1. Licensure that doesn't match the map
The most common failure is jurisdictional: a site that says 'available in all 50 states' backed by a clinician roster that covers forty-seven. The law that governs a telehealth visit is the law of the state where the patient sits, so the claim on your homepage is a promise about licensure in every one of those states, and reviewers check the roster, not the homepage.
The fix is mechanical but unforgiving: build the state-by-state matrix (site claims × provider licenses × pharmacy shipping authority) before writing the service-area copy, and gate checkout so unserved jurisdictions can't order. If your checkout accepts territories or APO addresses your clinical network doesn't cover, that mismatch is a finding.
2. Questionnaire-only prescribing
The valid-prescription standard requires care from a licensed professional before anything is prescribed or dispensed. A flow where payment plus a form triggers medication, with no genuine clinician evaluation and no ability to decline, fails the standard no matter how good the rest of the site looks.
Reviewers walk your funnel with a test patient account, so the flow you describe must be the flow that exists. Marketing that promises 'intake, then provider review, then payment' while the buy button drops straight into a card form reads as a transparency problem even when the underlying model is sound. Make the click-path match the story, disclose that not all visits result in a prescription, and make the decline path real.
A provider who can say no is the difference between telehealth and a vending machine, and reviewers are specifically looking for the vending machine.
3. Vague pharmacy sourcing
'Prescriptions are filled by a licensed U.S. compounding pharmacy' is the sentence that stalls applications. The application wants the pharmacy named, with licenses, and its own certification or accreditation status; dispensing partners are generally expected to be LegitScript-certified or recognized-body accredited, and their review can affect yours.
Interestingly, naming the pharmacy on your public site is not the requirement; certified operators often don't. What's required is that you can name it to LegitScript with evidence of the relationship, and that patients have a way to reach the pharmacy that dispensed their medication. If you can't produce the name today, that's not a paperwork gap; it's a fulfillment-chain decision you haven't made.
4. Claims a regulator wouldn't sign
The claim patterns that draw findings are consistent: 'guaranteed approval' or anything implying no doctor stands in the way; brand-equivalence language for compounded products ('generic Ozempic', 'same as the brand'); outcome numbers lifted from brand-name clinical trials to sell a compounded formulation the trials never studied; absolute safety claims; and superlatives ('the most effective on the market') with nothing behind them.
Two subtler versions catch polished sites. Supplement-style DSHEA disclaimers ('these statements have not been evaluated by the FDA…') pasted onto prescription pages read as a site that doesn't know which regulatory regime it's in. And your page metadata counts: a superlative baked into a meta description ships into search snippets (the advertising surface) even after you've cleaned the visible page.
The discipline that survives review: every quantified claim substantiated for the product actually sold, compounded status disclosed wherever compounded products appear, and testimonials that reflect typical results rather than the best week anyone ever had.
5. Data security nobody wrote down
Reviewers consistently cite privacy and data handling as the weakest area of applications: business associate agreements missing for vendors that touch health information, no written breach-response protocol, and template privacy policies describing a generic e-commerce store rather than a telehealth operation.
Tracking pixels are the sharp edge. Analytics and advertising scripts loaded on intake surfaces, where people select conditions and answer health questions, are the pattern behind federal tracking guidance and a string of enforcement actions. Keep ad pixels and session replay off anything a patient touches, and audit what your tags actually transmit.
6. The quiet ones: identity, domains, history
Three low-drama patterns round out the list. Business identity: a site with no legal entity, no address, and no support contact reads as anonymity, and anonymity reads as risk. Domain hygiene: every domain you own or control must be disclosed, and registration details are expected to be accurate; public WHOIS privacy services are worth lifting before you apply, even though plenty of operating merchants carry them. And the ten-year disclosure: reviewers ask about criminal, regulatory, and civil history for the business, its principals, and affiliated practitioners. Disclosed history is workable; discovered history is usually terminal.
None of these require genius. They require someone to read your site and your paperwork the way a skeptical reviewer will, before the fee is spent. That's exactly what our free Preflight scanner does for the website half: claims, disclosures, trackers, seals, and payment fingerprints, graded with evidence in about a minute.
Deficiency notices are almost never surprises; they're the things you'd have found reading your own site as an adversary. Do that first.
Frequently asked
- Does a rejection burn my application fee?
- The fee is nonrefundable regardless of outcome, and each website's application carries its own fee. Preparation is cheaper than reapplication.
- Can I fix issues during the review instead of before?
- Minor items can often be remediated during review, but every deficiency round adds weeks. The applications that clear fastest arrive with nothing for the reviewer to ask about.
- Will LegitScript tell me exactly why I was rejected?
- You'll receive deficiency notices during review, but LegitScript reserves broad discretion. Building to the published standards, and to how reviewers actually apply them, beats litigating a rejection after the fact.
- My model uses async questionnaires. Is that automatically disqualifying?
- No. Asynchronous care is certifiable when a licensed clinician genuinely evaluates each patient and can decline, and when state telehealth rules for your served states permit the modality. What fails is prescribing where no real evaluation happens.
Want pricing for your program, and the Rx menu that goes with this?
We scope both on a call: 20 minutes with the partnerships team, no prep, no obligation.
Book a demo