Payments11 min readUpdated October 14, 2026

Telemedicine Payment Processing: What Processors Check

Taking card payments as a telehealth business: the MCC for a consult or a prescription, what Stripe and PayPal require, and Visa's rules on renewals.

Nick Bonnassies, CMO at Tagada · checked against 13 sources

Article summary

TL;DR

Telehealth businesses can take card payments, but processors review them first. Stripe lists telemedicine as a restricted business, PayPal requires pre-approval, and Visa puts online pharmacy sales in Tier 1 of its high-risk program. Expect to show licenses and your prescribing process, and keep consultations and medication on the right merchant codes.

Stripe treats telemedicine and online pharmacies as restricted businesses, reviewed case by case. PayPal requires pre-approval for both.
Visa has no telehealth code. A physician consult fits 8011, other practitioners 8099, dispensed medication 5912.
Card-absent pharmacy sales (5122, 5912) are Tier 1 in Visa's high-risk program, unless the pharmacy is accredited by NABP or another body Visa recognizes.
Stripe doesn't require LegitScript certification for telemedicine, but asks for license numbers and how your process works.
Treatment plans billed every month follow Visa's recurring rules: terms at sign-up, a reminder before a trial ends, cancellation online.

Want to go further? Ask

On this page

A telehealth business is two businesses in one checkout: a medical consultation and, often, a prescription that someone has to dispense and ship. Card networks and processors treat those two very differently. Here is what they check, which merchant code fits each part, and how to bill treatment plans without piling up disputes.

Is telehealth high-risk for payment processing?

Not all of it. Visa's high-risk list covers pharmacies, not doctors. Processors are broader: most of them review any business that diagnoses or treats patients online before they let it take cards.

Medication is Visa Tier 1
Card-absent sales under MCC 5122 and 5912 sit in Tier 1 of Visa's Integrity Risk Program, its highest level. The acquirer needs Visa's approval for that tier and must register the merchant first.3
Prescribing is licensed
Processors want to know who prescribes, where they're licensed and how a prescription is issued. Stripe asks telemedicine applicants for license numbers and information on their processes.
Treatment plans recur
Most plans renew every month. Visa sets rules for renewals, and a patient who forgot about one can file a dispute that counts against you.

Visa adds one hard line that applies to every acquirer, whatever the code.2

An Acquirer must ensure that a Merchant [...] does not accept Cards for [...] The purchase of products that claim or imply a similar efficacy as prescription drugs, controlled substances, or recreational/street drugs, irrespective of claims of legality.

Visa Core Rules, section 1.9.2.1, April 18, 2026

In practice, the product pages of a telehealth brand matter as much as its license. A non-prescription product marketed as "works like" a prescription drug can't be sold on Visa at all.

Which processors accept telehealth payments?

The big self-serve processors don't refuse telehealth outright. They put it behind a review.4 5 6

What you sell	Stripe	PayPal
Telemedicine and telehealth services	RestrictedNeeds review. Prohibited for accounts in Mexico	Pre-approval required ("Telemedicine Services")
Prescription medication sold online	RestrictedNeeds review. Pharmacies approved only in the US, Canada, the EU, Australia, the UK and Japan	Pre-approval required ("Prescription Items")
Prescription-only medical devices, prescription delivery	RestrictedNeeds review	Pre-approval required for prescription dispensing services
Non-prescription products that make unsafe or harmful claims	Prohibited("pseudo-pharmaceuticals or nutraceuticals that are not safe or make harmful claims")	ProhibitedIf they present a risk to consumer safety

Verdict

Neither Stripe nor PayPal approves telehealth by default. Both decide case by case, and an approval can be changed or revoked later: Stripe says so in its restricted list.

Stripe defines the scope precisely. Telemedicine is "synchronous and asynchronous patient communication that involves diagnosis or treatment conducted over phone, text, email, or video consultations." Education or wellness content isn't telemedicine. And an internet pharmacy is any business that "sells, dispenses, markets, or facilitates the selling, dispensing, or marketing" of a prescription or pharmacy-only medicine ordered online.5 A telehealth brand that charges for the medication itself can fall under both definitions.

Which MCC fits a telehealth business?

Visa's merchant code manual has no telehealth or telemedicine code. You use the code of what you actually charge for.1

Fig. 1One brand, up to three codes

Your telehealth checkoutVisa has no code named telehealth

Physician consultation8011, Doctors and Physicians
Other practitioner8099, therapists, psychologists, mental health practitioners
Prescription medication5912, Drug Stores and Pharmacies

what you charge for sets the code

Source: Visa Merchant Data Standards Manual, April 2026, pages 75, 102 and 103.

