Directory · verified September 8, 2026
The telehealth payments directory.
Who will actually process payments for a cash-pay telehealth or Rx business, in four tiers: what the mainstream processors' own terms say (quoted verbatim from documents carrying their own date stamps), the specialist processors that market telehealth onboarding and what they require, the healthcare billing platforms that sign BAAs, and the card-network programs that explain why all of the above behave the way they do. Every claim was verified against the vendor's or network's own document on September 8, 2026; "not stated" means their pages do not say.
Read this first: this is not a list of EmbedCare's vendors, inclusion implies no relationship or endorsement, nothing is ranked, and no vendor paid to appear. It is also operator orientation, not legal or financial advice: processor terms change on their own schedules (the date stamps quoted per row are the tell), underwriting is always case-by-case, and the only posture that binds anyone is the current document on the processor's own site. Corrections: anthony@embedcare.com.
Tier 1: what the mainstream processors' own terms say.
What the five actually state, without generalizing: Stripe and PayPal name telemedicine as a restricted or pre-approval category, Shopify inherits its processors' lists, and Square and Braintree do not name telehealth as a service at all. The hard wall every one of them states in some form is card-not-present prescription PRODUCTS. Quotes below are from each processor's own current terms.
| Processor | Stated telehealth posture | Prescription products | BAA |
|---|---|---|---|
| Stripe | Restricted, case-by-case: its list (own last-updated stamp May 13, 2026) places “telemedicine and telehealth services,” online pharmacies, and prescription delivery under the restricted category requiring review; its FAQ states telemedicine businesses “don't need certification from LegitScript” but must provide licensing items in onboarding | “Card-not-present prescription-only products and pharmaceuticals” restricted; pharmacy support limited to named countries with review | Publishes no BAA and no BAA-availability statement (verified absence; third-party guides go further, saying it does not sign one) |
| Shopify Payments | Prohibits “products or services that require regulatory approval or compliance, such as… prescription drugs, medical devices” (its help center); its US terms now inherit prohibited categories from its named processors, Stripe and PayPal, by reference | Prescription drugs named in the prohibited list; the platform AUP separately says uploading PHI subject to HIPAA is unsupported | Not stated; PHI unsupported per its AUP |
| Square | No telehealth-named prohibition, but its payment terms (effective July 30, 2026) prohibit “internet/mail order/telephone order pharmacies or pharmacy referral services” where fulfillment follows a remote consultation absent a physical visit | “You may not process CNP transactions for items or services involving products that require a prescription” (its help article); card-present only for prescription-required products, which forecloses online Rx payment flows | Not stated on pages verified |
| PayPal | Pre-approval required, not prohibited: its acceptable-use policy's approval chart lists “Telemedicine Services,” described as “providing medical services and consultations in a remote fashion” | Pre-approval row: “the sale of any product(s) requiring a prescription or prescription dispensing services” | Not stated |
| Braintree (PayPal) | Its acceptable-use policy (own stamp: unchanged since November 2017, now hosted in PayPal's legal hub) lists “online or other non-face-to-face pharmacies or pharmacy referral services” and “prescription drugs” among prohibited uses; telemedicine as a service category is not named | Prohibited per the list above | Not stated |
Tier 2: the specialist processors and gateways.
The vendors that publicly market telehealth or high-risk onboarding. Two systematic findings from the verification pass: four of them state a near-identical certification prerequisite for anything selling medicine online, and published pricing is rare in this tier. Gateways (NMI, Authorize.net) are listed because operators meet them, but the acceptance decision sits with the acquirer behind them.
