you whether a given compounding arrangement is lawful, and no acquirer will. Expect to be asked for counsel’s written view. Some acquirers decline compounded weight loss programs outright, and others accept them with that opinion and tighter terms.
The prepaid plan problem, in numbers
Prepaid multi-month plans turn a supply interruption into a liability the acquirer can measure. Take an illustrative program that enrolls 500 new patients a month, each staying three months at 300 a month.
- Billed monthly, the program charges 1,500 active patients 300 each: 450,000 a month, delivered as it is billed. Very little is ever owed in product.
- Billed as a three-month plan at 900 up front, the program charges 500 new patients: the same 450,000 a month. After the first shipment each new patient is still owed two months, worth 600. In a steady state the newest cohort is owed 300,000 and the one before it a final month, 150,000. That is 450,000 of paid, undelivered medication at all times.
Now apply a 10 percent rolling reserve held for 180 days. It withholds 45,000 a month and levels off at 270,000. For the monthly model that cushion is ample. For the prepaid model it sits well below the 450,000 that patients have paid for and not received. The acquirer closes the gap with a higher percentage, a limit on how many months you may collect in advance, or both. These figures are an illustration and predict nobody’s terms. The reserve mechanics themselves are in the rolling reserve guide.
What the underwriter wants documented, and where files fail
A telehealth file fails on specifics, so the useful list is the one that names the usual defect next to each document.
| Item | What the underwriter checks | Where it usually fails |
|---|---|---|
| Entity structure | Which entity engages the clinicians, which owns the brand and which charges the card | The management company bills for medical services that only the physician-owned entity may provide in that state |
| License coverage | A matrix of each state served against the clinicians licensed there | Marketing reaches more states than the roster covers |
| Pharmacy partner | Pharmacy licenses per ship-to state, the dispensing agreement, compounding status | The pharmacy changed and the acquirer was never told |
| Certification status | LegitScript Healthcare Certification, or the application in progress | The certificate was issued for a different domain than the one in the application |
| Prescribing workflow | How a patient is evaluated, by whom, and what happens when the answer is no | A questionnaire leads to a prescription with no clinician decision in between |
| Checkout and terms | Price, rebill date, what is refundable and how to cancel, on the screens the patient sees | The terms live only behind a footer link |
| Marketing | Ads, landing pages and emails | Drug claims the FDA has told telehealth firms to stop making |
| Processing history | Three to six months of volume, refunds and chargebacks by service line | One blended statement where medication disputes cannot be separated from visit disputes |
The entity row surprises founders most. Many US states restrict who may own a medical practice, so telehealth groups are often built as a physician-owned professional entity served by a management company. The acquirer needs to know which of the two is the merchant of record, and it will ask for the agreement between them. Have counsel confirm the structure before the application names an entity.
A platform that owns its pharmacy is filing two businesses, and the dispensing half follows the requirements for an online pharmacy. Ownership, banking and history follow the general underwriting sequence.
Refund and billing terms that hold up in a dispute
Telehealth disputes concentrate in four situations, and each has a term that prevents it.
- The patient paid and was not prescribed. State before payment whether the consultation fee is refundable in that case, and refund the medication portion automatically. Without that term the dispute arrives as services not as described (Visa dispute condition 13.3) and you have little to answer with.
- The plan renewed after the patient stopped treatment. Send a reminder before each renewal, give a cancellation path that works without a phone call, and stop billing when a prescription expires. Otherwise the dispute is a canceled recurring transaction (Visa 13.2).
- The medication arrived late or never arrived. Charge when the pharmacy ships, or disclose the delay, and keep the tracking data. The dispute family is merchandise not received (Visa 13.1).
- The cardholder does not recognize the charge. Use a descriptor the patient saw at checkout, with no drug or condition in it, and authenticate first payments with 3DS2 so that a card-absent fraud claim (Visa 10.4) does not rest on your word alone.
Mastercard groups the first three under one cardholder dispute code, 4853. What matters for the account is the count: disputes divided by transactions, measured every month against the scheme programs. The math and the levers are in the chargeback ratio guide, and Visa’s current thresholds are set out in the Visa VAMP guide.
One limit is specific to healthcare. The evidence you submit in a dispute travels to the card issuer, so send proof of purchase, consent and delivery, and keep the clinical record out of it. The same rule governs descriptors, invoices and order fields, and it is most of what HIPAA compliant payment processing means for a telehealth checkout.
Mistakes that close telehealth accounts
Telehealth closures commonly trace back to a gap between what the acquirer approved and what the account processes. The repeat offenders:
- Describing a prescribing platform as wellness coaching or consulting to obtain a lighter category. Miscoding is a scheme rule violation the acquirer answers for, and the account closes when a review finds it.
- Launching a new treatment line, a new drug or a new pharmacy partner without telling the acquirer first.
- Selling in states where no contracted clinician is licensed.
- Leaving ad copy to an agency. The acquirer holds you to what the ads say.
Some files acquirers commonly decline whatever reserve is offered: a platform where a form produces a prescription with no clinician decision, a controlled-substance program that cannot show DEA registrations, a seller of GLP-1 products labeled for research use that markets them for treatment, and any business that will not name its pharmacy. Our telehealth page states the same line for our own reviews: files that describe the prescribing flow clearly move, and files that hide it do not.
What to send with a telehealth application
Send a file an underwriter can read in one sitting. For telehealth that means:
- one page describing what the card pays for in each service line;
- the entity chart and the agreement between the entities;
- the license matrix by state;
- the pharmacy’s licenses and your agreement with it;
- your certification status;
- screenshots of the full checkout, including refund and cancellation terms;
- three to six months of statements, if you have processed before.
If you sell compounded medication, add counsel’s memo and the ad copy currently running.
Then send your telehealth file. A person reads it, and you hear back within 1 business day with an offer, the list of what is missing, or a no and the reason for it when the model is outside what our acquirers take. Applying costs nothing, and nothing binds you before you accept a written offer.