What you charge for	Visa MCC	On Visa's high-risk list (card-absent)
Consultation with a licensed physician, general or specialized (dermatology, psychiatry…)	8011 Doctors and Physicians	Not listed
Consultation with another health practitioner (therapist, psychologist, fertility clinic…)	8099 Medical Services and Health Practitioners	Not listed
Prescription and proprietary drugs sold to patients	5912 Drug Stores and Pharmacies	Tier 1. Outside the US, only sales that aren't domestic
Wholesale or B2B distribution of drugs	5122 Drugs, Drug Proprietaries, and Druggist Sundries	Tier 1

Visa's rules also define a "Health Care Merchant" in the US: a merchant, other than a pharmacy, whose main business is providing health care services under codes such as 8011 or 8099.2 The pharmacy is deliberately outside that group.

5122 isn't a patient-facing code

Visa describes 5122 as business-to-business or wholesale distribution of drugs. A brand selling to patients shouldn't sit on it. If your provider gave you 5122 or a generic retail code for medication sales, ask why. See how to find your MCC on each processor.

Pharmacies get one exemption. Visa's rule that acquirers register every high-integrity-risk merchant "does not apply to Merchants assigned MCC 5122 or 5912 if the Merchant is accredited by the National Association of Boards of Pharmacy (NABP) or other regulatory body recognized by Visa."2 The full tier list is in our guide to high-risk MCC codes.

Consultation and medication: one merchant account or two?

This is the structural question most telehealth brands face. Visa's manual gives two rules that frame it.1

A merchant with several lines of business can use the code of its biggest line for everything, or one code per line.
But a line that is high integrity risk, like card-absent pharmacy sales, must have its own code, separate from the others.

Stripe assigns one MCC per account.8 So a brand that bills both the consult and the medication usually ends up with two accounts or two merchants of record, one per code.

Fig. 2Two common setups

The brand bills everything

CheckoutConsult plus first month of treatment
splits intoConsult account8011 or 8099
andPharmacy account5912, Visa Tier 1

Two codes: 8011 or 8099 for consults, 5912 for medication, each with its own review

Brand bills the consult, pharmacy bills the medication

CheckoutConsult or membership fee
chargesBrand account8011 or 8099
hands off toPartner pharmacyCharges the patient for medication

The brand stays on 8011 or 8099; the pharmacy is merchant of record for the drugs

who dispenses decides

Illustrative example. The right setup depends on who dispenses, who employs the prescribers and your legal structure.

Either way, the patient sees two kinds of charges. Make each billing descriptor recognizable: Visa requires that the name on the statement doesn't create confusion with the merchant's code, and an unfamiliar name is a classic reason for "I don't recognize this charge" disputes.1 If you're new to the concept, read what a merchant of record is responsible for.

What processors ask for

Stripe says telemedicine applicants "typically need to provide items such as license numbers and information on your processes."5 Merchant account providers list similar files. Build them before you apply, not after the first review email.

Licenses. Prescriber license numbers and the states or countries each one covers, plus the pharmacy's license if you dispense. LegitScript's first standard: be "adequately licensed for the services they offer and in the jurisdictions they serve."
Your clinical flow. Intake, who reviews it, synchronous or asynchronous consult, when a prescription is issued or refused, and what the patient pays if it's refused.
Who does what. The medical group, the pharmacy, the brand: who is the merchant of record for each charge.
Product and ad copy. No claim that a non-prescription product works like a prescription drug. Processors read your site the way Visa's rules do.
Billing terms. Price, renewal frequency, trial terms, how to cancel, refund policy for refused prescriptions.
History. Processing statements and dispute rates from past accounts, if you have them.

Assembled from Stripe's telemedicine FAQ and LegitScript's healthcare certification standards. Each processor sets its own list.

Do you need LegitScript certification?

Not for Stripe. Its FAQ is explicit.5

Telemedicine businesses don't need certification from LegitScript. However, certain licensing and regulatory items must be provided to Stripe for verification as part of the onboarding process.