| Vendor | Claims to onboard (its words) | Stated certification prerequisite | Pricing posture |
|---|---|---|---|
| Authorize.net | Gateway marketing healthcare payments generally; telehealth, pharmacy, HIPAA, and BAAs are all unmentioned on its healthcare page. Acceptance depends on the acquirer behind the gateway | Not stated | Links a pricing page from its healthcare page; no figures on the healthcare page itself |
| Bankful | High-risk generalist (“high-risk isn't a problem, it's a category”); named verticals include nutraceuticals, CBD, firearms; telehealth and pharmacy are not named | Not stated | The specialist tier's exception: publishes a plan table on its site, with monthly fees from $0 to $95 across its standard tiers plus a higher-fee API concierge tier, per-transaction fees from $0.08 to $0.15 plus processing, and eCheck and crypto options priced separately |
| Corepay Corepay (this ISO) is unrelated to Corpay, Inc., the NYSE-listed corporate-payments company | “Built for telehealth, wellness, peptides, hormone replacement, and subscription care,” naming GLP-1 programs and recurring consultations; claims same-day decisions and direct underwriting | “VIPPS certification or proof of LegitScript registration is required to approve a merchant account for selling medicine or similar services online” (its page) | Not published; its calculator carries an estimates-only disclaimer |
| Durango Merchant Services | Telemedicine (including telepharmacy) and pharmacies; publishes an unusually specific underwriting document list, down to prescriber state-license numbers and site photos | “If you are selling medicines you will need to provide us a copy of VIPPS Certification or proof of registration with Legit Script” (its telemedicine page) | Not published |
| Maverick Payments | High-risk verticals including “health products” (its page); telehealth, telemedicine, and pharmacy are not named on the page verified | Not stated | Not published |
| NMI | White-label gateway, not an underwriter: healthcare positioned under “Medical & Dental,” with 150+ processor options behind it; underwriting decisions sit with the processor, not NMI | Not stated | Not published (partner model) |
| PaymentCloud | Telemedicine, healthcare, online pharmacy, and online therapy via dedicated industry pages; owned by Electronic Merchant Systems since January 2024, still operating under its own brand | For online pharmacy: an “up-to-date certificate from NABP… OR LegitScript certification” (its page, which also advertises a partner discount on certification application fees) | Not published; “fees vary depending on processing history, payment methods, business risk levels” |
| Soar Payments | Telemedicine, including selling medicine and consultations online, via processors and sponsor banks “who have the capability to underwrite regulated industries”; US-based businesses only (its stated eligibility) | “If you are selling medicine or similar services online you will need to provide copy of VIPPS Certification or proof of registration with Legit Script” (its page) | Not published |
Located but not verifiable at review (their pages refused automated verification; confirm directly before relying on them): Easy Pay Direct (telemedicine merchant-account marketing visible in search indexes only), Zen Payments, and PayKings. This footnote is a verification status, not a judgment.
Tier 3: healthcare billing platforms that sign BAAs.
Where patient payments meet PHI, the differentiator is whether the platform will be your HIPAA business associate. These three publish or reference their own BAA in their own documents; none of them is a high-risk Rx underwriter.
- InstaMed (J.P. Morgan): Operates as a HIPAA business associate by default: “As a HIPAA business associate of your healthcare provider(s), InstaMed may use and disclose your protected health information only as permitted by HIPAA” (its privacy statement, revised May 1, 2026); a JPMorgan Chase subsidiary with enterprise healthcare focus.
- PayGround: Publishes its standing BAA on its own site, naming PayGround as business associate to the customer covered entity; a patient-payments platform for providers, not a high-risk Rx underwriter.
- Rectangle Health: Its master services agreement (updated April 22, 2026) builds the BAA in as Exhibit A, “to be signed during the application process to enable Activation”; practice-payments focus, with a Clover PracticePay partnership announced with Fiserv in 2025.
Tier 4: the rules underneath everything above.
Visa Integrity Risk Program (VIRP), formerly GBPP. Visa's own description: the program "establishes a set of ecosystem controls, requirements and capabilities designed to detect, deter and remediate illegal activity," and merchants in high-risk areas "must be registered in the VIRP program by their acquirer," with quarterly acquirer certification. The public Visa Core Rules (April 18, 2026 edition, read directly) require acquirers to register high-integrity-risk merchants, with one precise exemption worth quoting whole: registration "does not apply to Merchants assigned MCC 5122 or 5912 if the Merchant is accredited by the National Association of Boards of Pharmacy (NABP) or other regulatory body recognized by Visa." The words telemedicine and telehealth appear nowhere in the 923-page public rules document, so telehealth treatment flows through acquirer policy rather than a named public rule. Visa publishes no registration fee figures in the documents verified; treat any circulating numbers as unconfirmed.
Mastercard MATCH, per acquirer documentation. Described in Stripe's own acquirer docs as Mastercard's "global database of businesses terminated by acquirers because of severe rule violations, fraud, or high chargebacks": acquirers must screen applicants against it, qualifying terminations are added within one business day, listings remain active five years, and a listing "generally disqualifies a merchant from processing with Stripe," per those same docs; other mainstream processors screen against the same database, so expect the same result there. Mastercard's own merchant-rules manual declined automated verification, so this page states nothing Mastercard-specific beyond MATCH as acquirers document it. The practical translation: a shutdown is durable, which makes honest underwriting up front the cheap option.
LegitScript Healthcare Merchant Certification. The certification layer the specialist tier references. Per LegitScript's own fact sheet and FAQ as of September 8, 2026: open to "healthcare merchants that facilitate the sale of prescription drugs," including telemedicine providers; a one-time application fee of $975 per website and an annual fee of $2,150 per website, the annual fee due only on approval. Note the precision this page keeps: the specialists require LegitScript or VIPPS for selling medicine, Stripe's FAQ says telemedicine businesses do not need it, and Visa's public rule names NABP rather than LegitScript for the pharmacy registration exemption. All three statements are true at once because they cover different scopes. EmbedCare is not affiliated with LegitScript; certification support is a managed service.
