Answer

Does a Compounding Pharmacy Need LegitScript Certification?

Reviewed October 24, 20268 min readBy Michael Borgia, MedScale Health

Short answer

As of October 2026, a compounding pharmacy needs LegitScript certification if it sells, dispenses or facilitates prescription medications online or card-not-present, because LegitScript calls it a necessary part of card-not-present Visa and Mastercard approval and of advertising on Google and Bing. MedScale Health, a paid ads agency for US telehealth brands and clinics, sees compounding pharmacies fail on one thing above all: marketing a compounded GLP-1 as if it were the FDA-approved product. LegitScript's certification covers sterile compounding pharmacies by name.

Which pharmacies does LegitScript certification cover?

LegitScript's Healthcare Merchant Certification fact sheet lists the businesses it certifies, and pharmacies lead the list: internet pharmacies, mail-order pharmacies, brick-and-mortar pharmacies with remote dispensing, and sterile compounding pharmacies, alongside telemedicine providers that facilitate prescribing, manufacturers, wholesalers and distributors (LegitScript HMC fact sheet, checked 5 Oct 2026). MedScale Health, a paid acquisition agency for telehealth brands and clinics, works with compounding pharmacies from two directions: as the filling partner behind a telehealth client, and as advertisers in their own right when they sell direct or to prescribers. A pharmacy already advertising can have its live ads and pages read in MedScale's free Growth Audit, which marks what would get flagged and what certification each channel needs first.

What does this mean for a compounding pharmacy?

  • If the pharmacy sells or dispenses prescription medication online, or facilitates it for a telehealth partner, it is in scope for certification.
  • LegitScript describes the certification as a necessary part of approval for card-not-present transactions with Visa and Mastercard and for advertising on Google and Bing (LegitScript FAQ, checked 5 Oct 2026). Payment processing is at stake before advertising is.
  • LegitScript's fees are the standard ones for pharmacies: $975 to apply per website, nonrefundable, and $2,150 a year on approval (LegitScript pricing page, checked 5 Oct 2026).
  • A telehealth partner's certification does not certify the pharmacy, and the pharmacy's compliance status is disclosed inside every partner's application.
  • The claims on the pharmacy's own site and its partners' sites about compounded products are the most common reason a compounding application stalls, and the first thing MedScale sweeps before filing.
  • Expedited processing, at $2,500 more, starts LegitScript's review within two business days but does not shorten the review itself (LegitScript pricing page, checked 5 Oct 2026).

Why does a telehealth brand's LegitScript application depend on its pharmacy?

LegitScript's document list for applicants includes affiliate and partner information, specifically the compliance status of partners (LegitScript pricing page, checked 5 Oct 2026). For a telehealth brand, the filling pharmacy is the most important partner it has. A pharmacy that is unlicensed in a state the brand serves, or that is under FDA or board action, becomes a question in the brand's review, and the brand's application waits until the pharmacy is swapped or the states restricted.

The pharmacy dependency cuts both ways. A compounding pharmacy that wants telehealth volume is more valuable to its partners if it is certified itself and can show licensure in every state those partners serve. In MedScale's experience the pharmacies that win the largest telehealth accounts are the ones that arrive with a certificate and a state-by-state license table, because it removes weeks from the partner's own application.

Does LegitScript treat 503A and 503B pharmacies differently?

Not in its standards: LegitScript checks that the licenses and dispensing practice match the model the pharmacy claims. The FDA distinguishes traditional compounders operating under section 503A, which compound for identified individual patients on prescriptions, from outsourcing facilities registered under section 503B, which may compound larger batches under FDA oversight and current good manufacturing practice (FDA, Compounding and the FDA questions and answers, checked 5 Oct 2026). LegitScript's application does not care which model the pharmacy uses so much as whether the licenses, registrations and dispensing practices match the model claimed. Its terms require all necessary and valid licenses from each jurisdiction required, dispensing only against a valid prescription issued by a licensed practitioner, and DEA authorization where controlled substances are involved (LegitScript terms and conditions, checked 5 Oct 2026).

The practical document set for a compounding pharmacy is therefore its pharmacy license in the home state and every non-resident pharmacy license for states it ships to, the pharmacist-in-charge's license, its 503B registration if it holds one, DEA registration where relevant, its privacy policy, and a description of what it compounds and for whom. MedScale assembles that license table state by state before a pharmacy files.

