1. The pattern, in the order it happens
The sequence is consistent enough to describe in advance. A clinic boards on a mainstream processor in an afternoon, because signing up takes minutes and nobody asks what you sell. Revenue grows. Somewhere between month three and month eighteen — almost always after a step up in volume — an automated review flags the account.
Then, typically in this order: a request for documentation, a pause on payouts while the review runs, and a decision. If the decision goes against the clinic, the account is closed and a portion of recent volume is held as a reserve against future chargebacks. The clinic is not usually accused of fraud. It is told, correctly, that its business was never permitted.
The damage is rarely the lost processor. It is the timing: payouts stop while payroll, rent and the next compounding-pharmacy invoice do not.
2. Why it happens: the aggregator model
Stripe and Square are payment aggregators. Rather than underwriting each business individually and issuing it a merchant ID, they place many merchants under a shared master account. That is exactly why onboarding is so fast — and exactly why the acceptable-use rules are strict and enforced centrally.
Both maintain published lists of restricted and prohibited businesses, and pharmaceuticals and prescription products appear on them. The lists are not hidden. They are simply not what anyone reads when signing up for a payment link in ten minutes.
Read the actual list before you argue with it. Stripe publishes its restricted businesses list and Square publishes its prohibited goods and services policy. Both are updated. If you take one action after reading this article, open the current version for whichever processor you use and search it for “prescription” and “pharmaceutical”.
Enforcement is automated and retroactive. That combination is what catches people out: the absence of a problem is not permission, it is latency. And because review is usually triggered by volume, the clinics that get caught are disproportionately the ones doing well.
3. “We’ve been fine for two years” is not evidence
This is the most common and most expensive misreading in the category. Two years without a review does not demonstrate that the account is permitted. It demonstrates that nothing has yet caused a human or a model to look at it closely.
Treat the exposure the way you would treat any other uninsured risk: not by its probability in any given month, but by what it costs when it lands. For most clinics that number is every dollar of card revenue, stopped at once, for as long as the review and any reserve period run.
4. The two structures that work
There are only two honest answers, and neither is “hope”.
Split billing — the one we recommend
Keep the mainstream processor for everything it is happy to handle: consults, memberships, aesthetics, retail supplements. Route only the medication charges to a high-risk merchant account underwritten for prescription products. Two rails, one clinic.
The reason to prefer this is arithmetic. High-risk processing costs more per transaction by design — that premium is what the underwriting buys. Running your entire book through it means paying a risk premium on every routine follow-up visit. The split confines the premium to the revenue that actually carries the risk.
The operational catch is that somebody has to route each charge correctly, every time, forever. Front-desk staff will not reliably remember which rail a line item belongs on at 4:50pm. This is a job for software: the routing should be a property of the charge, not a decision a human makes under time pressure.
One high-risk processor for everything
Simpler books, one statement, one reconciliation, one support relationship — and nothing left behind that can be frozen. It makes sense when most of your revenue is medication anyway, or when you have already been dropped once and would rather not repeat the experience. You pay the premium on all volume for that simplicity.
5. What high-risk actually costs
Expect three separate line items, and be suspicious of anyone who quotes only the first.
| Cost | Typical shape | Notes |
|---|---|---|
| Discount rate | Meaningfully above mainstream card rates | Priced for the risk being underwritten; tiers down with volume |
| Gateway fees | Per transaction, plus a small monthly | Often quoted separately from the rate |
| LegitScript certification | Charged per website, annually | Usually mandatory before a processor will board you |
That third row is the one that surprises people, and it is large enough to change whether the model works for a small practice. We have written the current fee schedule up separately in what LegitScript certification actually costs.
Underwriting is also a real review rather than an instant sign-up. Plan for business documents, a look at your website and claims, and days rather than minutes. If you are not already certified, certification is the long pole and it comes first.
6. What to do before it happens to you
Find out what your processor actually permits. Open the current restricted-business list and read it against what you sell. Ten minutes. Separate the revenue in your own books first. Even before you change processors, know what share of monthly card volume is medication. That number determines whether split billing or a full switch is right, and you will need it for any underwriting conversation. Do not wait for a clean moment. Underwriting takes longer when you are already frozen, and a processor reviewing an application from a clinic whose previous account was just closed is a harder conversation than one from a clinic that moved deliberately. Make the routing a system property. Whatever you choose, the decision about which rail a charge takes should live in software that knows what the charge is for. A rule enforced by memory is not a rule.This is not legal advice. It is what we have learned building software for prescribing clinics, written down plainly because almost nobody publishes it. Fee schedules and federal rules change — every figure here was checked on 6 August 2026 and linked to its source. Confirm the live position with the regulator, the vendor, or your own counsel before you act on it.
7. Frequently asked questions
Will Stripe or Square close my account for prescribing?
Not for prescribing — for taking payment for prescription products through their platform, which their terms prohibit. The clinical activity is not their concern; the transaction is. Both publish restricted-business lists you can check today.
How much notice do you get?
Often little to none before payouts pause. Review typically starts with a documentation request and a payout hold running concurrently, not sequentially. Plan for the money to stop first and the conversation to happen after.
Can I appeal?
You can respond to the review, and clinics occasionally survive one. But this is not a misunderstanding to correct — it is a policy being applied. Treat a successful appeal as a reprieve to migrate during, not as a resolution.
Is a reserve the same as a fine?
No. A reserve is your money, withheld against potential chargebacks and released after a defined period. That distinction matters legally and not at all to your cash flow in the month it happens.
Does splitting payments mean two checkouts for the patient?
It should not. The split belongs in the software: the system decides which rail a line item takes and the patient sees one transaction. If your EMR makes staff choose manually, the rule will be broken eventually.
Are aesthetics and IV therapy affected?
Generally not by themselves — the restriction is on prescription products. A med spa selling neurotoxin treatments and a wellness clinic selling drips are usually fine on mainstream processors. It is the prescribing arm that changes the picture.