Payments · Telehealth7 min readUpdated November 2, 2026

Is It Legal to Sell Telehealth Services Online?

Selling telehealth online is legal in the US if you follow six sets of rules: licensing, ownership, prescribing, health data, billing and ads.

Nick Bonnassies, CMO at Tagada · checked against 16 sources

Article summary

Legal, with rules

TL;DR

Yes. In the US, a telehealth brand can sell consultations, prescriptions and treatment plans online, as long as clinicians are licensed where each patient is, the business structure lets them practice, prescriptions follow federal and state rules, health data is protected, and subscriptions are billed and cancelled the way consumer law requires. Processors check each of these before approving you.

The Interstate Medical Licensure Compact covers 44 states, the District of Columbia and Guam; it speeds up state licenses, it isn't a national license.
Controlled substances sold online need a valid prescription; the default is "at least 1 in-person medical evaluation".
As of November 2, 2026, the DEA's temporary telemedicine flexibilities run through December 31, 2026.
Health apps not covered by HIPAA can fall under the FTC's Health Breach Notification Rule, in effect since July 29, 2024.
In 2024 the FTC's proposed order against Cerebral totaled more than $7 million, partly over cancellation practices.

Want to go further? Ask

On this page

This guide is part of our hub on telehealth payment processing. The general guide, for any business: how to get and keep a high-risk merchant account.

This page is general information about US rules as of November 2, 2026, not legal advice. Work with a healthcare attorney before launch.

The six rules a telehealth brand must follow

Area	The rule in one line	Source	Detail
Licensing	Clinicians licensed in the patient's state	AMA summary2, IMLC1	Legal by state
Ownership	In many states, only licensed professionals can practice medicine or employ the doctors	State law	Ownership and licensing
Prescribing	Federal rules for controlled substances, state rules for the rest	21 U.S.C. § 829(e)3, DEA4	Below
Health data	HIPAA for covered entities, FTC rule for others	HIPAA5, FTC6	HIPAA and payments
Billing	Clear terms, express consent, simple cancellation	ROSCA7, California8	Cancellation compliance
Advertising	LegitScript and platform authorization for Google and Meta	Google11, Meta12	Advertising

Fig. 1Six rules, one line each

Licensing
Clinicians licensed in the patient's state2.
Ownership
In many states, only licensed professionals can practice medicine or employ the doctors.
Prescribing
Federal rules for controlled substances, state rules for the rest3.
Health data
HIPAA for covered entities, FTC rule for others5 6.
Billing
Clear terms, express consent, simple cancellation7.
Advertising
LegitScript and platform authorization for Google and Meta11 12.

Processors check each of these before approving you.

AMA; IMLC; 21 U.S.C. § 829(e); 42 U.S.C. § 1320d-8; ROSCA; Google Ads and Meta ad policies.

Licensing follows the patient

The medical act takes place where the patient is: states require "licensure in the state where the patient is located", as the AMA summarizes2. In practice, a clinician licensed in one state generally needs a license, or a state exception, to treat a patient located in another.

The compact helps, not replaces: the IMLC "offers a voluntary, expedited pathway to licensure for physicians who qualify" across 44 states, the District of Columbia and Guam1.
Some states issue telemedicine-specific licenses or registrations (AMA summary)2.
At checkout, this means knowing the patient's state and serving only the states your clinicians cover.

State by state: can you offer telehealth across state lines?

Ownership: who can employ the clinicians

In states that apply the corporate practice of medicine doctrine, a company owned by non-physicians can't practice medicine or employ doctors to do so. Founders commonly use a physician-owned medical group plus a management services organization (MSO) they own. The doctrine varies widely by state.

How the structure works and which licenses each party needs: who can own a telehealth company.

Prescribing and controlled substances

Federal law sets one hard line. "No controlled substance that is a prescription drug [...] may be delivered, distributed, or dispensed by means of the Internet without a valid prescription", meaning one issued by a practitioner who "has conducted at least 1 in-person medical evaluation of the patient"3.

Watch out

The DEA and HHS have extended temporary COVID-era flexibilities that allow remote prescribing of controlled substances without a prior in-person visit, under conditions. As of November 2, 2026, the fourth extension runs "January 1, 2026 through December 31, 2026"4. No permanent rule has been published yet. Don't build a checkout that depends on a rule with an end date.

Fig. 2Remote prescribing of controlled substances: the line and its exception

Federal lineAt least 1 in-person medical evaluation
January 1, 2026Fourth extension of the flexibilities starts
November 2, 2026No permanent rule published
December 31, 2026Fourth extension ends

The exception has an end date; the federal line doesn't.

21 U.S.C. § 829(e); DEA and HHS, 90 FR 61301, December 31, 2025.

Prescriptions for medicines that aren't controlled substances follow each state's rules on establishing a patient relationship. That is a question for your clinicians and counsel.

Health data

Two federal regimes can apply, and a third risk sits in your marketing stack.