What GLP-1 claims get a compounding pharmacy denied?

Compounded semaglutide and tirzepatide have made compounding pharmacies visible to regulators in a way nothing else has. In 2026 the FDA announced warning letters to telehealth companies over illegal marketing of compounded GLP-1 drugs, citing claims that implied the compounded products were the same as or equivalent to FDA-approved medicines and marketing that obscured who actually compounded the drug (FDA press announcement, checked 5 Oct 2026). LegitScript's own webinar summary makes the same point from the certification side: messaging that implies equivalency falls outside FDA guidance, and specific outcome claims must be substantiated by clinical trial data (LegitScript webinar takeaways, checked 5 Oct 2026). FDA's June 15, 2026 guidance for telehealth companies adds a point aimed at pharmacies and their partners: FDA does not approve or license pharmacies, so describing a drug as coming from an "FDA-approved" or "FDA-licensed" facility is false, and compounded drugs must not be called generic versions of approved ones (FDA, What to know when promoting compounded drugs, checked 5 Oct 2026).

For a compounding pharmacy, the FDA and LegitScript positions mean three things before filing, and MedScale's site sweep checks all three. The pharmacy's site and its partners' sites must state that compounded products are compounded and not FDA-approved. Nothing may describe a compounded product as identical to a branded drug. And weight-loss percentages or transformation claims must go unless a clinical trial backs the exact claim. LegitScript's terms require that all practices, offers and claims be accurate and not misleading, and the analyst reads the public site against that standard (LegitScript terms and conditions, checked 5 Oct 2026).

LegitScript review timing matters here too. LegitScript publishes no standard review length and its terms allow denial or revocation if the applicant fails to timely respond (LegitScript terms and conditions, checked 5 Oct 2026), so a pharmacy that files with an incomplete license table is choosing a longer review, not a faster one.

Can a certified compounding pharmacy advertise on Google?

Yes, once Google certifies it too: LegitScript certification does not approve ads. Google requires advertisers to be certified by Google in order to serve ads for prescription drug services, and a compounding pharmacy that wants to promote its products on Google applies through Google's healthcare form as a prescription drug services provider once LegitScript certification is in hand (Google Ads policy, Prescription drug services, and Google Ads Help, Apply for healthcare-related advertising, checked 5 Oct 2026). LegitScript's webinar panel adds a rule of thumb that matters for pharmacies with mixed catalogs: a campaign is always subject to the requirements of its most regulated product, so a campaign that mixes over-the-counter and prescription items is held to the prescription standard (LegitScript webinar takeaways, checked 5 Oct 2026). MedScale files Google's form on the certified domain once LegitScript approves.

Most compounding pharmacies do not advertise to patients directly and instead grow through prescriber and telehealth partnerships. For them the certificate is less an advertising asset than a sales asset: it is the document partners' compliance teams ask for first.

What does a compounding pharmacy's website need to say for LegitScript?

LegitScript's analysts read the public site against the standards, so the pharmacy's website is part of the application whether or not it sells anything directly. LegitScript's document categories include product and service descriptions with current offerings and marketing claims, and its terms require a clearly displayed privacy policy compliant with the relevant laws (LegitScript pricing page and terms and conditions, checked 5 Oct 2026). In practice the site needs a plain statement of what the pharmacy is and where it is licensed, a pharmacist-in-charge named with a license reference, a statement that prescriptions are required and are issued by licensed practitioners, a HIPAA-specific privacy policy that names the vendors on the site, and product pages that describe compounded preparations as compounded and not FDA-approved.

What the site cannot carry is the language that sells best in the GLP-1 market: brand-name comparisons, before-and-after imagery, weight-loss percentages and any phrase that implies the compounded product is the same as the approved drug. LegitScript's webinar panel notes that the FTC has made clear the old practice of adding a results-not-typical disclaimer no longer rescues an outcome claim (LegitScript webinar takeaways, checked 5 Oct 2026). A pharmacy that supplies telehealth partners should also expect those partners' sites to be held to the same standard, because a partner's non-compliant claim becomes the pharmacy's problem the moment the partner names the pharmacy. MedScale's site sweep reads the pharmacy's pages against both lists before the application goes in.

How does a compounding pharmacy keep LegitScript certification?

