Glossary

The telehealth glossary.

98 terms that decide how telehealth businesses get built, in plain English: the legal structure, the clinical rules, the pharmacy chassis, the certification layer, and the payments machinery. Each definition links to the guide that goes deeper.

Business & legal structure

MSO (management services organization): The non-clinical company in the standard telehealth structure: it owns the brand, technology, and operations, and provides them to a physician-owned practice under a management services agreement. It's how non-clinician founders and investors participate in healthcare without owning the medical practice itself.; The MSO model, explained; Also in: Founding without a license · Franchise vs platform: where the MSO sits
Friendly PC (professional corporation): The physician-owned professional entity that is the actual medical practice: it employs or contracts the clinicians, owns the patient relationships and records, and holds clinical authority. 'Friendly' refers to the cooperative relationship with the MSO, not to any reduction in the physician's legal responsibility.
PC owner (physician owner): The licensed physician who legally owns the professional corporation. The role is substantive rather than nominal: this person holds clinical authority, carries the professional responsibility, and is the reason the structure satisfies corporate-practice rules at all. Arrangements that treat the owner as a rented signature are the ones that fail under scrutiny, which is why the market prices the role as an ongoing engagement rather than a formality.; The MSO model, explained; Also in: What oversight actually costs
Fair market value (FMV) compensation: Paying for services at what those services are independently worth, rather than at a level that varies with the revenue they help generate. It matters in this structure because fee-splitting rules restrict sharing professional revenue with non-clinicians: flat or cost-plus management fees set at fair market value are the conservative pattern, while pure percentage-of-revenue fees draw scrutiny in strict states. How your management fee is calculated is a question for healthcare counsel, not a template.; The MSO model, explained; Also in: Founding without a license
Corporate practice of medicine (CPOM): The state-law doctrine that only licensed clinicians or clinician-owned entities may own medical practices or direct clinical care. Enforcement varies widely by state; multi-state telehealth programs structure for the strictest states they serve.; The MSO model, explained; Also in: Founding without a license · Franchise vs platform: the CPOM wrinkle
Management services agreement (MSA): The contract between the practice and the MSO defining the services provided and the fee. Fee design is the legally sensitive part: fair-market-value flat or cost-based fees are the conservative pattern where fee-splitting rules are strict.
Fee splitting: Sharing professional medical revenue with a non-clinician, restricted in many states. It's the doctrine that constrains how an MSO may charge a practice, and why percentage-of-revenue management fees draw scrutiny in strict states.
Standing order: A physician-signed order authorizing other staff to perform defined clinical actions under stated conditions without a case-by-case physician order. Common in med-spa and IV-therapy operations; must be lawful in each state where it's used, which certification reviewers ask about directly.
Telehealth vs. telemedicine: Often used interchangeably. Where distinguished, telemedicine means remote clinical care (diagnosis, treatment, prescribing) while telehealth is the broader umbrella including remote monitoring, education, and administrative services. Regulators' definitions vary by statute, so read each rule's own definition.
DTC (direct-to-consumer) healthcare: Care marketed and sold directly to patients, typically cash-pay and online, rather than reached through referrals or insurance networks. Modern lifestyle telehealth (weight loss, hormones, hair, skin) is predominantly DTC.
Cash-pay model: A practice that charges patients directly and doesn't bill insurance. It trades payer revenue for radically simpler operations (no credentialing with payers, no claims), transparent patient pricing, and product-like subscription economics; patients sometimes seek reimbursement themselves via superbills.
Superbill: An itemized receipt with the diagnosis and procedure codes a patient needs to seek reimbursement from their own insurer for care they paid cash for. It lets a cash-pay practice stay out of insurance networks while leaving patients a reimbursement path.
White-label telehealth: A clinic that runs under one company's brand while another company supplies or operates the clinical machinery behind it: licensed clinicians, pharmacy fulfillment, software, and compliance. Models range from software you operate yourself to fully operated stacks; the brand owner keeps the audience relationship and retail pricing.; White-label telehealth, explained; Also in: The economics of white-label telehealth · How to choose a platform
Telehealth business in a box: A turnkey package for launching a branded telehealth business without assembling the stack: clinicians, pharmacy, storefront, payments, compliance, and support from one platform. The test of a real one is whether prescribing, medication economics, and compliance are actually inside the box rather than left as your homework.; What the box has to include
Telehealth stack: The set of infrastructure layers a telehealth business runs on: legal structure, clinical supply, storefront software, pharmacy fulfillment, payments, labs, compliance tooling, marketing, and support operations. Founders either assemble the layers from specialist vendors or buy them as one operated platform.; The stack, mapped
1099 vs. W-2 clinicians: The two ways programs engage clinicians: independent contractors (1099) offer flexibility and lower fixed cost, while employees (W-2) offer schedule control and tighter integration. Classification is a legal test about control, not a preference, and several states scrutinize contractor status aggressively; clinician networks price partly on carrying that question for you.; Clinician network options
Malpractice insurance (telemedicine): Professional liability coverage for clinical care, written to cover telehealth modalities and every state the clinician serves. Programs verify that policies cover telemedicine explicitly, match the practice's state map, and name the right entities; premiums vary widely with specialty, volume, and history.
Tail coverage: The extension that covers claims reported after a claims-made malpractice policy ends, for care delivered while it was active. It is the exit cost of switching insurers or winding down a practice, and who pays for tail (the clinician, the group, or the platform) is a contract point worth settling up front.