Stripe Support, Prohibited and restricted businesses list FAQs

Other banks and processors can still ask for it. LegitScript's certification reviews nine standards, from licensure and prior discipline to validity of prescriptions, privacy and advertising. LegitScript says "Visa and Mastercard recognize LegitScript Certification," and that Google, Meta, Microsoft, TikTok and LinkedIn are among the platforms that trust it for healthcare ads.7 For many telehealth brands, ads are the reason to get it, and payments benefit on the side.

$975

LegitScript application fee per website, nonrefundable

$2,150

Annual certification fee per website, once approved

$2,500

Optional expedited processing, review starts within 2 business days

Fees as published on LegitScript's healthcare certification page on October 14, 2026.7 Check the page before you budget: they change.

Billing treatment plans as subscriptions

Monthly refills, memberships and ongoing care are subscriptions for the card networks. Visa's rules apply whatever your code.2

Fig. 3A treatment plan Visa is happy with

Sign-upPrice, frequency and trial terms shown apart from the general terms, patient consents
ConfirmationIn Europe, within 2 business days
Trial endingReminder at least 7 days before, with amount, date and a cancel link
RenewalOn the dates agreed
Cancel onlineRequired when the plan was sold online

card-absent, any MCC

Source: Visa Core Rules and Product and Service Rules, April 18, 2026, tables 5-20 and 5-21.

If you don't honor the terms you showed, Visa's rule is a full refund. In the US, ROSCA and state auto-renewal laws add their own requirements; negative option billing covers them. For how stored cards and merchant-initiated renewals work, see subscription payment processing, and for renewals that fail, subscription payment failures.

A treatment plan has one constraint a coffee subscription doesn't: the next shipment may depend on a prescriber renewing the prescription. Bill on the schedule you disclosed, and if a renewal isn't approved, don't charge for medication you won't ship.

When to charge: before or after the consult

Three patterns are common, and each has a card rule behind it.

Charge at booking. Simple for cash-pay consults. State plainly what's refunded if the prescriber declines treatment.
Authorize at booking, capture after the consult. The funds are held, not taken, until you capture. Holds expire, so capture within your processor's window. See pre-authorization holds.
Charge after insurance pays (US). Visa calls this a Preauthorized Health Care Transaction. The Health Care Merchant needs an order form describing the services, the patient's permission to charge the balance after insurance pays, and a time period of no more than one year. It can't request authorization until the insurer has adjudicated the claim.2

Only the third pattern is reserved to Health Care Merchants, which excludes pharmacies.

Disputes on recurring treatment plans

Most telehealth disputes aren't fraud. They're patients who didn't expect a charge.

I didn't know it would renewRenewal terms were buried in the general termsShow price and frequency separately at sign-up, send the 7-day reminder before a trial ends
I cancelledCancellation took a call or an email that went unansweredOnline cancellation, a confirmation email, no charge after it
I don't recognize this chargeThe descriptor shows the medical group or pharmacy, not the brandRecognizable descriptor on each account, brand name in the receipt
I never got my medicationPrescription refused or delayed, charge already takenCapture after approval, refund refused prescriptions as your policy says

Visa's dispute thresholds apply to telehealth like to any card-absent merchant. Since April 1, 2026, the VAMP "Excessive" level for merchants in the US, Canada, the EU and Asia-Pacific is 1.5%: fraud reports plus disputes, divided by settled card-absent transactions.13 Our guide to chargeback prevention covers the ratio, alerts and how to answer subscription disputes.

HIPAA and your payment processor

Some vendors say any processor handling telehealth payments must sign a business associate agreement. The statute is narrower than that.10

To the extent that an entity is engaged in activities of a financial institution [...], or is engaged in authorizing, processing, clearing, settling, billing, transferring, reconciling, or collecting payments, for a financial institution, this part, and any standard adopted under this part, shall not apply to the entity with respect to such activities.

42 U.S.C. § 1320d-8

The exemption covers the payment. It doesn't cover your intake forms, patient messages, CRM or email tool, which may hold health information tied to a name. Keep clinical details out of payment metadata, receipts and descriptors, and ask your counsel which vendors need an agreement.

HSA and FSA cards

Patients often want to pay with a health savings or flexible spending card. HSA funds pay for qualified medical expenses, defined as amounts paid for "medical care" under section 213(d) of the tax code.11 Prescribed medicines count as medical expenses; drugs that aren't prescribed don't, except insulin.12

Whether a given charge qualifies is the patient's question with their plan, not a promise to put on your checkout. On the card side, Visa lets FSA and HRA payments be auto-substantiated at checkout only if the merchant is licensed and certified by SIGIS, and its acquirer too.2

Prescribing rules that shape your checkout (US, as of October 2026)

Controlled substances: a dated rule

Under the DEA and HHS fourth temporary extension, in effect from January 1 to December 31, 2026, a DEA-registered practitioner can prescribe schedule II-V controlled substances via telemedicine without an in-person evaluation, if the conditions in 21 CFR 1307.41 are met.9 What applies from January 1, 2027 depends on what DEA publishes next. Check the Federal Register before you plan a checkout around it.

