Telehealth website merchant underwriting is decided by a processor, acquiring bank, or payment facilitator using its own commercial, fraud, dispute, and compliance criteria. Reviewers commonly examine who sells the service, what customers purchase, healthcare claims, billing and cancellation terms, refunds, privacy disclosures, and data flows. No federal rule creates a universal approval checklist.
Telehealth website merchant underwriting at a glance
| Question | What to expect | Who sets it |
|---|---|---|
| How long does review take? | Confirm timing directly; no federal timeframe is established. | Processor or acquirer |
| What must the website show? | Merchant identity, service, pricing, contacts, terms, refunds, privacy, and clinical roles. | Processor or acquirer |
| What does it cost or hold? | Rates, reserves, fees, and transaction terms are not set by federal sources. | Processor or acquirer |
| What triggers concern? | Unsupported claims, unclear billing, inconsistent entities, weak refunds, or unexplained data flows. | Processor or acquirer |
| Are recurring charges allowed? | They require clear disclosures, affirmative consent, and a simple cancellation path under the Negative Option Rule. | FTC rule and processor |
| Are chargeback limits universal? | No universal federal threshold was identified. | Confirm with your acquirer |
What do payment processors look for on a telehealth website?
Processors commonly look for a coherent, verifiable description of the merchant and transaction. State the legal business name, customer-service contact, purchased service, pricing model, provider or medical-group role where applicable, jurisdictions served, and recognizable card-statement descriptor.
A technology or management company should not appear to diagnose, treat, prescribe, or promise clinical outcomes when licensed clinicians or a provider organization make those decisions. Distinguish administrative infrastructure from clinical care, and make the website agree with the application, bank account, invoices, provider agreements, ownership records, and fulfillment description. These are operational review points, not a federally mandated underwriting form.
What website claims can cause merchant underwriting concerns?
Unsupported or misleading health claims can create concern because Section 5 of the FTC Act, 15 U.S.C. §§ 41–58, and the FTC Health Products Compliance Guidance apply to website copy, digital content, social media, testimonials, influencers, and healthcare intermediaries.
Review headlines, images, medical terminology, before-and-after material, practitioner statements, and claims about safety, efficacy, treatment, prevention, or FDA approval. Health-related claims should be truthful, not misleading, and supported by appropriate scientific evidence. A disclaimer does not automatically cure a misleading overall impression.
The FTC’s Endorsement Guides, 16 C.F.R. Part 255, also apply to testimonials. Endorsers should have actually used the service, material connections should be disclosed, and testimonials cannot imply claims the advertiser could not make directly. Keep substantiation for material claims, document consent for patient stories, disclose paid relationships, and remove anonymous or unverifiable outcomes. Processor acceptance does not validate a healthcare claim.
Does a telehealth website need HIPAA privacy disclosures?
A covered healthcare provider required to provide a Notice of Privacy Practices should make it prominently available as required by 45 C.F.R. Part 164, Subpart E, including § 164.520. A general e-commerce privacy policy is not automatically a substitute.
Privacy language should match intake, scheduling, payment, communications, portal, and support workflows. Map which entities receive appointment, billing, payment, or health information. Under 45 C.F.R. § 164.506, HIPAA permits certain uses and disclosures for treatment, payment, and healthcare operations, subject to limits and protections; payment processing is not unrestricted permission to disclose health information.
Do not assume every payment vendor needs a business associate agreement. HHS explains that financial institutions conducting ordinary payment-card transactions generally are not business associates merely because they process consumer financial transactions. Document each vendor’s actual role.
Can analytics or tracking tools affect website approval?
Yes. Tracking tools can affect privacy and security review, especially on appointment, intake, authenticated, symptom, billing, or patient-portal pages. HHS states that tracking technologies in telehealth or patient areas may access protected health information, and a cookie banner alone is not a HIPAA authorization.
Inventory analytics, advertising pixels, session recording, chat widgets, forms, scheduling tools, portals, and checkout integrations. Determine what each tool receives, where data goes, and whether a business associate relationship or other permission is required. A June 20, 2024 court decision vacated part of HHS OCR’s guidance concerning certain IP-address disclosures from unauthenticated public webpages; that is not a blanket exemption for authenticated or patient-facing areas.
Maintain an incident-response process. Under the HIPAA Breach Notification Rule, individual notice generally must be provided without unreasonable delay and no later than 60 days after discovery. Breaches affecting 500 or more individuals require notice to the HHS Secretary within that period; smaller breaches may generally be reported annually. The FTC Health Breach Notification Rule may apply to certain health-data businesses outside HIPAA.
What recurring-billing information should a website show?
The checkout should state the price, billing interval, renewal terms, trial conversion, cancellation method, and refund limits before collecting billing information. Under the FTC’s Negative Option Rule, 16 C.F.R. Part 425, businesses must not misrepresent material facts, must disclose important information before billing, obtain unambiguous affirmative consent, and provide a simple cancellation mechanism that immediately stops recurring charges.
The FTC announced its final Click-to-Cancel rule on October 16, 2024. The Eighth Circuit vacated it on July 8, 2025, and the FTC’s March 11, 2026 advance notice of proposed rulemaking is a proposal, not a current requirement. The Restore Online Shoppers’ Confidence Act still requires clear disclosure of material terms, express informed consent, and a simple way to stop recurring charges. Keep terms versions, consent records, cancellation requests, refunds, and confirmation messages.
