Telehealth Payment Processing: Why Merchant Accounts Get Frozen, and How to Get Approved

Why healthcare payments are different

The card networks treat online pharmacy and telemedicine as high-integrity-risk categories. Under Visa's Integrity Risk Program and Mastercard's Business Risk Assessment and Mitigation program, an acquiring bank can't simply board a prescription-product merchant: it must register the merchant with the network, carry ongoing monitoring obligations, and face network fines if the merchant turns out to be selling illegally. That registration burden, not squeamishness, is why most processors' acceptable-use policies simply prohibit the category.

Registration is also where certification stops being optional. As of August 2026, the practical standard for registering a U.S. pharmacy or telemedicine merchant is third-party verification: LegitScript certification or, for pharmacies, NABP accreditation. The acquirer needs an independent party to have verified that your licenses are real, your prescribing model is lawful, and your catalog is clean, because the acquirer is the one the network fines if it isn't.

Merchant category codes make the classification concrete: MCC 5122 (drugs and druggists' sundries) and MCC 5912 (drug stores and pharmacies) are the codes that trigger the registration requirement. Some merchants try to dodge the issue by boarding under a generic wellness or services code. That's called MCC misclassification, and it converts a paperwork problem into a terminated account when the processor's transaction monitoring catches it.

The chain of custody runs: card network rules bind the acquirer, the acquirer's risk team binds you, and certification is the document that satisfies both. Getting certified before applying for processing is doing the underwriter's job for them.

How accounts actually die

The most common failure isn't rejection at signup. It's approval under a mismatch, followed by discovery. A brand launches on a mainstream processor as a supplement or wellness store, adds prescription products later, and runs fine for months. Then a routine review, a cardholder dispute mentioning medication, or an automated crawl of the site surfaces the mismatch, and the standard playbook fires: funds held, a rolling reserve imposed, then termination.

Shopify Payments is the sharpest example because so many health brands start there: its terms prohibit prescription products outright, so a storefront selling Rx through Shopify's native processing is one review away from a freeze regardless of how compliant the clinical model is. Stripe, PayPal, and Square similarly restrict pharmaceutical and telehealth categories without prior written approval. None of this is hidden; it's in each platform's published acceptable-use terms.

Termination has a long tail. Terminated merchants can be listed on MATCH (the Mastercard Alert to Control High-risk Merchants list), which acquirers check during underwriting; a MATCH listing typically persists for five years and makes every subsequent application harder. This is why the cheapest possible time to fix your payments architecture is before the first freeze, not after.

What underwriters actually look for

A high-risk underwriting file is a coherence check between three things: what your corporate documents say, what your website shows, and what your processing history proves. The specific items that decide approvals:

• Certification or accreditation in hand (LegitScript for telehealth and pharmacy; NABP for pharmacy), or at minimum a filed application with a clean readiness posture.
• Corporate identity that matches the website: legal name, physical address, and support contact visible on the site and identical to the application.
• Licensure documentation: the medical group's structure, provider licenses in the states you serve, and pharmacy partners' credentials.
• Honest billing mechanics: clear descriptors (patients recognize the charge), a findable cancellation path, and subscription terms disclosed before payment, which is also what the FTC's negative-option rules require.
• Chargeback posture: a dispute ratio under the network thresholds, and a story for how refunds, cancellations, and clinical declines are handled.
• A catalog an analyst can defend: no research chemicals, no unapproved peptides, no offerings the acquirer would have to explain to the network.

Underwriters read your website the way a certification analyst does. The same scan that predicts your LegitScript review predicts your merchant application, because the second is downstream of the first.

The approval path, in order

First, fix the site before anyone with a decision to make reads it: identity, disclosures, claims, catalog. Second, get the certification moving, because it's the gating document for everything after. Third, apply to acquirers that actually board the category (high-risk-experienced acquirers and the payment providers built on them), with the underwriting file assembled up front rather than dribbled out over deficiency emails.

Fourth, board honestly: correct MCC, accurate business description, descriptors that match your brand. Fifth, wire in the operational layer that keeps the account alive: dispute alerts and responses, decline-aware retry logic, and cancellation flows that resolve frustration before it becomes a chargeback.

Sixth, build redundancy. A single merchant account is a single point of failure for the entire business; serious telehealth operators run volume across multiple merchant accounts so that no one underwriter's decision can pause revenue. That's an architecture decision, and it's much easier to make before you need it.

Where Embed Care fits

Payments is one of the five engines Embed Care operates for partner brands. Launch on our rails and your program runs on established healthcare processing with multi-MID redundancy, automatic card updating, decline-aware dunning, and chargeback handling already in place, or bring your own merchant account and we plug into it. Either way, the storefront that faces the underwriter ships certification-ready, and you can verify that yourself: run your current site through our free Preflight scanner and read it the way a risk analyst will.