Card-Not-Present Payments for Prescription and Compounded Medications

Card-not-present medication payments receive enhanced underwriting because an acquiring bank evaluates more than card fraud: prescription legitimacy, pharmacy licensing, product and claims risk, fulfillment, recurring billing, health-data handling, refunds, and disputes. No universal federal approval standard for these transactions was identified; the processor or acquirer makes a business-specific decision.

Card-not-present medication payments at a glance

Why do online prescription payments receive closer review?

Online prescription payment processing receives closer review because a transaction may involve a pharmacy, prescriber, prescription workflow, regulated product, and fulfillment chain. FDA BeSafeRx and Internet Pharmacy Warning Letter materials identify indicators associated with legitimate online pharmacies, including requiring prescriptions, providing U.S. contact information, making a licensed pharmacist available, and holding appropriate state-board licensure.

Those FDA indicators are not payment-card rules. They are compliance signals an underwriter may use to understand the seller and dispensing process. FDA materials also identify concerns involving unapproved prescription drugs, sales without prescriptions, inadequate directions for safe use, and missing required warnings.

A reviewer may ask which entity sells and dispenses the medication, how prescriptions are received and validated, when payment is captured, which pharmacy fulfills the order, and what happens when an order is delayed, refused, recalled, canceled, or disputed.

What does a CNP medication merchant account application require?

Applicants should generally prepare entity, ownership, licensing, product, prescription, fulfillment, marketing, privacy, refund, and dispute records. Exact requirements vary by acquirer, which determines the final underwriting packet.

• Legal-entity, beneficial-owner, address, website, and contact information.
• Pharmacy, facility, pharmacist-in-charge, and applicable state-license documents.
• A product catalog identifying prescription, compounded, controlled, and nonprescription categories where applicable.
• A clear description of the telehealth, prescriber, pharmacy, fulfillment, billing, and support roles.
• Prescription-validation, dispensing, order-release, cancellation, refund, recall, and support procedures.
• Screenshots showing prices, shipping, refund, renewal, consent, cancellation, and support disclosures.
• Evidence supporting health, efficacy, safety, and testimonial claims.
• Privacy materials, HIPAA role analysis, vendor list, and business-associate agreements where applicable.
• Breach-response, chargeback, refund, reshipment, and fraud-monitoring procedures.
• Business, prescriber, pharmacy, patient, and fulfillment locations.

Describe the actual products and business model accurately. Avoid vague labels such as “custom medication” or “wellness” when the transaction involves prescription or compounded drugs.

Can a processor require pharmacy and prescription documentation?

Yes. A processor can request documentation that helps evaluate pharmacy legitimacy, prescription controls, product status, and fulfillment. Payment authorization is not proof that a prescription is valid or that a pharmacy may dispense an order. The business should explain how incomplete or unacceptable prescriptions are stopped and how customers are notified and refunded when fulfillment cannot proceed.

State review remains necessary. The supplied federal sources do not establish a state-by-state licensing matrix. Verify pharmacy and nonresident-pharmacy licensing, prescriber licensing, telehealth, compounding, controlled-substance, privacy, automatic-renewal, cancellation, and consumer-protection requirements through the relevant official state authorities.

How should recurring prescription refills comply with federal rules?

Recurring prescription refills should disclose material terms before billing information is obtained, obtain informed consent to the negative-option feature, and provide a simple cancellation mechanism under the FTC’s Negative Option Rule, 16 C.F.R. Part 425. The FTC announced the final rule on October 16, 2024; confirm its current operative status and any later developments for the specific arrangement.

Show refill frequency, price, renewal timing, shipping or handling charges, and cancellation terms before payment. Keep affirmative-consent records. The supplied research does not establish whether every prescription-refill arrangement is covered or exempt, so counsel should analyze the structure.

What health-claim rules affect medication payment underwriting?

Health-related benefit and safety claims generally require competent and reliable scientific evidence under the FTC’s Health Products Compliance Guidance. The guidance applies to internet, social-media, testimonial, and expert-endorsement marketing.

The FTC’s Consumer Reviews and Testimonials Rule, including 16 C.F.R. Part 465, took effect October 21, 2024. Businesses must not create, buy, sell, or disseminate fake or false reviews; falsely imply that a person experienced a result; condition incentives on a particular sentiment; or conceal certain material connections. Patient stories cannot support claims the business could not make directly.

Maintain an evidence file for each claim and obtain appropriate medical, regulatory, or legal review before launch. This is a compliance consideration, not a promise of processor approval.

