LegitScript vs. NABP: The Two Certifications That Actually Mean Something

Every GLP-1 telehealth site has a badges section near the footer. "HIPAA Compliant." "Certified." "Verified." "Licensed." Most of these badges are decoration. Two aren't. LegitScript and NABP are the certifications that actually mean something in this category — and here's why.

What LegitScript does

LegitScript is a private certification and monitoring company. In the pharmacy and healthcare context, it evaluates operators against a set of published standards — licensing, compliance with state and federal law, sound business practices, verification of disclosed information.

LegitScript certification matters because:

• Google Ads requires it for healthcare advertisers. Operators advertising prescription drugs on Google must have LegitScript certification. This alone means most legitimate telehealth operators pursue it.
• Facebook/Meta also requires it for pharmacy-related advertising.
• The certification is not trivial to get. LegitScript reviews documentation, checks licenses, confirms disclosed clinician and pharmacy relationships, and monitors for ongoing compliance.
• The certification is not permanent. LegitScript can revoke certification if a platform misbehaves, and does.

An operator without LegitScript certification is either too new to have it, can't get it, or doesn't advertise on Google/Meta. The first case is neutral. The other two are signals.

What NABP does

The National Association of Boards of Pharmacy is the professional body for state pharmacy regulators. Its accreditation programs include:

• Verified Pharmacy Program (VPP) — evaluates pharmacies against NABP standards.
• Digital Pharmacy Accreditation — specific to online pharmacies.
• .pharmacy Top-Level Domain — NABP controls the .pharmacy TLD; sites on it have been vetted.

NABP accreditation of the pharmacy (not the telehealth platform) is what you actually want. A VPP-verified 503A pharmacy compounding your GLP-1 has demonstrated compliance with state pharmacy standards beyond the baseline required by law.

How to verify each

1. For LegitScript: visit legitscript.com/verified-websites, search the platform's domain. Status should be "Certified." If the platform claims LegitScript but the lookup returns nothing, the claim is false.
2. For NABP VPP: visit nabp.pharmacy and use the VPP lookup. Enter the pharmacy name (not the telehealth platform — remember those are different entities). A verified pharmacy will appear with its accreditation details.

The badges that mean nothing

A non-exhaustive list of logos that appear on GLP-1 telehealth sites that don't mean what you think they mean:

"HIPAA Compliant"

HIPAA compliance is a legal requirement for handling protected health information. It's not a certification. There is no HIPAA badge authority — any website can display "HIPAA Compliant" regardless of whether they are. Enforcement is retroactive; HHS OCR acts after breaches, not proactively.

"SOC 2 Compliant"

Real certification, but it's about information security infrastructure, not medical quality. A platform can have impeccable SOC 2 and terrible medical care. SOC 2 is the IT equivalent of "our servers don't leak passwords," which is great but not the same as "your prescription is safe."

"AMA Member" / "ANCC Certified"

Individual clinician credentials, not platform credentials. If a platform's badge says the medical director is AMA or ANCC certified, that's a real credential for that person, not for the platform overall.

"BBB Accredited"

BBB accreditation is a paid membership, not a quality seal. Any business can pay for BBB accreditation regardless of actual quality. The BBB rating (A+, B, etc.) is more meaningful than the accreditation badge itself, and even that has methodology quirks.

"Trustpilot Excellent"

Trustpilot badges reflect the review score, which as we covered in Article #12 is heavily gamed. The badge itself is not earned through any review process.

Fabricated "award" badges

"Best Telehealth 2025." "Top-Rated Weight Loss Provider." These usually trace back to no organization at all, or to award mills that sell the right to display a badge. Legitimate industry awards — from NEJM Catalyst, the American Telemedicine Association, or similar professional bodies — do exist, but they're rare and the platforms with them prominently cite the issuing organization.

The hierarchy, in order

If you had to rank badges by how much they matter:

1. NABP VPP (on the pharmacy) — highest signal for drug safety.
2. PCAB accreditation (on the pharmacy) — voluntary, high bar, strong signal.
3. LegitScript Certified (on the telehealth platform) — solid baseline.
4. State license verification — not a badge, but the actual underlying regulatory reality.
5. Everything else — decoration.

Why good platforms don't always have NABP/LegitScript

Some legitimate platforms deliberately don't pursue LegitScript — usually because they've built their patient acquisition without Google Ads (referrals, content, affiliate networks) and don't need the certification. LegitScript costs real money and real time. A newer operator that doesn't advertise on Google may be perfectly fine but uncertified.

Similarly, not every legitimate 503A pharmacy is NABP VPP-verified. VPP is voluntary. A state-licensed pharmacy with a clean record and PCAB accreditation is plenty legitimate without VPP.

So the inverse isn't automatic. "No LegitScript" doesn't mean "bad platform." But "claims LegitScript but isn't in the database" is a definitive lie.

The three-badge audit

1. Click every badge on the site. Do they link to verifiable records?
2. For LegitScript or NABP specifically, verify via the issuing authority's lookup.
3. Check whether the underlying credential is current — expired certifications are still sometimes displayed.

The ten minutes this takes is the single cheapest filter on bad operators. Most scams can't survive it. Most legitimate operators pass it easily. The gap between the two tells you almost everything you need.