Regime	Who it covers	What it requires
HIPAA	Covered entities and their business associates	Privacy and security of health information. Payment processing for a financial institution is exempt "with respect to such activities"5
FTC Health Breach Notification Rule	"Vendors of personal health records (PHRs) and related entities that are not covered by" HIPAA	Notify individuals, the FTC and sometimes the media after a breach6
FTC Act (pixels, tracking)	Any business	The FTC has acted against telehealth brands over health data shared with ad platforms9 10

Fig. 3Which data rule applies to your brand

Health dataTwo federal regimes, one marketing risk

HIPAACovered entities and their business associates
FTC Health Breach Notification RuleHealth records not covered by HIPAA
FTC ActAny business: pixels and tracking

The third risk sits in your marketing stack, not in your processor.

42 U.S.C. § 1320d-8; FTC Health Breach Notification Rule, 89 FR 47028; FTC press releases on Hims & Hers and Cerebral.

The FTC's 2024 proposed order said Cerebral shared data of nearly 3.2 million consumers with third parties through tracking tools10. Payment side: do you need a HIPAA BAA with your payment processor?

Billing and cancellation

Most telehealth brands sell memberships or treatment plans. Federal law applies to every online subscription.

Before billing details: "clearly and conspicuously discloses all material terms"7
Before charging: "express informed consent"7
To stop: "simple mechanisms for the consumer to stop recurring charges"7
California adds online cancellation for online sign-ups, reminders before longer trials convert and notice before price changes8

Example

On July 29, 2026, the FTC, Utah and California sued Hims & Hers. The FTC alleges the company enrolled consumers in recurring plans "shortly after receiving consumers' intake forms", that most consumers didn't get a consultation with a provider, and that cancellation was hidden. These are allegations in a pending case9.

Rules in detail: how to sell telehealth services on subscription.

What your processor will ask you to prove

Legality is the first thing underwriters check. Stripe says telemedicine applicants "typically need to provide items such as license numbers and information on your processes"13, and restricted approvals "may be modified or revoked by Stripe at any time"14.

Rule	What to have ready
Licensing	License numbers and states for each prescriber
Ownership	Entity documents, management agreement if you use an MSO
Prescribing	Your clinical flow: intake, review, when a prescription is issued or refused
Health data	Where intake data lives; proof nothing clinical goes to the processor
Billing	Checkout screens with price, frequency and cancellation
Ads	LegitScript certificate if you run Google or Meta ads

Next step: how to get a telehealth merchant account approved. The launch sequence end to end: how to start a telehealth company. If you'd rather not assemble clinicians, pharmacy and payments yourself, look at a telehealth stack with storefront, doctors, pharmacy and payments.

How Tagada helps

Payments reviewed as a regulated vertical

TagadaPay applies "Enhanced review for regulated verticals"16 and brings "Native 3DS2, device intelligence, and rules engine: approve real customers, block the rest."

Routing across TagadaPay and processors such as Stripe, NMI and Airwallex, with a cascade to another processor when one is down or times out
Your vault, portable: "Switch processors without re-onboarding customers"
Support: "24/7 human support on Slack Connect"

Your counsel still owns your brand's legal review.

Building a telehealth brand from scratch? Tagada Rx runs storefront, doctors, pharmacy and payments in one stack: "Independent clinicians review every case before any charge", a licensed US pharmacy ships direct to the patient, and stores run on tgdcare.com, which is LegitScript certified15. US patients only, by selection.

Apply for processing

Payments reviewed as a regulated vertical

Updated on November 2, 2026

Nick Bonnassies

CMO at Tagada

CMO at Tagada. Before Tagada, Nick built direct-to-consumer brands that generated over $115M in sales, raised over $25M in crowdfunding and sold two of them. He also works as a fractional CMO on marketing operations and AI systems.

Frequently asked questions

Is telehealth legal in all 50 states?

Yes, telehealth is legal in every state, but each state licenses its own clinicians and sets its own practice rules. Your clinicians must be licensed where each patient is located; the IMLC speeds this up in 44 states, the District of Columbia and Guam.

Do I need a license to start a telehealth company?

The company itself usually needs ordinary business registrations; the clinicians need medical licenses in each patient's state. In states with corporate practice of medicine rules, the ownership structure matters too. See ownership and licensing.

Can telehealth providers prescribe medication online?

Yes, within state rules. Controlled substances are stricter: federal law requires an in-person evaluation by default, and the DEA's temporary exceptions run through December 31, 2026, as of November 2, 2026.

Can a non-doctor own a telehealth company?

Often yes, through a structure where a physician-owned practice provides care and the founders' company provides management services. Whether that's required, and how, depends on the state. Get healthcare counsel before you sign clinician agreements.

What gets telehealth companies in legal trouble?

Recent FTC cases point to billing and data, not medicine: charges before a clinician reviews the case, hard-to-find cancellation, and sharing health data with ad platforms. Cerebral's 2024 order and the 2026 complaint against Hims & Hers (allegations) both cite ROSCA.