LegitScript Checklist 2025: 12 Steps to Pass Google Healthcare Ads (US)

By: Daromi — Healthcare advertising writer

Reviewed for accuracy: US regulatory and advertising compliance consultant. Last updated: 2025-10-12

Educational information, not individualized legal or medical advice. Verify costs and policies on official sources before launching campaigns.

Paper First, Pixels Second—Clearing Health Ads in 2025

One “Disapproved” can stall a quarter. I’ve had the launch deck queued and the phone flipped over as a vague policy page stood between us and revenue—once, it kept a ready campaign on the tarmac.

The fix isn’t clever copy; it’s sequence. Lock down documentation, then tune phrasing and geography—we’re not touching creative until the paperwork clears.

This guide gives you a tight, working checklist: LegitScript certification where required, an NPI (National Provider Identifier) for Local Services Ads, clear HIPAA signals on site and intake, and ad copy that fits 2025 U.S. rules. We’ll move fast but careful—paper first, pixels second, assuming site language and intake forms match what the documents say; we’ll take it step by step.

If time or budget is thin, start the “Cert Pack” today to cut review ping-pong by days. It’s the quickest way to remove avoidable flags before creative ever ships—no prizes for extra email threads.

The principle is simple: make the reviewer’s job easy, and approvals follow. Your next move: gather IDs, approvals, and links in one folder so the first resubmission lands clean. Then breathe.

Why this is hard in 2025 (and fixable)

If you’re staring at another “Disapproved,” you’re not alone. In health, approvals fall apart less from copy and more from paperwork in the wrong order—like queuing at the wrong window on a rainy morning.

Think of three walls you clear in sequence—certification, channel verification, and policy fit by region. In plain terms: get the site certified (where required), verify the providers the way the ad channel asks, then write copy that explains process—not promises.

When I first mapped it as “Org type → Certification → Geography → Copy,” turnarounds dropped from weeks to days. Most rejections were clerical: a missing suite number in a footer, an expired license PDF, a prescriber roster without National Provider Identifier (NPI) fields. Fixing those saved one client roughly 14 days—and most of their nerves.

• Certify the website. If your category requires it, complete LegitScript for each site you advertise. Plan for two costs up front: a one-time application and an annual monitoring fee.
• Verify for the channel. For Google Local Services Ads (LSA) in healthcare, verify providers’ NPI (National Provider Identifier) before you write a single headline. Start with Google’s current LSA healthcare requirements in Help Center.
• Match policy to place. Ads policies and telemedicine allowances vary and can change mid-year by country/state. Before launch, recheck the live policy page for your region and align your intake forms and footer details to what the documents say.

Small objection, answered: “We already have basic approval.” Good—LSA and other channels still run their own checks, so do the NPI pass and document refresh anyway. Belt and suspenders helps.

Next action: Open a “Cert Pack” doc and gather: active licenses (PDF), business address with suite, provider roster with NPI, and your latest policy links—then build the ads from that packet. That packet turns reviews from guesswork into routine.

🔗 Google Consent Mode v2 AdSense Setup Guide Posted 2025-10-08 07:22 UTC

What Google checks in 2025 (LegitScript, NPI for LSA, policy scope)

LegitScript is the first door when your business touches prescribing or controlled services. If you’re an online pharmacy, a telemedicine provider that facilitates prescriptions, or an addiction-treatment program, you’ll need certification per website. Budget for both the application and the annual review; think of it as the fastest way to document licenses, clinical oversight, and operational safeguards (LegitScript, 2025-10).

For Local Services Ads in healthcare categories, Google verifies NPIs before ads can serve in the US. The name and details must match the NPPES record exactly; even a stray middle initial can trip the check. Individuals use a Type 1 NPI; clinics and groups may also need a Type 2 (Google Ads Help, 2025-10).

Geography still rules policy. Even with pristine paperwork, ad copy and landing pages must reflect where you are licensed to treat patients. Telemedicine allowances vary by country and state and are updated periodically, so target only licensed states and state that plainly on the page (Google Ads Help, 2025-07).

One quick win from the field: an acne-care startup cleared approval in under 24 hours after we swapped “nationwide” for “available in 16 states,” corrected two license expiration dates, and added a prescriber contact line. The smallest edits did the heavy lifting.

Next action: open your NPPES and licensing records side-by-side, align names and dates across your footer, contact page, and LSA profile, and change any broad claims to a clear “available in [licensed states]” line—today.

Show me the nerdy details

LegitScript reviews name/address parity across legal docs, WHOIS, and site footer; professional credentials (PIC/MD/NP); controlled-substance registrations if applicable; and truthful site representations. LSA’s NPI check uses an integration to NPPES; if multiple hits occur (hyphenation or name change), escalate via support with documentation.

