Payments · Online Pharmacy8 min readUpdated November 2, 2026

How Do I Require a Prescription Before Checkout?

How an online pharmacy requires a valid prescription before checkout completes, holds the card during review, and captures or voids the payment.

Article summary

TL;DR

Make the prescription a condition of the order, not of the payment. Collect it at checkout (upload, or a request to the prescriber), authorize the card without capturing, and have a pharmacist verify it. Capture only once it's approved; void the authorization if it isn't. A card hold usually lasts 7 days online, so review fits inside that window.

  • The FDA lists sites that "allow you to buy medicine without a prescription from your doctor" as a sign of an unsafe online pharmacy.
  • Stripe restricts "Card-not-present prescription-only products and pharmaceuticals" (updated September 22, 2026); Shopify Payments doesn't support prescription drugs.
  • On Stripe, an online card authorization is valid 7 days for customer-initiated Visa, Mastercard, Amex and Discover payments.
  • Stripe's 30-day extended hold on Visa doesn't apply to transactions related to healthcare.
  • Shopify's Acceptable Use Policy excludes uploading Protected Health Information subject to HIPAA.
Want to go further? AskChatGPTClaudePerplexityGrok
On this page

This guide is part of our hub on online pharmacy payment processing. The general guide, for any business: high-risk merchant accounts. If you sell prescription treatment as a brand, Tagada Rx puts storefront, doctors, pharmacy and payments in one stack, by application.

Why the prescription check comes before the money

A pharmacy that sells prescription medications without a valid prescription is, for regulators and processors, the textbook illegal pharmacy. The FDA tells consumers a safe online pharmacy "requires a prescription from a licensed healthcare professional"1FDA, BeSafeRx: Frequently Asked Questions, content current as of September 21, 2020.

  1. FDA

    Among the signs of an unsafe site, it "allow[s] you to buy medicine without a prescription from your doctor"1FDA, BeSafeRx: Frequently Asked Questions, content current as of September 21, 2020.

  2. Controlled substances

    Federal law bars dispensing them "by means of the Internet without a valid prescription"221 U.S.C. § 829(e), read November 2, 2026.

  3. Processors

    Stripe reviews online pharmacies before accepting them3Stripe, Prohibited and restricted businesses, last updated September 22, 2026; Shopify Payments lists prescription drugs among the products it can't support4Shopify Help Center, Shopify Payments eligibility, read November 2, 2026.

Your checkout is the first thing an underwriter tests. If an anonymous visitor can pay and receive a prescription-only product, the account review usually ends there. The full rule set: online pharmacy merchant account compliance.

The three ways to gate checkout

Pick the gate by where the prescription comes from. Most pharmacies combine the first two.

GateHow it worksStrengthLimit
Upload at checkoutThe patient attaches a file; the order goes on hold for pharmacist reviewSimple; works for new patientsA photo isn't verification: the pharmacist still confirms with the prescriber
Prescriber sends itThe patient names the prescriber; the pharmacy requests or receives the prescription directlyStrongest evidenceSlower; the order waits on a third party
Account gatePrescription-only products are visible but can't be added to the cart until the account holds a verified prescriptionClean for refillsFriction on the first order

Merchants still ask for this on Shopify. A November 2024 Community thread looking for an app that "requires prescription approval" before checkout ended with no confirmed solution9Shopify Community, Seeking Checkout App with Prescription Approval Feature for Pharmacy, November 28, 2024. WooCommerce plugins exist: one blocks checkout on the server until a file is attached and holds the order for review, and states it "does not replace local pharmacy rules"10WordPress.org, Prescription for WooCommerce by DevDiggers, version 1.0.0, read November 2, 2026.

Fig. 1A prescription-gated checkout, step by step

approved declined or closed routing step

  1. CartPrescription-only product
  2. thenPrescriptionUpload, prescriber, or verified account
  3. thenCard authorizedA hold, not a charge
  4. waits forPharmacist reviewPrescriber, patient, product, quantity, validity
  5. approvedCapture and shipOr void if rejectedApproved

Nothing is charged and nothing ships before the pharmacist clears the order.

Stripe Docs, Place a hold on a payment method.