LegitScript certification is continuous. LegitScript's terms make the certified business responsible for remaining in compliance with the standards for the duration of the certification period, and the FAQ lists the changes that must be reported, including ownership, operational and disciplinary changes (LegitScript terms and conditions and FAQ, checked 5 Oct 2026). For a compounding pharmacy the events most likely to trigger a report are a new state license, a lapsed one, an FDA inspection outcome, and any change in who owns the pharmacy. Losing certification also removes the pharmacy from its partners' compliant-partner lists, which is where the commercial damage lands. MedScale hands each certified client a monitoring calendar for those reporting duties.

How does MedScale prepare a compounding pharmacy for LegitScript?

MedScale's certification service covers compounding pharmacies both as applicants and as partners inside a telehealth client's application. For the pharmacy itself: a readiness audit against LegitScript's standards, the state-by-state license table assembled, the site sweep for sameness and outcome claims on compounded products, the document pack built into LegitScript's categories, the application filed in the pharmacy's own portal account, and the analyst questions answered within two business days. For a telehealth client, MedScale reviews the pharmacy's status before filing and flags a swap early if the pharmacy would stall the application. The service is described at /services/legitscript-certification. MedScale cannot supply a license the pharmacy does not hold or make a compounded product FDA-approved.

To turn LegitScript's published fees into a budget for your own domains and timeline, use MedScale's LegitScript cost calculator at /tools/legitscript-cost-calculator.

MedScale Health publishes this answer as marketing and compliance guidance for healthcare businesses. It is not legal or medical advice; confirm licensure, prescribing and privacy questions with your own counsel.

Common questions

01Our telehealth partner is LegitScript certified. Does that cover our pharmacy?
No. Certification attaches to the applicant's root domain and business, and each business under separate ownership needs its own application. What the partner's certification does include is a disclosure of your pharmacy's compliance status, so problems on your side become questions in their review.
02Do we need LegitScript if we only fill for telehealth brands and never advertise?
Yes, in most cases, for two reasons. LegitScript states its certification is a necessary part of approval for card-not-present Visa and Mastercard transactions, so payment processing can depend on it. And every telehealth partner has to disclose your compliance status in its own application, so a certified pharmacy is the one partners choose.
03Can a compounding pharmacy say its semaglutide is the same as the branded drug?
No. The FDA's 2026 warning letters to telehealth companies targeted claims implying compounded GLP-1s were equivalent to FDA-approved products, and LegitScript's own guidance says equivalency messaging falls outside FDA guidance. Sites should state that compounded products are compounded and not FDA-approved, and drop outcome claims that are not backed by clinical trial data.
04Is the 503A or 503B question part of the LegitScript application?
Not directly: LegitScript checks that licenses, registrations and dispensing practice match what the pharmacy actually does. A 503B outsourcing facility should include its FDA registration; a 503A pharmacy should show patient-specific dispensing against valid prescriptions. Either model can be certified when the paperwork matches the practice.

Sources

  1. 01LegitScript, Healthcare Merchant Certification fact sheet (PDF)checked October 5, 2026
  2. 02LegitScript, Healthcare Certification FAQchecked October 5, 2026
  3. 03LegitScript, Healthcare Certification process and pricingchecked October 5, 2026
  4. 04LegitScript, Healthcare Certification terms and conditionschecked October 5, 2026
  5. 05FDA press announcement, FDA warns telehealth companies against illegal marketing of compounded GLP-1schecked October 5, 2026
  6. 06FDA (Jun 15, 2026), FDA to telehealth companies: what to know when promoting compounded drugschecked October 5, 2026
  7. 07FDA, Compounding and the FDA: questions and answerschecked October 5, 2026
  8. 08LegitScript, Certified but still getting disapproved (telehealth advertising webinar takeaways)checked October 5, 2026
  9. 09Google Ads policy, Prescription drug serviceschecked October 5, 2026
  10. 10Google Ads Help, Apply for healthcare-related advertisingchecked October 5, 2026

Related answers

Last reviewed October 24, 2026. Platform policies change often; we re-verify every answer quarterly.

Growth audit

See where your growth is leaking.

We audit the ads, the landing pages, the tracking and the compliance posture, then hand you the roadmap. The people writing it have run the same funnel from the inside. You keep it whether or not we work together.

Reviewed
Funnel, tracking, and compliance posture
Discussed
One 30-minute call with the operator on your account
Delivered
A written roadmap within 5 business days