Clinical & prescribing

Asynchronous telehealth: Care delivered without a live interaction: the patient completes a structured medical intake, and a licensed clinician reviews it later and decides, including prescribing where appropriate. Permitted for many conditions in many states; others require synchronous contact for some or all encounters.; State prescribing rules; Also in: How clinician networks handle async · An async-first network, reviewed
Telehealth modality rules: A state's rules about HOW an encounter may happen, as distinct from who may practice there. Every state requires a valid patient-practitioner relationship before prescribing and they differ on what creates one: some accept an asynchronous questionnaire reviewed by a clinician, others require synchronous audio-video for a first encounter or for particular drug classes. Because these rules vary by state and by drug, intake is a per-state matrix rather than one flow, which is why multi-state programs build a routing layer before they build volume.; State prescribing rules; Also in: Building the clinician network
Synchronous telehealth: Care delivered in a live interaction, by video or audio. Some states require a synchronous encounter to establish the patient-practitioner relationship or for particular drug classes, which is why national intake flows branch by state.
Patient-practitioner relationship: The legally required clinical relationship that must exist before prescribing. States differ on what establishes it via telehealth (asynchronous intake, video visit, or in-person exam), making this the single most consequential state-law variable in telehealth program design.
Informed consent (telehealth): The patient's documented agreement to receive care via telehealth, covering the modality's nature and limits. Many states require telehealth-specific consent language and its retention in the record.
Ryan Haight Act: The federal law generally requiring an in-person evaluation before controlled substances are prescribed via the internet, subject to telemedicine exceptions. Pandemic-era flexibilities and ongoing DEA rulemaking have repeatedly changed the practical posture; programs touching controlled substances verify the current status before building.
Full practice authority: State NP regulation allowing nurse practitioners to evaluate, diagnose, and prescribe independently, without a physician agreement. Roughly half the states grant it; the rest require collaborative or supervisory arrangements, which national programs maintain per state.
Collaborating physician: A physician holding the state-required collaboration or supervision agreement with an NP (or PA) in non-independent-practice states, with duties such as chart-review percentages or regular meetings where rules specify them. A real operational role; paper-only versions are a known enforcement target.; Building the clinician network; Also in: The NP founder's playbook · Oversight networks in the clinician directory
Medical director: The physician who owns a program's clinical governance: protocols, standing orders, quality review, and accountability to boards and reviewers. In the MSO structure this authority sits on the practice side.
IMLC (Interstate Medical Licensure Compact): An agreement among most states streamlining the process for qualified physicians to obtain additional state licenses. It eases multi-state coverage building; it is not a single national license.
Credentialing: Verifying a clinician's qualifications from primary sources: licenses in each state, DEA registration, board certification, work history, and screening for board actions and exclusions, refreshed on a cycle. Certification, payers, and partnership diligence all ask for the file.; The credentialing & licensing directory
eRx (electronic prescribing): Transmitting prescriptions electronically from prescriber to pharmacy over certified networks. Telehealth platforms integrate eRx-capable systems rather than building the rails; EPCS (electronic prescribing of controlled substances) adds identity-proofing and two-factor requirements for controlled medications.
EHR (electronic health record): The system holding the legal medical record: encounters, orders, messages, and documents. Telehealth programs need async review queues and state-aware routing more than hospital-grade breadth, but the record must be real, retained per state rules, and producible on demand.
Controlled substance schedules: The federal I-V classification of drugs with abuse potential, with state overlays. Practically for lifestyle telehealth: most GLP-1, hair, and skin medications are non-controlled, while testosterone is Schedule III, so TRT programs inherit the entire controlled-substance telemedicine framework.
