Your application has a second applicant in it.
Most telehealth founders read LegitScript's nine standards as a list of things their own company has to get right. Our Standard 7 post is about one of those.
Standard 4 is the standard about everyone else. It reaches the pharmacy that fills your prescriptions and makes that pharmacy's compliance status part of your review. If you signed with a compounding pharmacy because its pricing and turnaround were right, and nobody asked whether it was LegitScript certified or NABP accredited, there is an open question in your application that you did not put there.
What does Standard 4 say about the pharmacy?
LegitScript publishes its nine Healthcare Certification standards on its own site. The fourth is titled Affiliates and Partners, and the paragraph that matters here reads:
"A merchant's partners, defined as organizations essential to supporting the applicant's continuum of care, such as partner pharmacies responsible for the fulfillment of prescription medication to patients, are generally required to be LegitScript-certified or accredited by another recognized body, with limited exceptions permitted only at LegitScript's sole discretion."
Three things in that sentence set the terms. The requirement is "generally" imposed, so it is the rule and not the exception. The pass condition is LegitScript certification or accreditation by "another recognized body", and the standards page does not name the body. And the exceptions are "limited" and sit entirely in LegitScript's discretion, so you cannot plan around getting one.
The paragraph above it is wider. The affiliates it reaches "includes but is not limited to partner pharmacies, businesses or medical practices, supplying wholesalers, co-owned companies, staff, any associated medical personnel", and all of them "must be operating legally". The pharmacy is the partner this post is about because it is the one LegitScript itself names.
Which pharmacy does LegitScript mean?
The application checklist LegitScript publishes for Healthcare Certification is more specific than the standards page, and it is the document to read before you sign a pharmacy agreement. Its Partner Pharmacy Requirements section opens with a question: "Did you know all partner pharmacies are required to be certified through LegitScript, or be NABP-accredited?"
Then it defines the term. "A partner pharmacy is defined as a pharmacy utilized by an applying entity to fulfill and dispense prescription medication orders to/for patients of the applying entity."
That is a functional definition, not a contractual one. The pharmacy that ships semaglutide to your patients is your partner pharmacy whether you contract with it directly or reach it through a telehealth platform. If two pharmacies fill for you, by state or by product, both are in. The same checklist says that if your platform promotes or links to a third party provider group to perform telehealth, "the promoted URL is required to be certified", so the provider side carries the same duty.
What does LegitScript accept as a pass?
The checklist asks whether you have "searched and verified your partner pharmacy's LegitScript certification status", and then: "Is your partner pharmacy 'Certified' or 'Legitimate?'" The public lookup is LegitScript's Website Certification Status page, and those two words are two of the five categories in its classifications guide.
- Certified. "The website is LegitScript-certified, meaning it has been vetted through LegitScript's rigorous review processes and is monitored on an ongoing basis."
- Legitimate. "The applicable website is not LegitScript-certified, but has received accreditation or certification from other entities that LegitScript recognizes, such as the NABP."
- Unverified. A neutral descriptor for merchants that "have not been subjected to our certification or voluntary monitoring programs".
- Unapproved. Denotes "some problem with regulatory compliance or risk", including merchants "operating legally in one jurisdiction but not in others".
- Rogue. The merchant's "primary purpose is to engage in some sort of illegal, unsafe, or misleading activity".
Certified and Legitimate are the passing answers. Unverified is not a pass. It is the status of a pharmacy nobody has looked at yet, and the checklist's next sentence is about what happens when the answer is no.
The "recognized body" the standards page leaves unnamed is named twice elsewhere on LegitScript's site. The checklist says "NABP-accredited", and a LegitScript blog post from April 2026 says certified providers' "partner pharmacies must be LegitScript-certified or accredited by the National Association of Boards of Pharmacy". NABP's own site lists several accreditation programs, Digital Pharmacy, Compounding Pharmacy and Healthcare Merchant among them, and LegitScript's checklist does not say which it means. When a pharmacy tells you it is "NABP accredited", ask which program, and confirm with LegitScript's team rather than assuming.
What happens when the pharmacy is not certified?
The checklist does not say your application fails. It says this:
"If not, please confirm they are ready and willing to apply for their own certification. Pharmacies and medical providers partnered with applying merchants who are not LegitScript-certified must submit their own application for LegitScript certification within sixty days after the applicant's own certification, should they achieve it. Please note that the outcome of their compliance review may affect your own certification, if there is an active partnership."
