Telehealth Merchant Account Requirements: Underwriting Documents Checklist

There is no universal federal checklist for telehealth merchant accounts. The acquiring bank, processor, risk department, transaction model, and operating footprint determine what documents they request. A typical file explains who owns the business, what customers buy, how funds move, and whether the business can fulfill, refund, and document transactions.

Telehealth merchant account requirements at a glance

What documents should you organize before applying?

Treat the following as an underwriting-readiness file, not a guaranteed approval checklist. Requirements vary by business model and processor.

Which business identity documents do underwriters request?

Underwriters commonly request records establishing who controls the business, where it operates, and where funds will be deposited. Prepare:

• Articles of organization or incorporation
• EIN confirmation
• Ownership chart and beneficial-owner information
• Government-issued identification for owners, control persons, and authorized signers
• Operating agreement, partnership agreement, or bylaws
• Business and operating-address evidence
• DBA or assumed-name filings, where applicable
• Business bank-account information or a bank letter
• Names and roles of affiliated entities

Identify material participants such as medical groups, clinicians, billing entities, technology companies, and fulfillment partners. Explain whether the entity advertising the service is also the entity delivering it and receiving card payments.

What financial and processing records should you provide?

Financial records should show expected transaction behavior and, if available, prior performance. Organize:

• Expected monthly processing volume
• Average and maximum transaction size
• Expected refund, cancellation, and chargeback rates
• Prior processing statements
• Payer mix, such as direct pay, insurance, employer, or Medicare
• Fulfillment timeline and patient-support process
• Forecasts or contracts supporting projected volume, if requested

If the business has no processing history, provide a transaction-flow explanation: how customers arrive, what they purchase, when they are charged, when the service occurs, and how refunds or cancellations work.

Which clinical and licensing documents matter?

Clinical records should show who provides care, where clinicians are licensed, and what role the business plays. Depending on the model, prepare:

• Provider roster and professional licenses
• NPI information, where applicable
• Professional-entity, group-practice, or facility registrations
• Medical-director or supervising-provider agreements, where applicable
• Clinical-services agreements
• Insurance certificates, if requested
• Payer enrollment information, where applicable
• A matrix of patient and clinician states

Federal sources do not establish one nationwide telehealth authorization rule. Licensing, telehealth consent, professional-entity, corporate-practice, privacy, automatic-renewal, and board requirements can differ by state. Confirm each relevant jurisdiction with qualified counsel and the applicable regulator.

For Medicare-related revenue, Telehealth.HHS.gov guidance updated January 17, 2025 addresses appropriate codes, modifiers, modality information, location information, and documentation supporting reimbursement. It does not create a universal merchant-account checklist or determine approval.

What website and customer-payment documents should be ready?

Processors may review the customer journey. Keep current copies or screenshots of:

• Terms of service
• Privacy notice and notice of privacy practices, where applicable
• Pricing and fee disclosures
• Refund and cancellation policy
• Recurring-billing authorization and renewal terms
• Telehealth or informed-consent flow
• Customer-service contact details
• Fulfillment and delivery terms
• Sample receipts, invoices, and email confirmations
• Billing-descriptor information

The checkout, receipt, card statement, contract, and application should consistently identify what the customer buys. For recurring charges, retain timestamped consent, price and frequency disclosures, cancellation logs, and refund records. The FTC’s recurring-subscription rule addresses material disclosures, express informed consent, misrepresentations, and cancellation; verify its operative status at publication.

Health-related advertising also needs substantiation. Under the FTC’s Guides Concerning the Use of Endorsements and Testimonials in Advertising, 16 C.F.R. Part 255, health claims must be supportable and material connections should be disclosed. The FTC’s Consumer Reviews and Testimonials Rule, 16 C.F.R. Part 465, addresses fake or deceptive reviews and testimonials. Keep claim approvals, substantiation records, testimonial permissions, relationship disclosures, and review procedures.

What privacy and security records should a telehealth business prepare?

