To get a U.S. telehealth merchant account, you need to prove state licensure for any provider who prescribes, show HIPAA protections backed by a signed Business Associate Agreement, supply three months of bank and processing statements, and document pharmacy or DEA arrangements if your platform dispenses controlled substances. Underwriters will also reclassify your account under a high-risk merchant category code, scrutinize your chargeback history, and may require a reserve before approval.

TL;DR:

  • Platforms that do not prescribe face lighter paperwork, while pharmacies need state licenses, electronic claims capability, LegitScript certification, and heightened card network monitoring.
  • Hybrid businesses should identify who writes, verifies, and ships prescriptions; vague workflows prompt extra questions, and each state license or pharmacy agreement adds review time.
  • Initial review can take one to five business days after completion, while multi state models take longer; answer requests within 24 to 48 hours.
  • New businesses without three months of processing history face closer scrutiny or higher reserves, while chargeback or refund spikes can increase reserves or pause payouts.
  • Hosted checkout keeps cardholder data off your servers, reducing PCI scope; visit timestamps, consent records, and access logs help defend disputes.
Davincipay
Support for Telehealth Payment Reviews
DavinciPay supports telehealth businesses with acquiring relationships, payment gateways, fraud prevention, chargeback mitigation, and underwriting support.
Explore payment solutions

Table of Contents

Underwriting Checklist: Documents and Evidence Underwriters Expect

Underwriters build their decision on paper, not promises. Every document you submit either answers a risk question or raises one, so the goal is to remove every open question before you apply.

Start with business identity. This confirms who actually controls the business and who is legally accountable if something goes wrong.

Financial history comes next. Expect to provide three consecutive business bank statements and three consecutive processing statements, even if your company is new. Specialist underwriting teams rely on this window to judge cash flow stability and prior processing behavior, and a newer business without this history will usually face closer review or a higher reserve. Recent tax returns may be requested if your revenue or risk profile warrants a deeper look.

Licensure and clinical credentials matter more for telehealth than almost any other vertical. You’ll need state medical licenses for every state where your providers practice, National Provider Identifier (NPI) numbers, supervising physician letters where required, and DEA registration for any provider prescribing controlled substances. CMS continues to defer to state-by-state licensure requirements for telehealth providers, so a license valid in one state does not cover a patient located in another.

Operational agreements prove your model actually works the way your application describes it. If you fulfill prescriptions, you need written pharmacy fulfillment agreements, documented prescription verification workflows, and NCPDP or pharmacy EDI capability where applicable.

Compliance documentation closes the loop. This includes written HIPAA policies, signed BAAs with your processor and any cloud service provider, a PCI Attestation of Compliance or Self-Assessment Questionnaire, and LegitScript certification status if your model involves dispensing medication. LegitScript guidance notes that card networks expect telehealth and pharmacy merchants to document licensure and fulfillment agreements as a baseline compliance expectation.

Finally, underwriters check your website and your risk controls:

  • Provider license numbers, NPI, and clear contact information displayed on your site
  • Prescription disclaimers and sample patient consent forms
  • Visit logs that timestamp when a consultation actually occurred
  • A documented refund and cancellation policy
  • A written chargeback handling process with evidence retention steps

Pro Tip: Build a single shared folder with every document above before you start your application. Missing paperwork is the single most common cause of underwriting delays.

Requirements by Telehealth Model: Prescribing, Non-Prescribing, and Pharmacy Fulfillment

Not every telehealth business carries the same underwriting burden. What you need depends entirely on whether you prescribe, dispense, or simply connect patients to providers.

Non-prescribing telehealth platforms, such as mental health counseling or general wellness consultations, face a lighter documentation load. Underwriters still expect HIPAA compliance, PCI validation, and standard know-your-customer business verification, but there’s little to no pharmacy or DEA paperwork involved.

Prescribing telehealth businesses carry more weight. You must hold valid state licenses where your providers practice, register with the DEA if any provider prescribes controlled substances, and supply supervising physician documentation along with signed pharmacy partner contracts.

