New Payment Rules for Clinics and Pharmacies

Compliance Alert: New Payment Rules Hitting Clinics That Sell Medications & Supplements

July 28, 2026

If your clinics or pharmacy dispenses or sells medications, GLP-1s, HRT, ketamine, IV injectables, compounded meds, or even high-end supplements, how you collect payment just became a lot more important.

Card networks and processors have tightened the rules. What used to be “business as usual” can now trigger account reviews, holds, or outright shutdowns. Here’s the clear version of what changed and what you need to do about it.

Quick Takeaways

In-clinic medication sales must now run through chip-enabled (EMV) terminals. Swiped or keyed cards for prescription or pharmacy-grade products are no longer considered compliant by most processors.

Online, phone, or invoice sales of medications generally require LegitScript certification or recognized pharmacy accreditation.

Mastercard registration is mandatory.

Taking payment for a medication that a pharmacy later ships is still treated as high-risk by most processors.

The safest models right now: either process every in-person med sale on an EMV terminal, or bill only for the clinical service and let a partner pharmacy handle the medication sale and payment.

1. In-Clinic Medication Sales Now Require EMV Terminals

If a patient is standing in your clinic and you’re handing them (or administering) a regulated product, the card transaction needs to go through a chip-enabled terminal.

This applies to:

Semaglutide, tirzepatide, or lipotropic injections

Bioidentical hormone creams or testosterone

Ketamine lozenges or nasal sprays

Compounded medications or nutraceutical packs sent home with the patient

Keyed or swiped payments for these items are raising red flags. Processors are treating them as higher risk, and non-compliance can lead to account termination.

Practical step: Put an EMV terminal at the front desk or checkout area and train staff to use it for every in-person medication-related charge.

2. Selling Meds Online, by Phone, or by Invoice? New Barriers Apply

Card-not-present transactions for prescription or pharmacy-grade products now sit under much stricter rules.

To stay compliant with Mastercard and most modern processors you generally need either:

Full pharmacy accreditation (NABP, VIPPS, VAWD, etc.), or

LegitScript certification for the practice or website

This covers phone refills, online reorders, membership programs that ship meds, and any e-commerce sale of prescription weight-loss or compounded products.

Even if you don’t call yourself an “online pharmacy,” the moment you accept remote payment for the medication itself, these requirements usually kick in.

Mastercard registration is required for online medication sales with almost no exceptions.

How Clinics Are Adjusting Their Business Model

Many practices that are not pharmacies or LegitScript-certified are shifting to a cleaner structure:

Charge the patient only for the clinical service (consult, injection visit, treatment-plan appointment)

Send the prescription to a partner pharmacy that bills the patient directly for the medication

Example: You bill for a weight-loss consult and treatment planning. The pharmacy fulfills and charges for the semaglutide separately.

If you do dispense on-site or bundle meds into packages:

• Use a PCI-compliant gateway and store cards on file securely

• Always process in-person medication charges on an EMV terminal

• Keep service fees and medication charges clearly separated in billing

• Avoid card-not-present medication payments unless you are properly certified

• Card-on-file workflows also reduce no-shows and make recurring packages smoother while lowering chargeback risk.

What You Should Do Right Now

Confirm every in-clinic medication payment runs through an EMV terminal (Fiserv terminals are a common option that can be rented or purchased).

Stop card-not-present medication sales unless you hold LegitScript certification or pharmacy accreditation.

Review whether you are currently bundling meds into online or phone packages without the required certifications.

Talk to your processor. Be transparent about your product mix, how you collect payment, and your MCC.

Consider separating service revenue from medication revenue so the pharmacy handles the higher-risk side.

Bottom Line

The rules around payment for medications and pharmacy-grade products have tightened quickly. Clinics that adapt early—by using EMV for in-person sales or by letting a pharmacy partner handle the medication transaction—protect their payment processing and keep revenue flowing.

If you’re unsure whether your current setup is compliant, now is the time to review it. The cost of getting this wrong is usually higher than the cost of adjusting the model.

Need help structuring compliant workflows or evaluating payment partners that understand specialty and wellness clinics? We’re happy to walk through options.