Processors ask about this because a model that works under a temporary rule can stop overnight. If part of your catalogue depends on it, say so in your application and plan what happens to running plans if the rule changes.

Before you apply: questions to ask the processor

Question	Why it matters
Do you accept telemedicine, and online pharmacy sales, in my country?	Stripe approves pharmacies in six regions only and prohibits telemedicine in Mexico
Which MCC will you assign to each part of my business?	A consult on 8011 and medication on 5912 can't share one Stripe account
Is your acquirer approved by Visa for Tier 1?	Required before it can register a pharmacy merchant, unless NABP-accredited
Do you require LegitScript or another certification?	Stripe doesn't for telemedicine; others may
What triggers a rolling reserve, and for how long?	A reserve holds part of your payouts; the terms differ by processor and account
How do you handle renewals of stored cards and card updates?	Treatment plans live on renewals

How Tagada helps

Running treatment plans on more than one processor

Tagada runs subscriptions with trials, billing cycles, dunning and automatic retries, in the same system as the checkout that takes the first order. Payments route across Stripe, Adyen and Tagada's own processor, TagadaPay, with one set of rules and a cascade on decline. The card vault moves customers between merchant accounts without collecting their cards again, so running plans keep charging if one account is reviewed. 3D Secure 2 is native, with a rules engine. TagadaPay still underwrites each business, with enhanced review on regulated verticals. Pricing is on the pricing page. Tagada follows Visa and Mastercard rules and the laws that apply to payments.

Whichever processor you choose, the order stays the same: map each charge to its code, collect your licenses and process description, put renewal terms and cancellation where patients see them, and keep a second account ready before you need it. Dynamic payment routing explains how that second account takes over.

Updated on October 14, 2026

Nick Bonnassies

CMO at Tagada

CMO at Tagada. Before Tagada, Nick built direct-to-consumer brands that generated over $115M in sales, raised over $25M in crowdfunding and sold two of them. He also works as a fractional CMO on marketing operations and AI systems.

Frequently asked questions

Is telemedicine considered high-risk for payment processing?

Partly. Visa's high-risk program covers card-absent pharmacy sales (MCC 5122 and 5912) in Tier 1, but not doctor or practitioner codes like 8011 and 8099. Processors add their own rules: Stripe lists telemedicine as restricted and PayPal requires pre-approval, so every telehealth business goes through a review.

Can Stripe process telemedicine payments?

It can, after a review. Stripe lists telemedicine and telehealth services as restricted, reviews each business case by case and typically asks for license numbers and details of your process. Online pharmacies are approved only in the US, Canada, the EU, Australia, the UK and Japan. Telemedicine is prohibited for Stripe accounts in Mexico.

What MCC code is used for telehealth?

Visa has no telehealth code. Use the code of what you charge for: 8011 for consultations by licensed physicians, 8099 for other health practitioners such as therapists or psychologists, and 5912 for prescription medication dispensed by a pharmacy. 5122 is for wholesale drug distribution, not for selling to patients.

Do I need LegitScript certification to accept telehealth payments?

Not at Stripe: its FAQ says telemedicine businesses don't need LegitScript certification, though they must provide licensing and regulatory items. Other processors and banks can ask for it. LegitScript says Visa and Mastercard recognize its certification, and several ad platforms require it to run healthcare ads.

Does my payment processor need to sign a HIPAA business associate agreement?

For the payment itself, usually not: federal law says HIPAA's administrative simplification rules don't apply to a financial institution, or an entity acting for one, when it processes card or bank payments for health care. Tools that store intake data, messages or patient records are a separate question for your counsel.

Can patients pay for telehealth with an HSA or FSA card?

Often, if the expense is medical care under the tax code. HSA funds cover qualified medical expenses, and prescribed medicines count as medical expenses for the IRS. Whether a charge qualifies is between the patient and their plan. To auto-substantiate FSA and HRA card payments on Visa, the merchant must be SIGIS-certified.