Verticals / Telehealth & Pharmacy
Telehealth & Pharmacy
Growth infrastructure for care that gets delivered behind certification gates.
Telehealth and pharmacy occupy a strange position among regulated verticals: the major ad platforms will take your money, but only after a third party has audited your licensure, your prescription workflow, and your website. Google restricts the entire category of online prescribing, dispensing, and sale of prescription drugs, and requires advertisers to complete its own certification — which in most locations means LegitScript or NABP accreditation first. Meta gates prescription drug and telehealth ads behind active LegitScript certification plus its own authorization, and limits targeting to three countries. Nothing here is banned outright, but nothing is open either.
The gates do not stop at advertising. Card networks classify pharmacy merchant category codes as high-integrity risk, Stripe puts online pharmacies, prescription delivery, and telemedicine on its restricted list pending pre-approval, and the same LegitScript certification that unlocks ad accounts is the credential payment providers most commonly accept. Meanwhile HIPAA — plus FTC enforcement for entities HIPAA does not cover — constrains the measurement layer that every other vertical takes for granted. The default growth stack, installed as-is, is a compliance incident waiting for a records request.
zsty works in verticals where the standard playbook is prohibited or gated. This page lays out the current state of the rules that shape telehealth and pharmacy growth — ad policy, tracking technology, state licensure, prescribing rules, and payment infrastructure — with primary sources, so you can judge whether we understand your operating environment before you talk to us. None of this is legal advice; verify anything load-bearing with counsel.
Where the ad platforms stand
Google's Prescription Drug Services policy restricts promotion of online prescribing, dispensing, and sale of prescription drugs — explicitly including online pharmacies and telemedicine providers. Advertisers must apply for Google's own healthcare certification, and in most locations must first hold third-party accreditation from LegitScript, NABP, or a local regulator. Promotion is permitted in roughly 35 countries, keyword bidding in fewer, and the separate restricted drug terms rules limit which terms can appear in ads, keywords, and landing pages even for certified accounts. Certification is applied for at the child account level and tied to a specific certified domain.
policy source →Meta's Drugs and Pharmaceuticals ad standard requires prescription drug advertisers to hold active LegitScript certification or pass Meta's internal review, complete Meta's authorization process, target only the United States, Canada, or New Zealand, restrict audiences to 18+, and include a disclaimer to consult a licensed health professional. Online pharmacies and telehealth providers are named categories requiring LegitScript certification plus Meta authorization before delivery. Purely educational prescription-drug content and telehealth ads that promote no specific medication have narrower requirements, but the moment an ad facilitates the sale of a prescription product, the gate applies.
policy source →Independent of certification, Google's Personalized Advertising policy treats health as a sensitive interest category: advertisers promoting health-related products and services cannot use advertiser-curated audiences (remarketing lists, customer match built on health signals) because they may contain sensitive user data. Only Google's predefined audiences — with sensitive signals automatically excluded — remain available. In practice this removes retargeting, the highest-converting tool in a normal paid funnel, from every telehealth and pharmacy account, certified or not.
policy source →What closed paid channels do to the economics
Gated channels change the CAC equation before the first click. Certification is a real line item — LegitScript's Healthcare Merchant Certification runs $975 per website to apply and $2,150 per website annually, with a $2,500 expedited-review option — and the calendar cost of application, platform authorization, and per-domain scoping delays time-to-first-dollar in a way spreadsheet CAC models rarely capture. Then, even fully certified, the account operates with degraded tooling: no health remarketing on Google, three eligible countries and 18+ targeting on Meta, restricted drug terms constraining keywords and landing pages, and a measurement layer that legally cannot lean on third-party pixels the way a shoe brand's can. Certified paid acquisition in this vertical carries structural overhead that competitors in unregulated categories simply do not pay.
The rational response is not to abandon paid — telehealth is one of the few high-risk verticals where the gate can actually be opened — but to stop treating it as the primary demand engine. Owned and organic assets are the only channels in this vertical whose economics improve over time: search positions compound, refill and subscription retention compounds, and consented email/SMS lists are immune to platform policy swings. Operators who treat certification and compliance engineering as CAC line items, and who build organic demand capture in parallel with the certification queue, end up with unit economics the paid-only competitors cannot match when the next policy revision lands.
Compliance is site architecture
Build the site to pass LegitScript review before you apply
LegitScript certification for telehealth and pharmacy merchants requires demonstrable licensure and jurisdictional compliance, valid prescriptions from authorized prescribers, HIPAA-compliant privacy practices, and transparent business information — and the review is conducted against your live website. Licensure display, prescriber and pharmacy identity, physical contact information, prescription-requirement disclosure, and honest pricing/refund pages are architecture decisions, not copy edits. Certification is also priced per website, so domain sprawl multiplies both fees and review surface; consolidate before applying.
