Payments · Telehealth8 min readUpdated November 2, 2026

Telehealth Merchant Account Compliance: The Rules to Follow

The rules a telehealth brand must follow to keep its merchant account: MCCs, card network programs, Stripe, DEA, subscription law and health data.

Nick Bonnassies, CMO at Tagada · checked against 19 sources

Article summary

TL;DR

A telehealth brand keeps its merchant account by following four sets of rules at once: the card networks' (merchant code, dispute thresholds, subscription rules), its processor's policy, federal law (prescribing, subscriptions, health data) and state law (clinician licensing, auto-renewal). Telemedicine itself is not a card network risk category; selling the medication is.

Neither Visa's risk program nor Mastercard's registration list names telemedicine; both target pharmacies under MCC 5122 and 5912.
Stripe lists "Telemedicine and telehealth services" as restricted, and says telemedicine businesses "don't need certification from LegitScript".
As of November 2, 2026, the DEA's temporary telemedicine flexibilities run through December 31, 2026.
Visa flags US merchants at 1.5% fraud plus disputes since April 1, 2026.
On July 29, 2026, the FTC sued a telehealth company over subscription consent and cancellation; these are allegations, not a ruling.

Want to go further? Ask

On this page

This guide is part of our hub on telehealth payment processing. The general guide, for any business: how to get and keep a high-risk merchant account. General information, not legal advice.

The rules, by who sets them

Who	What they set	Where it bites
Visa and Mastercard	Merchant category code, registration, dispute thresholds, subscription rules	Monitoring programs, fines, termination
Your processor	Its restricted list, the documents it asks for, contract limits	Approval, reserves, closure
Federal law	Remote prescribing of controlled substances, subscription law, health data outside HIPAA	DEA and FTC enforcement
State law	Clinician licensing, corporate ownership, auto-renewal	Medical boards, attorneys general
Ad platforms	Certification and authorization to advertise	Ad account bans; see advertising

Tagada follows Visa and Mastercard rules and the laws that apply to payments.

Card network rules: telemedicine isn't a named category

Your acquirer assigns a merchant category code (MCC). For a consultation or a care plan, the closest codes are medical ones; for the medication itself, it's the pharmacy code1.

MCC	Visa's description1	When it fits
8011	Doctors and Physicians (Not Elsewhere Classified)	Practice of medicine by licensed physicians
8099	Medical Services and Health Practitioners (Not Elsewhere Classified)	Medical services with no more specific code
5912	Drug Stores and Pharmacies: "sell prescription and proprietary drugs"	You sell and ship the medication

The acquirer decides, not you. Visa's October 2026 manual doesn't contain the words "telemedicine" or "telehealth"1.

What changes when you sell the medication

Network	Telemedicine (consult, care plan)	Pharmacy (MCC 5122, 5912)
Visa Integrity Risk Program	Not in any tier2	Tier 1: registration with Visa before processing2
Mastercard	Not a registration category3	"Non–face-to-face pharmaceutical Merchants" must be registered; the acquirer verifies legality at least every 12 months3

Visa waives pharmacy registration for merchants accredited by NABP or certified under LegitScript's Healthcare Merchant Certification program2. That waiver applies to MCC 5122 and 5912, not to telemedicine. Who sells the medication, and on which account: charging the consultation and the medication separately, and the pharmacy side in online pharmacy payment processing.

Dispute thresholds

Program	Threshold
Visa VAMP (US merchants)	1.5% (fraud plus disputes ÷ settled transactions), at least 1,500 cases a month, since April 1, 2026 (Visa)4
Mastercard ECM	1.5% and at least 100 chargebacks a month (Chargeback Gurus)5

1.5%

Visa VAMP threshold for US merchants since April 1, 2026

1,500

Visa cases a month before the ratio applies

100

Mastercard ECM chargebacks a month, with the 1.5% ratio

Keeping disputes under these lines: chargebacks for telehealth companies.

What your processor checks

Stripe lists "Telemedicine and telehealth services" in its restricted businesses6. Restricted means "additional due diligence", with "proof of relevant licences or more details about your business model", and an approval that "may be modified or revoked by Stripe at any time"6.

Licensing
"Telemedicine businesses applying for a Stripe account typically need to provide items such as license numbers and information on your processes"7.
LegitScript
Not required by Stripe for telemedicine7. Google Ads and Meta do require it for ads, which is a separate question: LegitScript for ads and payments.
Scope
Stripe defines telemedicine as patient communication "that involves diagnosis or treatment"; education or wellness resources "aren't categorized as telemedicine"7.
Country
Stripe prohibits telemedicine in Mexico6.

Other underwriters ask for the same core file: entity documents, clinician licenses by state, your prescribing process, the checkout and its terms, refund policy and expected dispute rate. The full list: how to get a telehealth merchant account approved.

Clinician licensing and prescribing

The clinician must be licensed where the patient is. The Interstate Medical Licensure Compact speeds up state licenses for physicians; it covers 44 states, the District of Columbia and Guam8. It is not a national license.

For checkout, that means you must know the patient's state and sell only where your clinicians are licensed. State by state: is telehealth legal in my state?.

Watch out

Under the Ryan Haight Act, a controlled substance can't be dispensed online without a valid prescription, which requires "at least 1 in-person medical evaluation"9. The DEA's temporary flexibilities waive that in-person visit. As of November 2, 2026, they run through December 31, 202610. No later rule had been published that day.