Two clocks start in that paragraph. The first is sixty days from your approval for the pharmacy to file. The second has no fixed length: the pharmacy's review runs on its own schedule, and its outcome "may affect" yours for as long as the partnership is active. A pharmacy that fails its review while filling your prescriptions is a problem in your certification, not only in theirs.
That is also why the checklist asks for evidence when the pharmacy already passes: "Please be ready to present evidence of the partnership, or have the pharmacy representative email us to confirm this affiliation." A signed agreement, or a named person at the pharmacy willing to write to LegitScript, is part of the file.
Two more lines in the same document bear on a GLP-1 or peptide program. Under Affiliates, its list of "Common barriers" opens with "affiliations with merchants who facilitate the sale of unapproved drugs (ex: impermissible peptides or bulk drug substances)". Compounded drugs are not FDA approved, and what a 503A pharmacy may compound is bounded by the lists and conditions in our 503A and 503B explainer. A pharmacy compounding outside those bounds is your Standard 4 problem before it is anyone's product problem. And under Patient Services the checklist asks: "Does your platform facilitate the sale of compounded medications? If so, please complete each applicable tab within our compounding addendum template." The terms and conditions add that LegitScript may award "probationary certification" to "Applicants whose business models involve partnerships that, as determined in LegitScript's sole discretion, warrant increased monitoring". The partnership you chose can decide which kind of certification you get.
What does your website have to show about the pharmacy?
Our LegitScript FAQ hub answers "Do we need to name the pharmacy?" by saying the disclosure "should reflect the actual arrangement and applicable requirements". The terms and conditions every applicant agrees to are more concrete, and they are the text to build to.
Under Website Control: "If applicable, Applicant agrees that any website from which it accepts or facilitates prescriptions or dispenses drugs will allow patients to access the contact information for the actual dispensing pharmacy, including physical address, telephone number, and facsimile number. Applicant agrees to provide this same contact information to LegitScript."
So the question is not whether to name the pharmacy. It is where a patient on your site finds the dispensing pharmacy's physical address, telephone number and fax number. A pharmacy page, a block on the program page or a line in the patient FAQ all work. "Our partner pharmacy" with no name does not.
Standard 8, Transparency, carries the accuracy duty: practices and offers must be "accurate, transparent, and not misleading to patients or the public, including but not limited to any material detail regarding the pharmacy, pharmacy staff, medical practitioners, drugs, treatments, or financial transactions". A site that says "our 503B facility" when the contract is with a 503A compounding pharmacy has a Standard 8 problem on top of a Standard 4 one.
The same section of the terms contains the line that catches the most sites. "Applicant agrees that it will not link or otherwise refer Internet users to healthcare merchant or advertiser websites that are not approved by LegitScript." Naming the pharmacy is required. Linking to its storefront, if that storefront is not approved, is prohibited. A footer that says "fulfilled by" with a live link to an Unverified pharmacy site does the second while trying to do the first.
What if you change pharmacies later?
LegitScript's healthcare certification FAQ lists the changes a certified client should report to its certification team, and under business changes it names "Ownership", "Business operations" and "Partnerships". A new pharmacy is a reported change. It walks into the same Standard 4 test as the old one, and the dispensing pharmacy contact information on your site and in your file moves with it. The fulfillment side of a switch is in our compounded GLP-1 fulfillment guide. The certification side is shorter: look the new pharmacy up before you sign, collect the partnership evidence, update the contact block, and tell LegitScript.
What to do before you apply.
- List every pharmacy that fills prescriptions for your patients, and the provider group that writes them. Each is a partner in LegitScript's sense.
- Look each one up on LegitScript's Website Certification Status page. Certified or Legitimate passes. Anything else is a conversation before you sign.
- For a pharmacy that passes, get the partnership agreement and a named contact who will confirm the affiliation to LegitScript. For one that does not, ask in writing whether it will apply within sixty days of your approval, and decide whether that review is a risk you want running inside your certification.
- Put the dispensing pharmacy's physical address, telephone number and fax number where a patient can find them, and remove any link to a pharmacy site that is not approved.
- If the pharmacy compounds, read what it compounds against the current rules and be ready for the compounding addendum.
This is operational and web architecture guidance, not legal advice. LegitScript decides certification in its own discretion, and nothing here predicts its decision on your business or your pharmacy's. ToolBX Media is a LegitScript partner, and the partner inventory above is part of the readiness pass we run before a submission. Score your own site with the LegitScript readiness score, work through the web developer's checklist, or have us look at the storefront, the pharmacy handoff and the application together in a telehealth program fit review.
Common questions
Does my partner pharmacy have to be LegitScript certified before my telehealth business can be?