What refund policy should a telehealth merchant website include?
The refund policy should explain eligibility, request deadlines, duplicate-charge handling, missed appointments, failed intake, unused or partial services, cancellation timing, submission method, and expected processing time. Display it before payment and ensure support staff apply it consistently.
A no-refund policy does not eliminate disputes. Preserve service records, customer communications, refund decisions, and cancellation timing. No approved federal source establishes a universal healthcare refund rule or processor refund standard, so confirm acquirer-specific requirements directly.
Does CMS require a specific telehealth payment description in 2026?
The approved CMS source does not establish a specific website payment-description requirement. It does distinguish telehealth coverage and billing availability by service and provider type. CMS’s Telehealth FAQ CY 2026, updated October 15, 2025, states that certain therapy professionals could no longer furnish Medicare telehealth services beginning January 31, 2026, while certain rural health clinics and federally qualified health centers could continue billing specified non-behavioral-health services through December 31, 2026.
Do not promise that every service is reimbursable, covered by Medicare, or eligible for insurance payment. Distinguish self-pay from insurance-billed services and ensure public descriptions match the actual clinical and billing model.
What should founders do before applying?
- 1Identify the legal merchant, service sold, clinical entity, customer journey, billing schedule, and fulfillment responsibility.
- 2Reconcile the website with the application, bank account, invoices, provider agreements, ownership records, and statement descriptor.
- 3Test landing page through checkout; verify price, renewal, cancellation, privacy, and refund terms appear before payment.
- 4Audit health claims, testimonials, medical imagery, approval references, and substantiation records.
- 5Inventory forms, scheduling, portals, analytics, advertising tools, chat, session recording, payment integrations, and data recipients.
- 6Preserve terms versions, consent timestamps, cancellation records, support tickets, refunds, and change logs.
- 7Assess HIPAA roles, business-associate relationships, breach procedures, and applicable state requirements.
- 8Ask the processor or acquirer to confirm underwriting documents, descriptors, reserves, dispute procedures, prohibited-business policies, and recurring-billing requirements.
- 9Submit only when the website, application, contracts, and workflow describe the same business.
Download the healthcare underwriting checklist
MDLaunchr, the brand behind WhiteLabelClinic.com, is a white-label telehealth infrastructure platform—not a processor or acquirer. It helps qualified businesses evaluate and coordinate technology, operational, compliance, clinical-network, and fulfillment relationships. Explore how MDLaunchr and WhiteLabelClinic.com can support a compliance-first telehealth launch.
Questions to ask your processor
- What documents do you require for self-pay, insurance-billed, or subscription telehealth services?
- Which claims, clinical descriptions, or service categories require additional review?
- What recurring-billing disclosures, consent records, and cancellation evidence are required?
- How should the legal merchant, provider organization, platform, and fulfillment entities appear?
- What statement descriptor should customers see?
- What reserve, dispute, refund, transaction, or processing terms apply?
- Which privacy, security, tracking, or vendor documents should accompany the application?
- What website or business-model changes require re-underwriting?
Related reading: payment-processing resources.
Related reading: Boulevard Payments Alternatives for Prescribing Practices, Moxie Payments Alternatives for Prescribing Practices.
Written and reviewed by MDLaunchr's clinical and compliance team. We build white-label telehealth infrastructure for founders, creators, and healthcare operators—covering providers, pharmacy, technology, and compliance.
This article is for general informational and educational purposes only and is not medical, legal, or regulatory advice. It does not create a provider-patient relationship and should not be used to diagnose or treat any condition. Telehealth and compounding regulations vary by state and change over time—consult qualified legal, clinical, and compliance professionals before launching or operating a telehealth program.
Frequently asked questions
What do payment processors look for on a telehealth website?
They commonly review merchant identity, service description, clinical role, pricing, billing frequency, cancellation, refunds, privacy disclosures, contacts, claims, and consistency with the application.
How long does telehealth merchant underwriting take?
No federal timeframe is established. The processor or acquirer sets timing and may request additional business, ownership, clinical, fulfillment, or transaction information.
Do I need a HIPAA privacy policy for a telehealth payment processor?
A covered healthcare provider required to provide a Notice of Privacy Practices should make it available as required by HIPAA. A general privacy policy is not automatically a substitute.
Can a disclaimer fix an unsupported healthcare claim?
Not necessarily. The FTC evaluates the overall advertising impression, and a disclaimer does not automatically cure a misleading headline, image, or testimonial.
Does a no-refund policy prevent payment disputes?
No. It may set expectations, but it should be disclosed before payment and applied consistently. No refund policy eliminates disputes or guarantees processor approval.
Are merchant-account reserves or chargeback limits universal?
No. Approved federal sources do not establish universal reserve percentages, chargeback thresholds, or fees. Confirm current terms directly with the acquirer.
- Federal Trade Commission — Negative Option RuleHealth Products Compliance GuidanceAdvertisement EndorsementsFederal Trade Commission Announces Final Click Cancel Rule Making It Easier Consumers End Recurring
- U.S. Department of Health & Human Services — Breach NotificationBusiness AssociatesMay Covered Entities Provide HIPAA Npps ElectronicallyDisclosures Treatment Payment Health Care Operations
- Centers for Medicare & Medicaid Services — Telehealth FAQ Updated 10 15 2025
- Restore Online Shoppers’ Confidence Act (FTC)