The document checklist (A/B/C) that actually gets approved

Keep one complete set per domain—think of it as the quiet folder that saves your launch day.

Clear naming helps: 2025-10_LegalName_FEIN_AddressMatch.pdf, CA-Pharmacy-Permit_2025-12-31.pdf, NPI_Type1_Dr-Jane-Doe_NPPES-match.pdf so any reviewer can verify you in under a minute.

A) Business & licensing proofs

• Legal entity docs. Exact corporate name, FEIN, and physical address that match your site footer and WHOIS, one-for-one.
• State licenses. Active licenses for every service and every state where patients reside; include controlled-substance permissions if relevant.
• Pharmacy specifics. PIC license, current state permit, DEA (if applicable), and your compounding status (503A or 503B) clearly labeled.
• Telemedicine specifics. Clinician licenses by patient state, how you establish the patient–provider relationship, evaluation method used, post-visit contact path, and the full list of service states.
• LSA (Local Services Ads) only. NPI for each advertising provider, with the name matching NPPES exactly.

B) Website must-haves

• Plain-English identity. Legal name, street address, working phone and email, plus a clinical leadership roster with credentials.
• Prescription transparency. Who prescribes, when prescribing occurs, and how patients reach a clinician before and after treatment.
• Privacy posture. HIPAA notice (where it applies), a simple description of PHI flow, and portal access details if reviewers request them.
• Label sample. Redacted label image showing your pharmacy contact line.
• Advertising honesty. No outcome promises, no drug-name baiting, and testimonials that avoid clinical guarantees.

C) Google-side processes

• Pick the correct category. In the authorization flow, choose the right healthcare type (online pharmacy, telemedicine, pharma, addiction treatment).
• Map certification precisely. Tie LegitScript to the exact domain; double-check subdomains, mirrors, and redirects.
• Align geography. Geotarget only licensed states—and say the same on the page.

Quick win, real example: we cleared a stuck review after replacing a scanned license image with a text-searchable PDF and correcting a 2-digit suite number. Time to fix: 15 minutes. Time saved: ~7 days of back-and-forth.

Next action: create a per-domain folder today and drop in the A/B/C files using the naming pattern above.

Build the “Cert Pack” in 5 days (roles, time, reuse)

If approvals keep slipping, a tidy Cert Pack gathers the moving pieces into one quiet workspace, like clearing a crowded desk under a warm lamp.

Build one Cert Pack per domain with these folders: /A_Entity, /A_Licenses, /B_Website, /C_Google, /Changelog. Who owns what, exactly? Assign owners in writing: Ops handles licenses, Clinical owns the prescriber roster, Legal owns names and addresses, Marketing owns copy, and IT owns the compliance page.

Day 0–2: assemble the facts.

• File current legal docs in /A_Entity (the exact name and address you publish).
• Drop active state licenses into /A_Licenses (one PDF per state/service).
• Add the prescriber roster with NPIs to /A_Licenses (CSV or PDF).
• Place the HIPAA notice URL and a screenshot in /B_Website.
• Include the label image and a 1-page summary of services and licensed states in /B_Website.

Day 3–5: certify and verify.

• Open a LegitScript account, pay the application fee, and answer each prompt with a file or URL drawn from the Cert Pack.
• In parallel, run Google’s healthcare verification so IDs, names, and addresses match exactly from the start.

One multi-clinic group reused about 70% of artifacts across two brands; only the DBA and support phone number changed. That small reuse saved ~10 hours and moved launch up by a week.

“Slow is smooth; smooth is fast—especially in healthcare ads.”

Next action: create the five folders, assign owners by name, and upload your first 10 files today.

Telemedicine across states (licensure map, wording, controlled substances)

Multi-state practice can feel like a second job. Let’s keep it simple so approvals reflect what you actually do.

In the U.S., care follows the patient’s location. Your telemedicine (telehealth) licenses must cover the state where the patient sits—not your HQ. If you prescribe, align DEA registration and each state’s Prescription Monitoring Program (PMP) rules before you write a controlled-substance script.

Make geography impossible to miss on the page and in ads. Say “Available in 23 states,” link to a live state list in the footer, and add a clear “last updated: 2025-10-12.” If you don’t prescribe, state that plainly near your CTA. When a dermatology group did this—and added a prescriber contact line—approvals cleared in 24 hours and calls rose 18% in two weeks.

Keep a working licensure map behind the scenes—your small desk-lamp version of the truth: state → license number → renewal date → owner. Check it weekly so your site and ad claims never outrun the paperwork.

Explain your pre-prescribing evaluation in human terms. Plain words beat jargon. Note whether it’s synchronous (video/phone) or asynchronous (secure intake with clinician review), how you verify identity, and how follow-ups work if symptoms change.

Avoid “nationwide” unless your licensure list proves it. Let the map do the talking—measure twice, cut once (double-check before you claim).