Authorize at checkout, capture after verification

The cleanest payment pattern is authorize-then-capture, also called a pre-authorization hold. The bank reserves the amount; you take it only when the order is cleared.

  1. Authorize only at checkout (on Stripe, capture_method=manual)5Stripe Docs, Place a hold on a payment method, read November 2, 2026.
  2. Hold the order in a "pending prescription" status. Nothing ships.
  3. Verify the prescription: prescriber, patient, product, quantity, validity.
  4. Capture the authorized amount on approval. You can capture less, which releases the rest5Stripe Docs, Place a hold on a payment method, read November 2, 2026.
  5. Void the authorization if the prescription is rejected or never arrives5Stripe Docs, Place a hold on a payment method, read November 2, 2026.

On Stripe, the hold lasts 7 days for most online card payments.

How long the hold lasts on Stripe, for online card payments5Stripe Docs, Place a hold on a payment method, read November 2, 2026:

Card brandCustomer-initiatedMerchant-initiated
Visa7 days5 days (exactly 4 days and 18 hours)
Mastercard7 days7 days
American Express7 days7 days
Discover7 days7 days

If you don't capture in time, "the funds are released and the payment status changes to canceled"5Stripe Docs, Place a hold on a payment method, read November 2, 2026.

7 days

Stripe hold for a customer-initiated online card payment, on all four brands

4 days 18 h

Visa merchant-initiated hold on Stripe

30 days

Stripe extended authorization, which doesn't apply to Visa healthcare transactions

When verification takes longer than the hold

Plan your review to finish well inside 7 days. Extended authorizations won't save you on Visa.

Watch out

Stripe's extended authorization (up to 30 days) is offered on Visa for other merchant categories, but "doesn't apply to [...] transactions related to healthcare"6Stripe Docs, Place an extended hold on an online card payment, read November 2, 2026. It also requires IC+ pricing or a request to Stripe, and Stripe notes that many networks reserve extended windows for cases where the final amount isn't known6Stripe Docs, Place an extended hold on an online card payment, read November 2, 2026.

What to do when a prescriber is slow:

  • Tell the patient the order is on hold and why, with the date the hold expires.
  • Let the hold lapse or void it, then ask the patient to confirm a new authorization once the prescription is verified.
  • Don't charge a saved card without consent to "reserve" stock: a charge the patient didn't expect becomes a dispute.

Void, don't refund

A voided authorization never becomes a sale. A refund is a sale reversed after the fact, with processing costs and a line on the statement.

Outcome of the reviewPayment actionWhat the patient sees
Prescription approvedCaptureOne charge
Prescription rejectedVoid the authorization5Stripe Docs, Place a hold on a payment method, read November 2, 2026The pending amount disappears
Information missingKeep the hold, ask the prescriberPending amount, plus your email
Hold about to expireVoid, re-authorize with consentA new pending amount

Card statements don't always tell a hold from a charge, which "can sometimes confuse customers"5Stripe Docs, Place a hold on a payment method, read November 2, 2026. Say it on the checkout page: void transaction is the term your support team will use.

Where the prescription file lives

Keep the prescription and any health data in a system built for it, not in your store platform. Shopify's policy says it doesn't support "uploading Protected Health Information subject to HIPAA"7Shopify, Acceptable Use Policy, read November 2, 2026.

  • Store platform and payments: order, amount, status, a reference to the prescription record.
  • Pharmacy system: the prescription, the patient record, the pharmacist's decision.
  • Processor: HIPAA doesn't apply to an entity processing a payment for health care "for, or related to" that activity842 U.S.C. § 1320d-8 (HIPAA section 1179), read November 2, 2026, but that doesn't make your store a safe place for prescriptions.

Fig. 2Three systems, three kinds of data

One prescription orderSplit by what each system may hold
  1. Store platform and paymentsOrder, amount, status, a reference to the prescription record
  2. Pharmacy systemThe prescription, the patient record, the pharmacist's decision
  3. ProcessorProcesses the payment; HIPAA doesn't apply to that activity

The store keeps a reference, never the prescription.

Shopify Acceptable Use Policy; 42 U.S.C. § 1320d-8.