Good-faith exam (GFE): The clinical evaluation a licensed practitioner must perform before certain treatments, most prominently in med-spa practice, establishing that the treatment is appropriate for that patient. Many med spas satisfy it via telehealth; which practitioners may perform it and how varies by state.; GFE services for med spas, compared; Also in: GFE networks in the clinician directory
Supervising physician: A physician responsible under state law for overseeing care delivered by other licensed practitioners in defined settings. Distinct from a collaborating physician (an NP arrangement) and from a medical director (an organizational role); which one a business needs depends on state rules and who delivers the care.
In-person exam requirement: A state rule requiring a face-to-face evaluation before telehealth prescribing generally or for specific drug classes. Most states allow the relationship to be established via telehealth for non-controlled medications, but the exceptions define which programs can run fully online in which states; verify per state, current-year.
DEA telemedicine registration: The federal registration pathway for prescribing controlled substances via telemedicine, layered on the Ryan Haight Act's framework. The rules have moved repeatedly since 2023 between temporary flexibilities and proposed special registrations, so treat any summary as dated and verify the current posture before building a TRT or other controlled-substance program.
Primary source verification (PSV): Confirming a clinician's credentials directly with the issuing source (licensing boards, schools, certifying bodies) rather than trusting copies. The verification layer inside credentialing, and what credentialing platforms automate.
Payer enrollment: Getting a clinician or practice admitted to an insurance network so care can be billed to that payer. Cash-pay telehealth skips it entirely, which is a large part of why the cash-pay model launches faster.
Store-and-forward: The regulatory name many state statutes use for asynchronous telehealth: clinical information (intake answers, images, history) is collected and reviewed by a clinician later rather than in a live encounter. Whether store-and-forward alone can establish a valid patient relationship for prescribing varies by state, which is why async program maps are state-by-state documents.; State prescribing rules
Originating site / distant site: Telehealth's geography terms: the originating site is where the patient is during care, the distant site is where the clinician is. Licensure generally follows the patient (the clinician needs authority to practice where the patient sits), which is the rule that turns a national DTC program into a 50-state licensing project.
Telehealth parity laws: State laws addressing whether insurers must cover telehealth visits (coverage parity) or pay them at in-person rates (payment parity). Details vary widely by state and payer; cash-pay programs are largely unaffected, which keeps their economics uniform across states.
NPI (National Provider Identifier): The 10-digit identifier U.S. clinicians and healthcare organizations use in administrative transactions. Founders meet it in credentialing, e-prescribing setup, and pharmacy paperwork; individual (Type 1) and organizational (Type 2) NPIs are separate records serving different roles.
PDMP (prescription drug monitoring program): A state-run database of controlled-substance dispensations that prescribers check, mandatorily in many states, before prescribing scheduled drugs. Formularies that avoid controlled substances entirely, as most lifestyle-telehealth menus do, largely stay out of PDMP workflows.
DEA telemedicine flexibilities: The temporary rules that have allowed prescribing certain controlled substances via telemedicine without a prior in-person exam, extended several times while DEA develops a permanent framework (including proposed special telemedicine registrations). The status moves; verify the current rule directly before building on it, with the Ryan Haight Act as the baseline the flexibilities modify.; The TRT guide's federal layer, dated
Surescripts: The dominant U.S. e-prescribing network connecting prescriber software to pharmacy systems. When a telehealth platform advertises integrated e-prescribing, routing over this network through certified eRx software is usually what is meant; brands access it through their clinical software, not directly.
Prior authorization: An insurer's requirement that certain drugs or services be approved before they are covered, worked through forms and clinical documentation from the prescriber. Branded GLP-1s under insurance are the classic case; cash-pay programs sidestep the process by not billing insurance, which is part of their operational pitch.