Online pharmacy and fulfillment operations face the strictest scrutiny of all three models:

  • Current pharmacy licensure in all states served
  • NCPDP or pharmacy EDI readiness to process prescription claims electronically
  • LegitScript certification, which card networks typically expect for dispensing models
  • Heightened card-network monitoring given the fraud history associated with online medication sales

Hybrid platforms that both prescribe and fulfill need to prepare both document sets and be explicit in their application about exactly how the workflow connects: who writes the prescription, who verifies it, and who ships the medication. Vague descriptions of a hybrid model almost always trigger additional underwriting questions, so clarity upfront saves time later.

Website, Data Flow, and Operational Compliance Underwriters Check

Underwriters don’t just read your documents. They look at your live website and your systems to confirm the paperwork matches reality.

A payment processor that creates, receives, maintains, or transmits protected health information on your behalf is legally a business associate under HHS guidance, requiring a signed Business Associate Agreement. The same rule extends to cloud service providers: HHS guidance on cloud computing confirms that a cloud vendor handling ePHI is a business associate even if it does not hold decryption keys; hosting providers and backup services thus need BAAs.

Before you apply, map your data flow. Know exactly who touches ePHI, where cardholder data is stored, and which vendors need a BAA versus which only need a standard data processing agreement. This map becomes useful evidence during underwriting review.

Separate paths for health and card data

Reducing PCI scope makes the review easier. A hosted checkout or tokenized payment page keeps cardholder data off your servers entirely, which shrinks the compliance burden you need to prove. Practical guidance on cutting PCI scope with hosted checkout walks through how small healthcare businesses can present this evidence clearly.

Your systems also need to generate evidence that supports dispute defense later:

  • Audit logs showing who accessed patient records and when
  • Visit-start timestamps proving a consultation actually happened
  • Signed informed-consent records tied to each patient visit
  • EHR and payment gateway integration logs that corroborate billing events

On the website itself, underwriters check for provider license disclosures, visible NPI numbers, clear patient-facing refund and privacy policies, and marketing claims that match what your license actually allows you to do.

Pro Tip: If your platform sends appointment reminders by text, confirm your texting workflow is HIPAA-compliant before you apply; guidance on HIPAA-compliant texting covers the BAA, encryption, and consent requirements underwriters expect to see.

Payment-Processing Variables Underwriters Evaluate

Beyond documents, underwriters evaluate how your business behaves as a merchant account once it’s live, and several specific metrics shape both approval and terms.

Card networks classify telehealth and pharmacy merchants under specific merchant category codes, and LegitScript’s compliance guidance notes that Visa and Mastercard expect card-not-present pharmaceutical merchants to register under high-risk MCCs as a compliance measure, which brings closer monitoring regardless of how clean your business actually is.

Underwriters also track a handful of recurring metrics:

  • Chargeback rate relative to total transaction volume
  • Refund frequency and the reasons patients cite
  • Average ticket size and whether it matches your stated business model
  • Recurring billing patterns, since subscription telehealth draws extra scrutiny on cancellation handling

Reserve logic follows directly from these numbers. A rolling reserve holds back a percentage of your revenue for a set period as a buffer against disputes, and a spike in chargebacks or refunds can trigger an increase in that reserve or, in worse cases, a temporary hold on payouts.

Know-your-customer and anti-money-laundering checks round out the process. Banks verify beneficial ownership down to each principal holding meaningful equity, and incomplete ownership documentation is one of the most common reasons an otherwise strong application stalls. The fastest way to move past this step is to have ownership documents, licenses, and signed consent records ready before the bank asks.

Preparing Your Application: Sequence, Timeline, and Expected Costs

A telehealth merchant application moves faster when you follow a deliberate sequence rather than submitting documents as they become available.

  1. Gather every license, NPI number, and DEA registration tied to your prescribing providers first, since these take the longest to verify.
  2. Pull three consecutive months of business bank statements and processing statements.
  3. Finalize your signed BAAs with any processor or cloud vendor touching patient data, along with written pharmacy fulfillment agreements if you dispense medication.
  4. Submit your application to a processor experienced in telehealth underwriting rather than a generalist acquirer.
  5. Respond to follow-up requests within 24 to 48 hours to keep your file moving.