LegitScript's fourth certification standard says partners essential to the applicant's continuum of care, and it names partner pharmacies that fulfill prescriptions as the example, are generally required to be LegitScript certified or accredited by another recognized body, with limited exceptions at LegitScript's sole discretion. Its application checklist is blunter: all partner pharmacies are required to be certified through LegitScript or be NABP accredited. A pharmacy that is neither does not automatically sink your application, but the checklist says it must apply for its own certification within sixty days of yours, and that the outcome of its review may affect your certification while the partnership is active.
What counts as a partner pharmacy under LegitScript's rules?
LegitScript's application checklist defines a partner pharmacy as a pharmacy utilized by an applying entity to fulfill and dispense prescription medication orders to or for patients of the applying entity. That is the pharmacy that actually ships the medication to your patients, whether it is a compounding pharmacy, a mail order pharmacy or the pharmacy behind a telehealth platform you contract with. Standard 4 also treats partner pharmacies, supplying wholesalers, co-owned companies and associated medical personnel as affiliates whose conduct is part of your review, so if more than one pharmacy fills for your patients, each one is in scope.
What is the difference between Certified and Legitimate in LegitScript's website lookup?
LegitScript's classifications guide puts merchants and websites in five categories. Certified means the website is LegitScript certified, vetted through its review and monitored on an ongoing basis. Legitimate means the website is not LegitScript certified but has received accreditation or certification from another entity LegitScript recognizes, such as the NABP. Unverified is a neutral descriptor for a site that has not been through certification or monitoring, Unapproved denotes a regulatory compliance or risk problem, and Rogue means the merchant's primary purpose is illegal, unsafe or misleading activity. The application checklist asks whether your partner pharmacy is Certified or Legitimate, so those two are the passing results and Unverified is not one.
What happens if my pharmacy is not certified when I apply?
According to LegitScript's checklist, you should confirm the pharmacy is ready and willing to apply for its own certification. Pharmacies and medical providers partnered with an applying merchant who are not LegitScript certified must submit their own application within sixty days after the applicant's own certification, should the applicant achieve it, and the outcome of that review may affect your certification if the partnership is still active. In practice that makes the pharmacy's compliance a condition that runs on after your approval, so a pharmacy that will not commit to applying is a risk you are taking on with your own ad accounts and merchant account.
Do I have to name the pharmacy on my website?
LegitScript's Healthcare Merchant Certification Terms and Conditions say that, if applicable, any website from which the applicant accepts or facilitates prescriptions or dispenses drugs will allow patients to access the contact information for the actual dispensing pharmacy, including physical address, telephone number and facsimile number, and that the applicant will provide the same information to LegitScript. Standard 8 separately requires that any material detail regarding the pharmacy and pharmacy staff be accurate and not misleading. The same terms say the applicant will not link or refer visitors to healthcare merchant websites that LegitScript has not approved, so a link to an uncertified pharmacy's storefront is a different problem from naming the pharmacy.
What if I switch pharmacies after I am certified?
LegitScript's healthcare certification FAQ lists partnerships among the business changes a certified client should report to its certification team, alongside ownership and business operations. The new pharmacy walks into the same Standard 4 test as the old one, and the dispensing pharmacy contact information on your site and in your application has to change with it. Plan the switch as a certification event, not only a fulfillment event.
Sources
- LegitScript, Healthcare Certification, the nine certification standards including Standard 4, Affiliates and Partners, and the What You'll Need Before You Apply list checked 2026-10-28
- LegitScript, Healthcare Certification Application Checklist, document CHM-CE202-CHE-03, sections Affiliates and Partner Pharmacy Requirements checked 2026-10-28
- LegitScript, Healthcare Merchant Certification Terms and Conditions, sections Accuracy of Information, Website Control and Application Process checked 2026-10-28
- LegitScript, Healthcare Certification FAQs, Eligibility and Scope, Business Models and After You're Certified checked 2026-10-28
- LegitScript, Merchant and Website Classifications Guide, the five merchant and website categories checked 2026-10-28
- LegitScript, Website Certification Status lookup checked 2026-10-28
- LegitScript blog, Not All Women's Health Providers Are Created Equal, 20 April 2026, section on where medications come from checked 2026-10-28
- National Association of Boards of Pharmacy, Accreditations, the list of NABP accreditation programs checked 2026-10-28
- National Association of Boards of Pharmacy, Digital Pharmacy Accreditation checked 2026-10-28
Want this costed for your build?
Tell us what you already have and what is not working, and we will come back with the shape of the work and what drives the number.