Pharmacy & compounding

Compounding: A licensed pharmacy preparing a customized medication (combining, altering, or formulating ingredients) for use where an FDA-approved product doesn't meet the need. Compounded preparations are not FDA-approved, which is what the required disclosures on selling surfaces say.; 503A vs 503B, explained; Also in: The compounding pharmacy directory
503A pharmacy: A traditional compounding pharmacy: compounds pursuant to prescriptions for identified patients, regulated primarily by state boards under USP standards. The chassis behind ship-to-patient telehealth models, usually as a multi-state network routed by patient location.; 503A vs 503B, explained; Also in: 503A operations in the pharmacy directory
503B outsourcing facility: An FDA-registered compounder operating under full cGMP that may produce batches without patient-specific prescriptions, including office stock for clinics. Created by the DQSA in 2013; bulk substances it compounds from must generally sit on the FDA's 503B bulks list.; 503A vs 503B, explained; Also in: 503B operations in the pharmacy directory
cGMP (current good manufacturing practice): The FDA's manufacturing quality framework covering facilities, processes, testing, and documentation. 503B facilities operate under it; traditional 503A pharmacies follow USP compounding standards instead, which is a core difference between the categories.
USP <795> / <797>: The United States Pharmacopeia chapters governing non-sterile (795) and sterile (797) compounding: environments, technique, testing, and dating. The quality language to use when diligencing a 503A partner.
Beyond-use date (BUD): The date after which a compounded preparation should not be used, set under USP rules; the compounding world's analog to an expiration date, typically far shorter than manufactured-drug dating. It drives fulfillment cadence for compounded programs.
Office stock: Medication inventory held by a clinic or practice for on-site administration rather than dispensed to a named patient, lawfully sourced from 503B outsourcing facilities. The pattern behind med-spa and IV-therapy supply, and one certification reviewers ask applicants to document.
Cold chain: Temperature-controlled storage and shipping from pharmacy to patient, required for many injectables including GLP-1s. A fulfillment-diligence item: packaging validation, transit-time limits, and what happens when a shipment sits on a porch in July.
Certificate of analysis (CoA): A document reporting the testing performed on a specific batch (identity, potency, sterility, endotoxins as applicable) and by whom. Serious compounding partners provide them; marketing claims about testing should trace to them.
NABP: The National Association of Boards of Pharmacy, the association of state pharmacy regulators. Its accreditation programs verify pharmacies; payment networks accept NABP accreditation or LegitScript certification for pharmacy merchants, and telehealth applicants' fulfillment pharmacies are expected to hold one or the other.; NABP vs. LegitScript
GLP-1: The drug class (glucagon-like peptide-1 receptor agonists, including semaglutide and tirzepatide) at the center of modern weight-loss telehealth. Post-shortage, compounded versions require documented patient-specific clinical need, and the marketing rules around them are among the strictest in the category.; Compounded GLP-1 compliance; Also in: GLP-1 retention benchmarks, sourced · The GLP-1 business in a box
Research use only (RUO): Labeling that a substance is for laboratory research, not human use. On a consumer-facing storefront it functions as a red flag, not a shield: certification and payments reviewers treat prominent RUO labeling with consumer checkout as evidence of unapproved-drug sales.; The products that sink applications