The 2024-2026 record, dated.
- January 2024: Electronic Merchant Systems acquired PaymentCloud (company release); the brand continues to operate under its own name.
- September 2024: PayPal became an additional US card processor for Shopify Payments (PayPal newsroom), which is why Shopify's US prohibited categories now flow from both Stripe's and PayPal's lists by reference.
- September 2025: NMI's CEO transition took effect: Vijay Sondhi stepped down after seven years, with Steven Pinado taking over (its own release).
- May 2026: Stripe's restricted-businesses list carries a May 13, 2026 revision stamp; PSP terms pages carry their own dates, and re-checking those stamps is how this page stays honest.
Renamed or reorganized, for searchers holding old names: Visa's GBPP became VIRP effective May 2023 (per LegitScript's VIRP explainer); Braintree's legal pages migrated into PayPal's legal hub (its acceptable-use policy text is unchanged since 2017 per its own stamp); PaymentCloud has been owned by Electronic Merchant Systems since January 2024 while operating under its own brand; and Corepay the high-risk ISO is unrelated to Corpay the NYSE-listed corporate-payments company. This page is re-verified quarterly against the same primary documents, whose own date stamps are quoted above; additions require the same same-day verification pass this page was built from.
Questions operators actually ask.
Can a telehealth business use Stripe?
Often, for the consult side, after review: Stripe's own list places telemedicine under restricted categories requiring case-by-case approval, and its FAQ states telemedicine businesses do not need LegitScript certification but must provide licensing items in onboarding. The harder wall across mainstream processors is card-not-present prescription products: Stripe restricts them, Square prohibits CNP transactions for prescription-required products entirely, and Braintree's policy prohibits non-face-to-face pharmacies. Consults and Rx product payments are different underwriting questions; plan them separately.
Do I need LegitScript certification for payment processing?
It depends on which sentence of the industry you read, and both are true as of September 8, 2026. Stripe's FAQ says telemedicine businesses do not need it. The specialist processors say, in near-identical words, that selling medicine online requires VIPPS certification or LegitScript registration (Soar, Durango, Corepay, and PaymentCloud all state a version of this). And Visa's public rule exempts pharmacy merchants from high-integrity-risk registration only when accredited by NABP “or other regulatory body recognized by Visa”; LegitScript is not named in the public rule. The resolution: consults alone may pass mainstream review, while anything dispensing medicine meets the certification layer almost immediately.
What are VIRP and MATCH, and why do processors keep mentioning them?
They are the card-network machinery underneath every posture on this page. Visa's Integrity Risk Program requires acquirers to register high-integrity-risk merchants and re-certify quarterly; per LegitScript's VIRP explainer, pharmacy merchant categories sit in its highest-scrutiny tier. MATCH is Mastercard's database of terminated merchants, described in acquirer documentation: acquirers must screen applicants against it, listings persist five years, and Stripe's docs say a listing generally disqualifies a merchant from processing with Stripe; other mainstream processors screen the same database. A shutdown at one PSP is durable, which is exactly why the specialist tier exists and why honest underwriting up front beats optimistic onboarding.
What does LegitScript healthcare merchant certification cost?
Per LegitScript's own published fact sheet and FAQ as of September 8, 2026: a one-time application fee of $975 per website and an annual fee of $2,150 per website, with the annual fee due only on approval. Its certification covers the areas card-brand high-risk registration examines, including controls ensuring prescription drugs are dispensed only against valid prescriptions. Our cost calculator models the certification budget, and our LegitScript guides cover the process end to end.
Where EmbedCare sits: payments are one of the layers the platform operates for partner programs, with the underwriting posture and revenue-defense machinery built in, which is why the payments guide linked below reads like field notes. Licensed clinicians make every prescribing decision on EmbedCare programs, and nothing on this page changes who a processor will approve; documents and underwriters decide that.
Rather inherit a working payments layer than shop for one? Get the partner overview.
One email, no sequence. A human follows up with your program scoped.
Keep exploring
The payments guide
Layer 5 explained: underwriting, high-risk reality, revenue defense.
The assembly-journey pillar
All nine business layers, mapped.
Certification cost calculator
Model the certification budget from published fees.
Free readiness checker
Scan any telehealth site against certification standards.
The heavy layers, one contract.
EmbedCare operates the clinical network, pharmacy supply, storefront, payments, and compliance scaffolding behind your brand.