Checkout copy that prevents disputes

  • Before the card field: "Your card is authorized now and charged only after a pharmacist verifies your prescription."
  • On the hold: how long it lasts, and that it is released if the order is rejected.
  • On approval: a confirmation email with the amount and the shipping date.
  • On rejection: a plain email saying the hold is released and why the order can't ship.
  • Descriptor: your pharmacy's name, so the final charge is recognized: billing descriptor.

Fig. 3What the patient should read at each stage

Order · pending prescriptionOnline pharmacy checkout
Card
Authorized now, charged only after verification
Hold
Released if the order is rejected
On approval
Email with the amount and the shipping date
Descriptor
Your pharmacy's name

Illustrative record.

Say hold, not charge, until the pharmacist approves.

Illustrative example.

For refills and recurring orders, the billing rules are in how to sell prescription drugs on subscription. Building the page itself, fields, order and conversion: checkout optimization for online pharmacies.

How Tagada helps

Hold at checkout, capture on the doctor's approval

Tagada Rx runs this pattern as part of a telehealth stack with storefront, doctors, pharmacy and payments12Tagada, Tagada Rx, read November 2, 2026. It is open by application to a selected group of brands.

See how it works on the Tagada Rx page.

Tagada follows Visa and Mastercard rules and the laws that apply to payments.

Hold at checkout, capture on the doctor's approval

Nick Bonnassies

CMO at Tagada

CMO at Tagada. Before Tagada, Nick built direct-to-consumer brands that generated over $115M in sales, raised over $25M in crowdfunding and sold two of them. He also works as a fractional CMO on marketing operations and AI systems.

Frequently asked questions

Can I take payment at checkout and charge only after the prescription is approved?

Yes. Authorize the card at checkout without capturing, verify the prescription, then capture. On Stripe, an online card hold lasts 7 days for customer-initiated payments on the main brands. If the prescription is rejected, void the authorization instead of refunding.

Is there a Shopify app that holds checkout until a prescription is approved?

Merchants have looked for one. A Shopify Community thread from November 2024 ended without a confirmed app that holds checkout until approval. Note also that Shopify Payments doesn't support prescription drugs and Shopify's policy excludes uploading HIPAA-protected health information.

Is an uploaded photo of a prescription enough?

It's a start, not a verification. A pharmacist still checks the prescriber, the patient and the product before dispensing. The FDA's test for a safe pharmacy is that it requires a prescription from a licensed healthcare professional; how you verify it is set by your state board of pharmacy.

What happens if verification takes more than 7 days?

The authorization expires and the funds are released. Stripe's longer Visa hold doesn't apply to healthcare transactions. Tell the patient, then ask them to confirm a new authorization once the prescription is verified.

Do I need a BAA with my payment processor for prescription orders?

HIPAA doesn't apply to an entity processing payments for health care, for that activity. Keep prescriptions out of payment and store systems anyway, and send the processor only what it needs to charge the card.

Sources

Checked November 2, 2026
  1. FDA, BeSafeRx: Frequently Asked Questions, content current as of September 21, 2020
  2. 21 U.S.C. § 829(e), read November 2, 2026
  3. Stripe, Prohibited and restricted businesses, last updated September 22, 2026
  4. Shopify Help Center, Shopify Payments eligibility, read November 2, 2026
  5. Stripe Docs, Place a hold on a payment method, read November 2, 2026
  6. Stripe Docs, Place an extended hold on an online card payment, read November 2, 2026
  7. Shopify, Acceptable Use Policy, read November 2, 2026
  8. 42 U.S.C. § 1320d-8 (HIPAA section 1179), read November 2, 2026
  9. Shopify Community, Seeking Checkout App with Prescription Approval Feature for Pharmacy, November 28, 2024
  10. WordPress.org, Prescription for WooCommerce by DevDiggers, version 1.0.0, read November 2, 2026
  11. Tagada Docs, Tagada Rx introduction, read November 2, 2026
  12. Tagada, Tagada Rx, read November 2, 2026

Tagada Rx

No charge before the prescription is verified

Tagada Rx runs the stack behind your brand. Open by selection: every application is reviewed, and we reply to each one.

  1. 01Tell us about your brand
  2. 02We review every application
  3. 03Go live under your brand after review