FDA Form 483: The written observations FDA investigators issue after inspecting a facility. Not a penalty in itself, but certification applications expect 483s disclosed when observations required corrective action, and a partner pharmacy's 483 history plus responses is fair diligence material.
Essentially a copy: The federal compounding standard barring pharmacies from compounding what is essentially a copy of a commercially available FDA-approved drug, outside a declared shortage. It is the doctrine that ended mass-compounded GLP-1s once the shortages resolved in 2025, and the line every compounded program's legal posture is argued against.; Compounded GLP-1s after the shortage
503B bulks list: FDA's list of bulk drug substances that 503B outsourcing facilities may compound with. Whether a substance is on, off, or nominated to the list determines what 503Bs can legally produce at scale; the GLP-1 entries have been the contested question of 2025-2026, so verify current status before relying on it.
Patient-specific compounding exception: The argument that a compounded formulation meaningfully differs from the commercial drug for an individual patient (dose, delivery form, added ingredients) and therefore isn't essentially a copy. Post-shortage GLP-1 compounding largely rests on it, documentation requirements are strict, and its outer limits are being actively contested by FDA and manufacturers.
Non-resident pharmacy license: The license a pharmacy needs from a state it ships into but isn't located in. A 'ships to all 50 states' claim is really a claim about holding ~50 of these; verifying a partner pharmacy's license map against your patient map is basic diligence.
PCAB accreditation: Pharmacy Compounding Accreditation Board recognition (administered by ACHC) that a compounding pharmacy meets quality standards beyond baseline licensure. A useful diligence signal when selecting compounding partners, distinct from LegitScript certification and NABP accreditation.
WAC (wholesale acquisition cost): A manufacturer's published list price to wholesalers, before discounts and rebates. It is the reference number behind branded-drug economics discussions; what a pharmacy or program actually pays sits in confidential contracts, so treat WAC as an index, not a quote.
PBM (pharmacy benefit manager): The intermediaries that administer drug benefits for insurers and employers: formularies, pharmacy networks, rebates, and claims. Cash-pay telehealth mostly routes around PBMs, which is why its medication pricing can be flat and disclosed while insurance drug pricing stays opaque.
Mail-order pharmacy: A pharmacy that dispenses by shipping rather than at a counter, the fulfillment mode behind most DTC telehealth. Operationally it means non-resident licenses for destination states, cold-chain handling where products need it, and delivery experience becoming part of clinical retention.
Telepharmacy: Pharmacy services delivered remotely: pharmacist verification, counseling, and dispensing oversight conducted via technology, regulated state by state. Distinct from mail-order fulfillment; telepharmacy is about where the pharmacist works, not where the package goes.
REMS (risk evaluation and mitigation strategy): FDA-required safety programs attached to certain drugs, ranging from extra communication to restricted distribution. A formulary decision point: a REMS drug can carry prescriber, pharmacy, or monitoring requirements an online program must be built to satisfy, or should avoid.

