How Do You Launch a Telehealth Brand? The Compliance Checklist

What this means for you

• The visit model (async, video or hybrid) and the list of states you sell into come first. Every partner, page and ad decision hangs on them.
• Contracts sit in your name: prescribers, EHR, pharmacy, payments, identity verification, telehealth platform. A brand that does not own its stack cannot be certified or sold.
• The site is built to read as a clinic to a policy reviewer, not as a pharmacy. That decision is made in the page structure, not in the copy.
• LegitScript is the certification Meta and Google require before prescription drugs can be advertised. Build the pages the way it reviews them so certifying is a filing, not a rebuild.
• Tracking is server-side with generic event names from the first visit, and every vendor that touches patient data is under a business associate agreement.

MedScale Health, a patient-acquisition agency for telehealth and clinics, builds telehealth brands end to end and rebuilds live ones whose site reads as a pharmacy or whose tracking tells the ad platforms what condition each patient has. The checklist is the sequence that avoids paying for the same work twice. This page is marketing guidance for healthcare operators. It is not medical or legal advice, and platform policies change: check the sources listed at the end before acting on any specific rule.

One: settle the visit model and the states

Three models exist. In an asynchronous visit the patient completes intake, a licensed prescriber reviews it without a live call, and medication ships from a partner pharmacy on a subscription; it needs state-by-state rules on asynchronous prescribing, prescribers licensed in every state served, a pharmacy that ships there, identity verification and billing built for refills. In a synchronous model the patient books a video visit and the prescription follows; it needs scheduling against a real prescriber roster, a video platform under a business associate agreement, and intake that qualifies people before a slot is booked. A hybrid adds online visits to a physical clinic and needs one patient record across both sides.

If the category involves a controlled substance, such as testosterone, the model also depends on the federal telemedicine flexibilities for prescribing controlled medications without an in-person visit. Those flexibilities have been extended by temporary rule repeatedly, most recently in the extension published at the end of 2025, and state law layers on top. A model built on a flexibility that lapses is a model that has to be rebuilt.

Two: the backend partners, in your name

• Prescriber network: licensed coverage in every state sold into, async or video to match the model, and response times that can go in the offer.
• EHR: holds the chart, the visit record and the prescription; chosen for the API the intake can write to.
• Pharmacy: ships what is prescribed to the states served, compounded or retail, with the licensing to survive a LegitScript review. Know whether it is a 503A pharmacy compounding on individual prescriptions or a 503B outsourcing facility, because the FD&C Act treats them differently and every compounded product is described as compounded, not FDA-approved.
• Payments: a processor that underwrites telehealth knowingly. The wrong one freezes funds the first month volume looks real.
• Identity verification: confirms the patient is who the intake says, the way state rules require, without losing half of them at the upload step.
• Telehealth platform: video, scheduling and messaging under a business associate agreement where the model includes a live visit.

Every one of these vendors that creates, receives, maintains or transmits protected health information is a business associate, and 45 CFR 164.504 sets out what the written agreement has to contain. Signing the BAA is part of onboarding the partner, not an afterthought.

Three: a site that reads as a clinic

Meta and Google classify an advertiser by what the landing page looks like. A page that lists medications with prices and a cart reads as an online pharmacy and pulls the account into restricted delivery; under Meta's drugs and pharmaceuticals standard, promoting prescription drugs requires LegitScript certification and authorization. The compliant structure leads with the clinic, the program and the prescriber, puts medication detail second, frames candidacy and pricing the way the platforms allow, and states the prescription requirement and the results-vary line plainly. It loads in under two seconds on a phone, and the intake puts the fewest fields before the booking and the qualification questions after it.

Four: intake and quizzes written for the reviewer as well as the patient

Platforms read intake pages the way they read ads. A question phrased as a second-person symptom or a URL that names a drug can pull the account into restricted data. The eligibility quiz asks exactly what the clinical protocol needs (age, state, history, contraindications), so people who cannot be treated learn it in the first minute rather than after paying, and every question is checked against the same rules as the creative.

Five: LegitScript-ready structure and the certification path

LegitScript's healthcare merchant certification is what Meta and Google require before an online pharmacy or telehealth provider may promote prescription drugs, and Google's prescription drug services certification is a second application that follows it. The pages, disclosures and account structure are built the way LegitScript reviews them, so that certifying becomes a filing rather than a rebuild. Until certification lands, campaigns promote the program and the consultation and never name the drug.

Six: tracking from the first visit

Server-side tracking with generic event names goes in before the first ad runs, so a platform learns that a conversion happened and nothing about the condition behind it, and attribution holds through the click-out to a partner's checkout or booking page. Event names never contain a condition or a drug. The ad accounts are structured before the first dollar is spent, with consultation campaigns and any future authorized-product campaigns kept in separate ad sets.

The checklist

• Visit model chosen and written down, with the states and the rules that apply to each.
• Prescriber, EHR, pharmacy (503A or 503B known), payments, identity verification and telehealth platform contracted in the brand's name, each under a BAA where it touches patient data.
• Offer, pricing and renewal terms settled, with the disclosures healthcare subscriptions are held to.
• Site designed and built to read as a clinic, under two seconds on mobile, with a real privacy policy and provider credentials.
• Intake and eligibility quiz reviewed by the clinical lead and against platform policy.
• Checkout, subscription, refills, pauses and cancellations working end to end with test patients.
• LegitScript filed where the category requires it; Google's certification applied for once LegitScript is active.
• Server-side tracking live and verified event by event, with a document that says what each event means.
• Ad accounts structured, business and domain verification completed on Meta, advertiser verification completed on Google, before any spend.
• First campaigns live only on the channels open to the category.

The order in weeks

For an idea-stage brand the sequence runs about twelve weeks: discovery in weeks one to two, model and partner selection in weeks two to four, intake and design in weeks three to six, build in weeks six to ten, certification and tracking in weeks nine to twelve, and launch from week twelve. A brand with prescribers or a pharmacy already in place skips part of the second block; a live brand being rebuilt keeps running while the new structure is built beside it.

What MedScale does

MedScale Health's Telehealth Buildout (medscale.health/build) runs the sequence above end to end: the model document, intake and quizzes with a policy note on any question a reviewer could read wrong, the site in a repository under the client's account from the first commit, partner contracts in the client's name connected and tested with test patients, server-side tracking verified event by event, LegitScript filed where required, and the first campaigns live on the channels open to the category. Everything is owned by the client from day one and keeps running without the agency.