Does HIPAA apply to card-not-present healthcare transactions?

Ordinary card-processing activity generally does not automatically make a financial institution a HIPAA business associate. HHS explains that a financial institution conducting ordinary payment-card processing is generally not a business associate solely for that activity; HHS also includes billing, collection, claims management, and related activities within “payment.”

The merchant and other vendors may still have HIPAA obligations. Determine whether each party is a covered entity, business associate, neither, or subject to another federal privacy regime. Limit prescription, diagnosis, and treatment information in descriptors, receipts, email subject lines, analytics, processor metadata, portals, and support systems.

If unsecured PHI is breached, the HIPAA Breach Notification Rule, 45 C.F.R. §§ 164.400–414, generally requires notice without unreasonable delay and no later than 60 days after discovery. Breaches affecting 500 or more individuals require HHS notice no later than 60 days; smaller breaches may be reported annually, no later than 60 days after the calendar year of discovery.

A business outside HIPAA may still face the FTC Health Breach Notification Rule, 16 C.F.R. Part 318. The July 29, 2024 amendments addressed health apps and similar technologies, electronic notice, notice content, and reporting timing for breaches involving 500 or more individuals.

What federal payment rules remain unverified?

The approved sources do not establish a universal Visa or Mastercard threshold, reserve percentage, transaction cap, special high-risk fee, prohibited compounded-product list, or federal CNP medication surcharge rule. Confirm those matters directly with the selected acquirer. Federal sources also do not establish a complete state licensing framework.

What should a business do before requesting processing?

1. 1Define the legal seller, product categories, service footprint, and each party’s role.
2. 2Assemble pharmacy, facility, pharmacist, prescriber, and applicable state-license documents.
3. 3Document prescription receipt, validation, dispensing, fulfillment, recall, cancellation, and refund workflows.
4. 4Review claims, testimonials, recurring billing, privacy roles, and state requirements.
5. 5Map payment, portal, analytics, support, fulfillment, and health-data flows.
6. 6Prepare website screenshots, policies, projected processing information, and dispute procedures.
7. 7Ask the acquirer about product restrictions, descriptors, recurring charges, settlement timing, holds, limits, and required documents.
8. 8Submit a consistent packet and review the proposed agreement before accepting it.

Explore how MDLaunchr and WhiteLabelClinic.com can support a compliance-first telehealth launch.

MDLaunchr is the brand behind WhiteLabelClinic.com, a white-label telehealth infrastructure platform. It is one platform in this category—not a processor, pharmacy, treating clinician, regulator, or guarantor of approval—and helps qualified businesses evaluate and coordinate technology, operational, compliance, clinical-network, and fulfillment relationships.

Questions to ask your processor

• What pharmacy, facility, prescriber, product, and state-license documents are required?
• Are prescription, compounded, or controlled-medication transactions subject to separate review?
• When may payment be authorized or captured relative to prescription approval and dispensing?
• What disclosures, consent records, cancellation process, and refund controls are required for recurring charges?
• What descriptor and receipt fields are permitted for healthcare transactions?
• What holds, settlement timing, limits, monitoring conditions, or dispute requirements apply?

Source notes

The federal claims in this article are based on the following approved sources:

• FDA, “Internet Pharmacy Warning Letters”: https://www.fda.gov/drugs/drug-supply-chain-integrity/internet-pharmacy-warning-letters
• FTC, “Health Products Compliance Guidance”: https://www.ftc.gov/business-guidance/resources/health-products-compliance-guidance
• FTC, “Consumer Reviews and Testimonials Rule Questions and Answers”: https://www.ftc.gov/business-guidance/resources/consumer-reviews-testimonials-rule-questions-answers
• FTC, “Negative Option Rule” materials: https://www.ftc.gov/news-events/news/press-releases/2024/10/federal-trade-commission-announces-final-click-cancel-rule-making-it-easier-consumers-end-recurring
• HHS, “Business Associates”: https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html
• HHS, “Standards for Privacy of Individually Identifiable Health Information”: https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/standards-privacy-individually-identifiable-health-information/index.html
• HHS, “Breach Notification”: https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html
• FTC, “Health Breach Notification Rule Basics for Business”: https://www.ftc.gov/business-guidance/resources/health-breach-notification-rule-basics-business

Clinical decisions belong to independently licensed clinicians following an individual evaluation. This article is for general educational and business-planning purposes, not legal or medical advice.

Related reading: the full guide this article belongs to, Practice Better Payments Alternatives for Prescribing Practices, How Long Does High-Risk Healthcare Merchant Account Approval Take?.