Prepare records showing what data reaches the payment workflow and which vendors can access protected health information:

• HIPAA applicability analysis
• Vendor list and data-flow diagram
• Business associate agreements, when applicable
• Security-risk assessment
• Breach-response and incident-notification procedures
• Encryption and access-control description
• Payment-page architecture
• Explanation of whether unnecessary PHI is excluded from payment fields
• Evidence that payment and health-data systems are separated where possible

HIPAA applies to covered entities and business associates based on their roles and activities; not every telehealth startup is automatically covered. HHS states that a financial institution processing card transactions or directly facilitating payment provides an ordinary financial service and is not a business associate for that payment activity alone. The analysis may differ when a vendor receives, stores, analyzes, or transmits PHI for a non-payment function.

Under the HIPAA Breach Notification Rule, 45 C.F.R. §§ 164.400–414, covered entities must notify affected individuals, HHS, and sometimes the media after a breach of unsecured PHI. Individual and HHS notices generally must be made without unreasonable delay and no later than 60 days after discovery; business associates notify the covered entity within the same outside period.

The FTC Health Breach Notification Rule, 16 C.F.R. Part 318, may also apply to certain health-app and personal-health-record businesses that are not covered by HIPAA. Classify the business model accurately instead of labeling the entire operation “HIPAA compliant.”

Can pharmacy or fulfillment activity change the document package?

Yes. Pharmacy, prescription, product, or fulfillment relationships can prompt questions about the actual seller, responsible professionals, funds flow, and delivery process. Prepare relevant partner agreements, licenses or registrations held by the responsible entity, fulfillment timelines, customer-support procedures, and an explanation of which entity charges and which fulfills. Do not imply that a provider license establishes pharmacy authority.

What can trigger additional underwriting review?

Limited operating history, recurring billing, remote patient acquisition, multiple legal entities, prescription fulfillment, or unclear refund and fulfillment timing can lead to additional questions. Approved research does not establish card-network thresholds, reserve percentages, fees, or telehealth-specific network rules. Ask the acquirer about current volume, chargeback, reserve, descriptor, recurring-billing, monitoring, refund, dispute, and settlement requirements.

How do you prepare a telehealth underwriting file?

1. 1Identify the transaction parties. State which entity advertises, contracts, charges, delivers the service, and receives funds.
2. 2Build the identity file. Gather ownership, beneficial-owner, EIN, address, identification, and banking records.
3. 3Describe transaction behavior. Document volume, ticket sizes, payer mix, refunds, cancellations, chargebacks, and fulfillment timing.
4. 4Assemble clinical records. Include licenses, NPI information, entity records, insurance, and the patient-and-clinician state matrix.
5. 5Map the customer journey. Connect checkout, payment, clinical delivery, support, refunds, cancellations, and fulfillment.
6. 6Document data responsibilities. Classify HIPAA and FTC Health Breach Notification Rule exposure and identify PHI and payment-data flows.
7. 7Preserve marketing records. Keep claim substantiation, testimonial permissions, relationship disclosures, and review procedures.
8. 8Reconcile the package. Make the website, contracts, receipts, billing descriptor, bank account, and application describe the same transaction.
9. 9Ask the acquirer for current requirements. Confirm documentation, reserves, recurring billing, monitoring, disputes, and settlement terms.
10. 10Submit an indexed file. Use dated records and redact unnecessary patient information.

Download the healthcare underwriting checklist

MDLaunchr is the brand behind WhiteLabelClinic.com, a white-label telehealth infrastructure platform designed to help qualified businesses evaluate and coordinate technology, operational, compliance, clinical-network, and fulfillment relationships. It is not a processor and does not guarantee approval, rates, reserves, settlement terms, or account availability. Clinical decisions belong to independently licensed clinicians.

Questions to ask your processor

• Which legal entity must apply, receive funds, and appear on the cardholder statement?
• Which ownership, identity, banking, licensing, and processing-history documents are required?
• What volume, ticket, refund, chargeback, and recurring-billing information should be provided?
• What reserve, delayed-settlement, or funding terms could apply?
• Which website pages, receipts, descriptors, and cancellation records must be submitted?
• What are the current rules for monitoring, refunds, disputes, recurring billing, and termination?
• Is a business associate agreement required for any data flow beyond ordinary payment processing?

Explore how MDLaunchr and WhiteLabelClinic.com can support a compliance-first telehealth launch.

Related reading: the full guide this article belongs to, Jane App Payments Alternatives for Prescribing Practices, SimplePractice Payments Alternatives for Prescribing Practices.