Initial review with a specialist processor can take as little as one to five business days once your file is complete. Multi-state prescribing models or pharmacy fulfillment arrangements typically take longer, since each additional state license or pharmacy agreement adds a verification step.

Budget for a handful of recurring cost items: application and setup fees, LegitScript certification if your model requires it, any PCI remediation work needed to close gaps, and a reserve percentage held against early transaction volume. A processor that specializes in telehealth can shorten this entire timeline by knowing exactly which documents a bank will ask for before the bank asks.

How a Specialist Payments Provider Packages Approvals and Manages Risk

We built our underwriting process around the reality that telehealth merchants get rejected or delayed for predictable, fixable reasons, not because the business model is inherently too risky to approve.

We support telehealth merchants with acquiring relationships built for regulated healthcare models, gateway integrations that handle tokenized card data, BAA support for the payment processing relationship itself, and chargeback mitigation tools designed around the dispute patterns telehealth businesses actually see.

Before your file ever reaches a bank, we review and format your licensure package, confirm your pharmacy agreements are complete, recommend PCI-scope reduction options like hosted checkout, and negotiate reserve terms on your behalf rather than leaving you to accept whatever the first offer says.

A few things we do before submission:

  • Audit your document set against what the underwriting bank will actually ask for
  • Flag missing state licenses or expired DEA registrations before they cause a decline
  • Confirm your BAA language covers payment processing and gateway handling of ePHI
  • Recommend the MCC and account structure that fits your specific model

This groundwork is what separates a fast approval from a stalled application sitting in a review queue for weeks.

Author Perspective: Prioritized Fixes That Unblock Approvals

Most telehealth applications don’t get rejected for being high-risk. They get delayed because of gaps that are simple to fix if you catch them early. If I had to rank the fixes that matter most, a signed BAA and complete state licensure documentation come first: underwriters flag these before they look at anything else.

Visit timestamps and consultation logs come second. They’re the single strongest piece of evidence against a “service not received” chargeback, and most platforms don’t capture them until after a dispute forces the question.

Third, use hosted checkout or tokenization and bring that evidence to your application instead of waiting for an underwriter to ask about PCI scope.

— Peter

How DavinciPay.ai Helps Telehealth Businesses Get Approved

We built our telehealth payment processing service to help address common gaps that slow other applications down.

Davincipay

If you’re ready to start, visit our telehealth payment processing page and have your EIN, state licenses, DEA registration if applicable, three months of bank and processing statements, and signed BAA drafts ready to go. You can also apply directly through Apply Now to begin onboarding.

Before you submit anywhere, consider requesting a pre-application review to help identify missing documents and licensure gaps early, potentially speeding up the approval process.

This article is general information, not a substitute for advice from a qualified doctor. Consult a qualified healthcare professional about your own circumstances before acting on anything here.

FAQ

What are the CMS guidelines for telehealth billing in 2026?

CMS continues to defer to state-by-state licensure requirements for telehealth providers rather than setting a single national standard. The flexibility allowing providers to deliver telehealth from home without listing a home address on Medicare enrollment, originally introduced during the COVID-19 public health emergency, was made permanent, but providers remain responsible for meeting each state’s own licensure rules.

What is required for a merchant account?

A telehealth merchant account requires proof of business identity (EIN, articles of incorporation, ownership documentation), three months of bank and processing statements, and signed compliance documents including a HIPAA Business Associate Agreement with your processor. Providers who prescribe also need state medical licenses and, for controlled substances, DEA registration.

What are the five basic requirements for telemedicine?

Common requirements include state medical licensure where the patient is located, HIPAA-compliant data handling with signed BAAs, verified provider credentials such as NPI numbers, documented patient consent and visit records, and, where applicable, DEA registration for prescribing controlled substances.

Who is eligible for a merchant account?

Any legally registered business with verifiable ownership, a functioning EIN, and documentation supporting its operating model is generally eligible to apply for a merchant account. Telehealth businesses face additional eligibility checks around licensure, HIPAA compliance, and pharmacy or DEA documentation depending on whether they prescribe or dispense medication.

Sources