Certification & privacy

LegitScript certification: The healthcare merchant certification that payment networks and ad platforms use to verify telehealth and pharmacy businesses, covering nine published standards from licensure to website conduct. Applications run $975 per website (nonrefundable) plus $2,150 per year once certified, as of August 2026. LegitScript® is a registered trademark of LegitScript LLC; EmbedCare isn't affiliated with them.; The complete certification guide; Also in: Run the free readiness checker · How long certification takes
Preliminary certification: LegitScript certification granted to a business whose website is still under construction, based on staging access and a completion timeline, publicly verifiable while conditions are pending. One nuance: the seal code issues once conditions are met, so a preliminarily certified business can be legitimately certified without displaying a seal yet.
Adverse action disclosure: The certification application's broad history question: lawsuits, warning letters, consent agreements, monetary penalties of $2,000 or more, card-network fines, and FDA 483s that required corrective action, across a multi-year lookback. Disclosed history is generally workable; discovered history usually is not.
HIPAA: The federal law governing protected health information held by covered entities and their business associates: privacy, security, and breach rules. A marketing site that collects no PHI sits mostly outside it, but the moment intake data flows, the framework (and its BAA requirement for vendors) applies.
PHI (protected health information): Individually identifiable health information held by a HIPAA-covered entity or business associate. The operational line for telehealth marketers: identity plus health-condition interest, together, is the combination that turns routine analytics into a privacy event.
BAA (business associate agreement): The HIPAA-required contract with any vendor that touches PHI on your behalf, obligating it to protect the data. Ad platforms won't sign them for pixel data, which is the structural reason trackers don't belong on care surfaces.; Tracking pixels, HIPAA, and the BAA line; Also in: Which marketing tools sign BAAs: the matrix · Which payment platforms sign BAAs
HBNR (Health Breach Notification Rule): The FTC rule requiring non-HIPAA health apps and connected businesses to notify consumers when health data is disclosed without authorization, enforced since 2023 (GoodRx was the first action) and amended in 2024 to state its reach plainly. The FTC's main hook for pixel cases outside HIPAA.; Pixels, HIPAA, and telehealth
Tracking pixel: A snippet that sends page and event data, with identifiers, from your site to an ad or analytics platform. Defensible on general marketing pages behind real consent; the enforcement record is about pixels on intake, checkout, and authenticated surfaces.
Consent management: The banner-plus-blocking machinery that keeps non-essential trackers unloaded until a visitor opts in, and records the choice. The blocking half is the point: a banner over an already-fired pixel documents the violation rather than preventing it.
Probationary certification (LegitScript): A LegitScript certification tier with heightened monitoring and a higher published annual fee, applied where the certifier wants closer oversight. Functionally certified, but the tier itself signals conditions worth understanding before relying on it in partner diligence.
Restricted drug terms (Google Ads): Google's policy governing prescription drug names in ad text, keywords, and landing pages. In the U.S. (with Canada and New Zealand), certified advertisers may use them promotionally; keyword-targeting them requires certification anywhere it's allowed, and uncertified accounts naming them while promoting prescribing get disapproved.; LegitScript for Google Ads
Prescription drug services certification (Google): Google's healthcare certification for businesses promoting online prescribing, dispensing, or sale of prescription drugs, telemedicine providers included. Free to apply for, granted after third-party certification (LegitScript for U.S. telemedicine; LegitScript or NABP for pharmacies), and required before prescription-service ads can run.
Health sensitive-interest limits (Google Ads): Google's personalized-advertising rules for health: advertisers in health categories can't use Customer Match, remarketing lists, or lookalike audiences. Acquisition planning for telehealth builds on search intent and Google's predefined audiences instead.
Core setup (Meta): Meta's restricted data-sharing mode for ad accounts it categorizes as health-related: lower-funnel events like Purchase and Add to Cart stop being usable for optimization from the pixel and Conversions API. Since early 2025 it has reshaped telehealth acquisition toward lead forms, landing-page-view optimization, and first-party measurement.
Conversions API (CAPI): Meta's server-side event pathway, sending conversion data from your server instead of the browser pixel. For health advertisers it pairs with strict event sanitization: what may be sent is constrained by Meta's health-data rules and by your own privacy obligations, not just by what the API accepts.
Prior express written consent (TCPA): The written-consent standard U.S. law requires before automated marketing texts or calls: clear disclosure naming the seller, consent not conditioned on purchase, and easy revocation. Statutory damages run per message, which is why compliant SMS programs treat consent capture as infrastructure rather than a checkbox.
Claim substantiation (FTC): The FTC standard that health claims in advertising need competent and reliable scientific evidence before they are made, with required rigor scaling with the claim. In practice for telehealth marketing: model outcomes rather than promising them, keep an evidence file for every claim, and treat testimonials as claims needing the same support.; Advertising telehealth, compliantly
State gating: Serving patients only in states the program's clinician and pharmacy licensure actually reaches, enforced in the product (state selectors, address checks) rather than in fine print. Certification reviewers and ad platforms look for it; shipping everywhere on partial licensure is a shutdown pattern.