Treat tracking technology as regulated infrastructure
OCR's guidance on online tracking technologies still governs HIPAA-covered entities. A federal court in June 2024 vacated the narrow "proscribed combination" portion — IP address plus a visit to an unauthenticated page about a health condition — and HHS withdrew its appeal, but the rest of the guidance stands: tracking on authenticated pages, patient portals, scheduling flows, and intake forms can disclose PHI to the tracking vendor. No third-party ad pixel belongs behind a login or inside a care flow without a BAA or valid authorization, and mainstream ad platforms will not sign BAAs for pixel data.
The FTC reaches what HIPAA does not
GoodRx paid a $1.5 million civil penalty in the FTC's first Health Breach Notification Rule action and is permanently barred from sharing user health information with third parties for advertising — over exactly the pixel and SDK configurations most growth teams install by default. Coupon platforms, discount cards, wellness storefronts, and cash-pay telehealth brands that sit outside HIPAA are squarely inside FTC jurisdiction. "We're not a covered entity" is not a tracking strategy.
Your content map must match your licensure map
Telehealth care is legally rendered where the patient is located, so a provider generally needs licensure in the patient's state, and the Interstate Medical Licensure Compact — 42 states plus DC and Guam — expedites obtaining separate state licenses rather than creating one portable license. Site architecture should encode this: state-level landing pages and conversion paths only where the clinical roster is actually licensed, geo-gating on intake, and a maintenance process that updates pages when the licensure map changes. A state page you cannot legally serve is both a regulatory exposure and a conversion dead end.
Prescribing copy must track a temporary federal rule
Telemedicine prescribing of Schedule II–V controlled medications without a prior in-person exam currently operates under DEA/HHS's Fourth Temporary Extension of the COVID-era flexibilities, effective January 1 through December 31, 2026, while permanent special-registration rules are finalized. Any page promising online prescribing of controlled medications is describing a rule with an expiration date — date-stamp it, review it on a schedule, and never let marketing copy assume permanence. Not legal advice; verify prescribing claims with counsel.
Payment infrastructure
Assume Stripe requires pre-approval — plan for it or around it
Stripe's restricted businesses list names online pharmacies (including SaaS platforms), card-not-present prescription-only products, prescription delivery services, and telemedicine and telehealth services as categories requiring pre-approval through its sales and compliance teams. Building checkout on a default Stripe account and disclosing the category later is how telehealth companies end up with frozen balances mid-launch. Underwriting conversations belong before the build, not after.
Card networks classify pharmacy MCCs as high-integrity risk
Visa and Mastercard treat MCC 5122 (drugs and druggist sundries) and MCC 5912 (drug stores and pharmacies) as high-integrity-risk categories requiring registration through the acquiring bank. LegitScript certification is the compliance proof acquirers and payment providers most widely accept when onboarding pharmacy and telehealth merchants — the same credential that opens ad platforms does double duty in the payments stack.
Budget LegitScript as payments infrastructure, not marketing spend
LegitScript Healthcare Merchant Certification — recognized by Google, Meta, Microsoft, TikTok, Visa, and Mastercard among others — costs $975 per website to apply, $2,150 per website annually, with an expedited option at $2,500 for review within two business days. For a merchant that both advertises and processes cards, it is the single credential with the highest leverage per dollar in the vertical.
Your underwriting file is an operating asset — keep it current
A clean, current package — state licensure roster, prescription workflow documentation, fulfillment pharmacy agreements, refund and cancellation policy, sample patient communications — shortens every onboarding you will ever do and materially reduces dispute exposure when a cardholder challenges a subscription charge. Subscription-based telehealth in particular should over-document consent and cancellation flows, because recurring-billing disputes are the category's chief chargeback-risk driver.
Maintain processing redundancy
Policy reclassification, an acquirer exiting the category, or a risk-screening flag can suspend a merchant account with little warning, and in this vertical a payments outage stops care delivery, not just revenue. A second processing relationship — ideally with a processor that specializes in healthcare merchants — is standard resilience engineering, not paranoia.
The zsty approach
zsty's method was built in the one vertical with worse conditions than yours. Our founder operates Big Moose Hemp, a DTC hemp brand that grows under a total advertising prohibition — no Google, no Meta, no gated path to either — and zsty.us itself ranks organically without a dollar of ad spend. Everything we do for regulated operators is proven first on our own properties, where there is no certification queue to wait in and organic demand capture is the entire game. Telehealth and pharmacy operators get the benefit of that discipline in a vertical where the gates, at least, can eventually open.