Fig. 1Remote prescribing of controlled substances, and its deadline

Ryan Haight ActAt least 1 in-person medical evaluation
DEA flexibilitiesIn-person visit waived, temporarily
November 2, 2026No later rule published
December 31, 2026Flexibilities run through this date

Check the date again before each new offer.

21 U.S.C. § 829(e); DEA and HHS, 90 FR 61301, December 31, 2025.

Subscriptions and cancellation

Most telehealth brands bill a care plan or membership on a cycle. That is negative option billing, with federal, state and card rules.

Rule	Requirement
ROSCA	Material terms before billing details, express informed consent, "simple mechanisms" to stop charges (15 U.S.C. § 8403)11
Visa	Trial or introductory terms shown separately, a reminder at least 7 days before a trial ends, online cancellation for online sign-ups (Visa Rules)12
California	Express consent, acknowledgment, online cancellation for online sign-ups, annual reminder (Cal. Bus. & Prof. Code § 17602)13

What the FTC has targeted in telehealth

Date	Case	What the FTC says
July 29, 2026	FTC, Utah and California v. Hims & Hers (pending)	The FTC alleges consumers were enrolled in recurring plans "shortly after receiving consumers' intake forms", and that cancellation was made difficult "by hiding the cancellation button"14
April 15, 2024	FTC v. Cerebral (proposed order)	More than $7 million over data shared for advertising and cancellation promises not honored15

Checkout wording and billing steps: how to sell telehealth services on subscription. State rules on cancellation: cancellation compliance.

Health data and your payment stack

Keep clinical data out of your processor. Stripe's agreement says the user "must not provide Protected Health Information to Stripe" and is liable for any disclosure16.

HIPAA section 1179 exempts payment processing activities, including card payments for health care17. A processor that does more than process payments can fall outside that exemption.
No treatment in product names, descriptors or metadata sent to the processor.
Outside HIPAA, the FTC's Health Breach Notification Rule covers vendors of personal health records not covered by HIPAA, since July 29, 202418.
Ad pixels: both FTC cases above involve health data shared with advertising platforms14 15. See server-side tracking for telehealth companies.

Details: do I need a HIPAA BAA with my payment processor?.

Monthly compliance check

[ ] Visa and Mastercard dispute ratios, by offer, against 1.5%
[ ] Top 5 refund and dispute reasons
[ ] States served match the states where clinicians are licensed
[ ] Checkout terms, consent box and confirmation email match the live offer
[ ] Online cancellation path tested end to end
[ ] No clinical data in descriptors, product names, metadata or ad pixels
[ ] Prescribing rules re-checked against the DEA's current date
[ ] New offers declared to the processor before launch

Fig. 2One month's check, filled in

Compliance check · NovemberOne telehealth brand, consults and care plans

Visa and Mastercard ratios: Under the 1.5% line
Top 5 refund and dispute reasons: Reviewed
States served: Match clinician licenses
Checkout terms and confirmation email: Match the live offer
Online cancellation: Tested end to end
Clinical data: Medication name found in a descriptor
Prescribing rules: Re-checked against the DEA date
New offers: Declared before launch

Illustrative record, not real data.

The ratios are read against the 1.5% line; your processor acts well before.

Illustrative example.

How Tagada helps

Payments built around the rules above

TagadaPay runs "enhanced review for regulated verticals"19, with "native 3DS2, device intelligence, and rules engine: approve real customers, block the rest".

Subscriptions with retries and automatic recovery
Your vault, portable: "Switch processors without re-onboarding customers"
Routing across TagadaPay and processors such as Stripe, NMI and Airwallex, with a cascade to another processor when one is down or times out
Security: PCI DSS Level 1, SOC 2, ISO 27001, GDPR

Building the whole telehealth brand? Tagada Rx adds "US-licensed clinicians in the patient's state, e-prescribing, pharmacy routing", and "the card is only captured once a doctor approves". Per Tagada's docs, "Tagada never persists PHI", and the store runs on tgdcare.com, which is LegitScript certified. US patients only, by selection.

Apply for processing

Updated on November 2, 2026

Nick Bonnassies

CMO at Tagada

CMO at Tagada. Before Tagada, Nick built direct-to-consumer brands that generated over $115M in sales, raised over $25M in crowdfunding and sold two of them. He also works as a fractional CMO on marketing operations and AI systems.

Frequently asked questions

What MCC does a telehealth company use?

Usually a medical code: 8011 for physicians or 8099 for medical services not elsewhere classified. Your acquirer assigns it. If you sell and ship the medication yourself, the pharmacy code 5912 can apply, with Visa and Mastercard pharmacy rules on top.

Do Visa and Mastercard require LegitScript for telehealth?

No. Visa uses LegitScript certification as a waiver from pharmacy registration for MCC 5122 and 5912. Mastercard asks acquirers to verify a pharmacy's legality and doesn't name LegitScript. Neither program names telemedicine. Google Ads and Meta do require LegitScript for telehealth ads.

Does Stripe accept telehealth companies?

It can. Stripe lists telemedicine as restricted, reviews "each business on a case-by-case basis" and asks for license numbers and process details. It doesn't require LegitScript for telemedicine. Selling prescription medication is a separate question.

Can a telehealth company prescribe controlled substances online?

Federal law requires an in-person evaluation before a controlled substance is dispensed online. The DEA's temporary flexibilities waive it through December 31, 2026, as of November 2, 2026. Processors look closely at any controlled-substance prescribing.

Do I need a BAA with my payment processor?

Usually not, if it only processes payments: HIPAA section 1179 exempts payment processing. Stripe's agreement forbids sending it PHI. Keep diagnoses and treatments out of product names, descriptors and metadata.