Payments

High-risk merchant: A merchant category the card networks require acquirers to register and monitor specially, with fines for boarding illegal actors. Online pharmacy and telemedicine are high-integrity-risk categories, which is why mainstream processors' terms exclude them and certification became the entry ticket.; Telehealth payment processing
MCC (merchant category code): The four-digit code classifying a merchant's business for the card networks; 5122 (drugs and druggists' sundries) and 5912 (drug stores and pharmacies) trigger pharmacy registration requirements. Boarding under a different code to avoid that is misclassification, and a common cause of terminations.
VIRP (Visa Integrity Risk Program): Visa's program requiring acquirers to register and monitor high-integrity-risk merchants. Pharmacy categories (MCC 5122/5912) sit in its highest-scrutiny tier per LegitScript's VIRP explainer, with a public-rule exemption for NABP-accredited pharmacies; telemedicine is not named in Visa's public rules and flows through acquirer policy, where LegitScript certification is the evidence commonly required for medicine-selling models. Mastercard's BRAM program is the counterpart.
MATCH list: Mastercard's database of terminated merchants (Member Alert to Control High-risk Merchants), checked by acquirers during underwriting; a listing typically persists around five years and must be addressed honestly in later applications. The long tail of an account termination.
MID (merchant identifier): The account ID under which a merchant processes cards. Multi-MID architecture spreads volume across several merchant accounts with healthcare-experienced acquirers so no single underwriter's decision can pause the business; it is redundancy, not a way to disguise what's being sold.
Rolling reserve: A percentage of each settlement the acquirer holds back for a period as a loss cushion, common in high-risk underwriting and often imposed suddenly when risk reviews sour. Cash-flow planning for telehealth should assume reserves are possible.
Chargeback: A cardholder's bank-initiated reversal of a charge. Networks monitor dispute ratios against thresholds, and sustained breaches endanger the account; telehealth defense is honest descriptors, findable cancellation, clinical-context response files, and refund policies that resolve anger before it becomes a dispute.
Dunning: The failed-payment recovery process: decline-code-aware retries, card-updater refreshes, and polite outreach for a new card. In subscription telehealth, most involuntary churn is a decline nobody followed up on, which makes dunning quietly one of the highest-ROI systems in the stack.
Negative option billing: Subscriptions that continue charging until canceled. The obligations here run through Section 5 of the FTC Act and ROSCA, not through the Negative Option Rule, whose 2024 click-to-cancel amendment was vacated in 2025 and formally withdrawn in February 2026. Enforcement under those authorities is current: ROSCA requires a simple cancellation mechanism, and the FTC's December 2025 telehealth order requires its respondents to disclose terms before charging, obtain express informed consent, and offer cancellation through the purchase channel. Note what none of that says: cancellation as easy as signup was the vacated rule's parity standard, and it is a defensible design target rather than a current universal obligation.
Click-to-cancel (Negative Option Rule): The popular name for the FTC's 2024 amended Negative Option Rule, which would have required cancellation as simple as signup. It never took effect: the Eighth Circuit vacated it in July 2025 and the FTC recodified the pre-2024 text in February 2026, leaving only the narrow prenotification-plan rule in force, with a fresh rulemaking still at the comment stage. What survives is narrower than the slogan: ROSCA requires a simple cancellation mechanism, and the FTC's December 2025 telehealth order requires cancellation through the purchase channel from the respondents it binds. Parity with signup effort is a design target worth adopting, not a rule anyone can currently cite at you.
Billing descriptor: The merchant name that appears on a cardholder's statement. Descriptors that don't match the brand a patient bought from are a top chargeback trigger, so subscription telehealth sets a recognizable descriptor, often with a support phone number in the descriptor field.

Definitions are operator orientation as of August 2026, not legal advice; regulatory details vary by state and change. LegitScript® is a registered trademark of LegitScript LLC; NABP is the National Association of Boards of Pharmacy. EmbedCare isn’t affiliated with or endorsed by either.

Keep exploring

All guides

The full library behind these definitions.

Free readiness scanner

Scan any Rx site against the certification standards.

How EmbedCare works

The operating model these terms describe, run for you.

Or skip the vocabulary lesson and launch on infrastructure that already speaks it.

Book a free demo Read the guides

www.embedcare.com is LegitScript certified Nationwide compounding pharmacy network TelMDFirst 4.5 (opens Trustpilot in a new tab) and DirectMeds 4.6 (opens Trustpilot in a new tab) on Trustpilot (brands built by our operators)

Trustpilot scores as of August 2026. Compounded medications are not FDA-approved.