The approach treats your website as two things simultaneously: a regulatory artifact and a demand engine. As a regulatory artifact, it is built to pass review — LegitScript's requirements shape the information architecture from day one, the state-page structure mirrors your actual licensure map, tracking is inventoried and stripped from authenticated and care-flow surfaces, and the copy discipline excludes efficacy claims and restricted drug terms that would burn a certification or an ad account. As a demand engine, it captures the search demand this vertical is rich in: condition-adjacent and medication-adjacent informational queries, state-plus-service queries, comparison and cost queries — the traffic that arrives whether or not your paid accounts are live, and keeps arriving when a policy revision pauses them.
Measurement gets rebuilt for the constraint rather than bolted on: server-side and aggregate analytics, BAA-covered tooling where PHI is in play, and conversion tracking designed so that no third-party ad platform ever receives condition, medication, or appointment data. When certification lands and paid channels open, they plug into a funnel that already converts — instead of being the only thing holding the business up.
Questions operators ask
- Do we need LegitScript certification if we never plan to run ads?
- Very likely yes — because of payments, not marketing. Visa and Mastercard treat pharmacy merchant category codes 5122 and 5912 as high-integrity risk requiring acquirer registration, Stripe restricts telemedicine and online pharmacy merchants pending pre-approval, and LegitScript certification is the compliance proof payment providers most widely accept when onboarding healthcare merchants. It also functions as a trust signal in partnership and B2B conversations. If you dispense or facilitate prescription products in any card-not-present channel, budget for certification regardless of your ad plans.
- Can we run Google or Meta ads while our certification application is pending?
- No. Google requires its healthcare certification — which in most locations presupposes LegitScript or NABP accreditation — before prescription-drug-service ads serve, applied for per account and tied to a certified domain. Meta requires active LegitScript certification (or completion of its internal review) plus Meta's own authorization before delivery. Running adjacent ads that avoid prescription claims while gated is possible but risky: landing pages that facilitate online prescribing are themselves in policy scope, and enforcement flags can complicate the certification you are waiting on. The productive use of the queue is building the organic and owned channels that do not need permission.
- The court vacated part of the OCR tracking bulletin — can we put GA4 and the Meta pixel back on our site?
- Not the way you had them. The June 2024 ruling vacated only the "proscribed combination" — IP address plus a visit to an unauthenticated public page about a health condition — and HHS withdrew its appeal, but the guidance still applies to authenticated pages, portals, scheduling, and intake, where tracking can transmit PHI to the vendor. Separately, the FTC's GoodRx action shows regulators reaching pixel-based health-data sharing even outside HIPAA, and the platforms' own terms prohibit receiving health data. The defensible posture: full pixel inventory, nothing third-party behind authentication or inside care flows, server-side measurement for the rest. Not legal advice — have counsel review your specific configuration.
- We're licensed in 12 states. Can our website market nationally?
- Your content can inform nationally; your conversion paths cannot. Telehealth care is rendered where the patient is located, so intake must gate by state against your actual clinical licensure roster, and state-specific landing pages should exist only for states you can serve. The Interstate Medical Licensure Compact speeds up adding states — it covers 42 states plus DC and Guam — but each state license is still separate, so treat the licensure map as living data that drives page publication, geo-targeting, and structured data on a maintenance schedule rather than a one-time build decision.
zsty buys no ads. It ranks organically — and did so for itself first.
If paid acquisition is closed in your vertical, the owned layer is the whole game. That's the layer we build.
Sources
- Prescription drug services — Advertising Policies Help — Google
- Healthcare and medicines — Advertising Policies Help — Google
- Personalized advertising — Advertising Policies Help — Google
- Drugs and Pharmaceuticals — Ad Standards — Meta Transparency Center
- Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates — HHS Office for Civil Rights
- Judge rules in favor of AHA, vacating HHS online tracking 'bulletin' as unlawful — American Hospital Association
- Fourth Temporary Extension of COVID-19 Telemedicine Flexibilities for Prescription of Controlled Medications — Federal Register (DEA/HHS)
- Restricted Businesses — Stripe
- Healthcare Merchant Certification — LegitScript
- Three Principles for Online Pharmacies (Payments Overview) — LegitScript
- FTC Enforcement Action to Bar GoodRx from Sharing Consumers' Sensitive Health Info for Advertising — Federal Trade Commission
- Licensure compacts — Telehealth.HHS.gov
Regulatory and platform policies change frequently. This page is operational analysis, not legal advice — verify current rules with counsel before acting.