As digitalization in general is rapidly expanding, online pharmacies have become an increasingly accessible and convenient option for consumers throughout the country. However, with this convenience comes scrutiny from patients and other relevant authorities seeking to ensure that the online pharmacy is legitimate, licensed, and compliant with all applicable legal and regulatory standards. Consumers, regulators, and especially Pharmacy Benefit Managers (“PBMs”) have begun to seek higher standards of assurance. One such major standard for identifying legitimate, compliant online pharmacies is the Verified Internet Pharmacy Practice Sites (“VIPPS”) accreditation which is now known as Digital Pharmacy Accreditation.
What Is VIPPS?
The VIPPS program was established by the National Association of Boards of Pharmacy (“NABP”) over 25 years ago to address the increasing number of online pharmacies, while also seeking to protect consumers from illegitimate or unsafe pharmacies. The purpose of VIPPS accreditation is to verify and provide assurance that digital pharmacies are compliant with federal and state laws and regulations, elevated standards of pharmacy practice, and strict privacy and safety measures. The VIPPS program was renamed Digital Pharmacy Accreditation in 2020 to reflect the expanding role of online/digital pharmacies. Online pharmacies that are successfully accredited display the VIPPS seal of approval signifying that the pharmacy is reputable, licensed, and committed to the quality of care. As the digital footprint of pharmacies grows, VIPPS accreditation is increasingly valuable to PBMs/payors and regulators as evidence of credibility and compliance.
Board of Pharmacy Rules & Regulations for Digital Pharmacies
Online pharmacies operating in the United States are required to adhere to a more complex set of rules and regulations in addition to the traditional core requirements governing the operation of a pharmacy. To be considered a legitimate online pharmacy, the pharmacy must obtain multistate licensure, as any pharmacy that ships prescriptions across state lines must be licensed in the state that it dispenses prescriptions into.
In line with that requirement, the online pharmacy is also required to follow applicable state Boards of Pharmacy regulations closely, as there has been increased scrutiny from the state boards, and some state Boards of Pharmacy have even begun to require NABP accreditation or equivalent credentials as a condition of licensure in the state.[1] In addition, online pharmacies are also expected to adhere to stricter website and data security standards as it relates to patient confidentiality, and security of protected health information (“PHI”).
Requirements for PBM Credentialing
In addition to enhanced oversight and compliance requirements at the state level, VIPPS accreditation has also become a hallmark of PBM credentialing applications for pharmacies seeking participation as a mail order pharmacy, and, in some cases, as a specialty pharmacy. Major PBMs, including Express Scripts, CVS Caremark, and OptumRx, often reference VIPPS (or NABP Digital Pharmacy) accreditation in their network enrollment criteria as means of validating operation standards and regulatory compliance. This highlights the PBMs’ growing focus on accreditation as an important benchmark for participation in advanced pharmacy networks, particularly with respect to mail delivery, and specialty services.
Achieving VIPPS Accreditation from NABP: Requirements/Accreditation Process
To obtain a VIPPS/Digital Pharmacy Accreditation, a pharmacy is required to satisfy a comprehensive set of requirements. First, the pharmacy must have valid licensure and be in good standing in all states of operation without any disciplinary action. In addition, the pharmacy applicant’s website must offer at least one interactive digital pharmacy service such as patient counseling/communication, new/refill/transfer prescription requests, and/or patient/prescriber portals, etc. The website must also meet strict technical and operational standards, such as having an active “pharmacy” domain and/or ensuring there is secure communication and privacy protections in place for patients. In essence, the pharmacy must ensure that the website properly demonstrates its services, securely manages PHI and avoids deceptive practices. reflects services, securely handles patient data, and avoids deceptive practice.
If the above-mentioned preliminary requirements are met, the pharmacy is able to submit an application along with any supplemental information and required fees. The application will be reviewed for adherence to the standards, and the pharmacy will be given a guidance checklist. The pharmacy must submit comprehensive written policies and procedures within 90 days of receiving the checklist, and once the requirements are met, NABP will conduct an on-site survey to evaluate compliance with all standards. Upon satisfaction of the requirements, accreditation will be granted where the pharmacy will be subject to annual reviews to ensure ongoing compliance. In addition, permission to display the VIPPS seal is granted and the verified information about the pharmacy is posted on the VIPPS website. Accreditation is important as it can provide the pharmacy with insulation during any audits or investigations by licensing authorities by demonstrating a consistent record of regulatory compliance and transparency.
VIPPS vs. LegitScript
Another entity that provides oversight and certification of online pharmacies is LegitScript. LegitScript is a compliance monitoring and certification company that reviews and certifies businesses (like online pharmacies, telemedicine companies, or addiction treatment providers) to verify that they meet legal, regulatory, and safety standards. It also conducts monitoring to identify “rogue” or non-compliant operators and provides intelligence to regulators, payment companies, and online platforms. Importantly, LegitScript certification can also be required by PBMs (in addition to VIPPS accreditation) to operate as a mail order pharmacy, and, more importantly, many large platforms – like Google, Microsoft/Bing, Facebook/Meta, TikTok, and Visa/Mastercard – require LegitScript certification before allowing advertising by a pharmacy or as a condition to obtain payment processing services. Thus, LegitScript certification is often necessary to accept payments online, and pharmacies that have faced too many complaints or have other red flags have risked having their LegitScript certification revoked, potentially ending their ability to accept payments from patients online.
Contact Our Experienced Attorneys Today
Frier Levitt regularly advises digital pharmacies and other relevant stakeholders on VIPPS accreditation, LegitScript certification and related regulatory matters. Whether assistance is needed in preparing for internal audits and VIPPS readiness, drafting and revising pharmacy policies and procedures, navigating multi-state pharmacy licensure, responding to inspection/audit findings reports, or structuring entities to meet licensure requirements, we can provide tailored guidance to protect your entity’s interests.
Frier Levitt provides strategic, industry-focused legal counsel tailored to your needs. Contact our team today to learn how we can help you.
[1] For example, both Kentucky and Indiana mandate that any pharmacy that dispenses more than 25% of the pharmacy’s total prescription volume as a result of an original prescription order received or solicited through the internet must be accredited through NABP’s VIPPS program. See, Ky. Rev. Stat. § 315.035 and Ind. Code Ann. § 25-26-17-4.5.
Senior Counsel