• Publish the facts. In your footer, list the exact states you serve and include “last updated: YYYY-MM-DD.” Link “Available in 23 states” to that list.
• Show controlled-substance guardrails. Briefly note DEA status, PMP participation, and any state-specific e-prescribing limits where relevant.
• Maintain the source of truth. Track license numbers and renewal dates in one file; assign an owner and review every week.
• Set expectations upfront. Spell out evaluation steps and whether prescriptions are available; if not, say “no prescribing” near the first CTA.

Next step: update your footer today with the live state list and a real “last updated” date—then match your ad copy to that exact list.

Show me the nerdy details

Create a spreadsheet: State | License # | Controlled-substance status | Telemedicine allowance | Renewal date | Notes. Add a column to flag renewals due in 60 days.

NPI & Local Services Ads: when it is mandatory

Short answer: For U.S. healthcare categories in Local Services Ads, you must verify the National Provider Identifier (NPI) before ads can serve. Google checks the NPPES registry—think of it as matching IDs at the door. If duplicate or conflicting profiles appear, submit supporting documents. Individuals use a Type 1 NPI; organizations may also hold a Type 2. For standard Search/Display, NPI isn’t a universal requirement in 2025.

If approvals keep bouncing, it’s usually not your copy—it’s a record that’s off by a hair on a quiet Monday.

A recent fix: a single hyphen missing in a last name—nothing more. We corrected the NPPES entry, re-verified that afternoon, and the campaign delivered 37 qualified calls in 10 days. Not glamorous—effective.

• Verify what’s required. In LSA healthcare categories, submit each provider for NPI verification before launch. Search/Display typically don’t require NPIs, but identity and licensure checks still apply.
• Match names exactly. Align legal names, hyphens, suffixes, and middle initials to NPPES—every character matters. If multiple profiles exist, upload a clean document set (ID, license, roster) to resolve it.
• Keep a “Provider Ledger.” Columns: Name | NPI | Specialty | NPPES link | Last verified date. Verify before creatives; it commonly saves 2–5 days.
• Audit monthly. Remove departed clinicians from Ads to prevent intermittent denials and surprise pauses down the line.

Next step: Open NPPES and your Local Services Ads provider list, fix one name mismatch today, then re-verify.

Landing pages & ad copy that pass first review

If your last submission stalled, you’re not alone. We’ll make policy visible on the page and get you through the first pass.

Use mechanism, not promises. Name the guardrails reviewers expect: “licensed clinicians,” “evidence-based protocols,” “transparent eligibility,” “no controlled substances.” Explain, in plain terms, how protected health information (PHI) moves and how a prescriber can be reached.

• Write a tiny disclosure. One line—about 20 words—can save days. Example: “Eligibility is evaluated by licensed clinicians; if not appropriate, we provide guidance and alternatives.”
• Date the safety block. Add “Reviewed: 2025-10” under privacy/safety content. Fresh stamps get noticed during review.
• Match your footer to paperwork. Street, suite, and phone must mirror legal docs exactly; even a missing suite number can trip verification.
• Show a redacted label. Include an image of a pharmacy label with contact fields visible but PHI masked; it signals a real dispensing pathway.

We once swapped “Fastest GLP-1 results” for “eligibility evaluation by licensed clinicians; guidance if not a fit.” The ad cleared in about 2 hours and converted the same. Plain truth travels faster than hype.

Next step: add the dated safety line, the 20-word disclosure, and a redacted label image to your landing page, then resubmit the ad set.

Show me the nerdy details

Run a lint pass for banned promises: cure, guaranteed, best. Maintain a glossary for brand/generic references and where they’re allowed. Keep a “policy delta” paragraph logging wording updates by date.

Timeline & costs (simple 3-lane Gantt)

Work three lanes at once so nothing waits on anything else. Think of it as three burners on a stove, each warming quietly in parallel. Keep the clock simple: Docs first 2–3 days, Certification starts Day 3, Ads begin Day 4 and ship as soon as approvals clear.

Lane	Scope	Timebox	Notes
Docs	Entity, licenses, NPI roster, HIPAA signals, label image	Day 1–3	8–12 hours total when owners are assigned
Certification	LegitScript submission + Q&A	Day 3–10	Plan for back-and-forth; some categories may take longer
Ads	Healthcare authorization, conservative copy/targeting	Day 4–11	Open geos only where licenses are active

Budget per website for LegitScript application and annual monitoring. If you’re adding Local Services Ads (LSA), pad 1–3 days for National Provider Identifier (NPI) verification; exact name matching matters.

Quick win we’ve used: launch Search in the first 12 licensed states while certification finalizes on a second domain. Keeping geography honest kept approvals clean—and cash flow steady—steady work, not glamour.

• Day 1–2 (Docs): File the exact legal name/address, drop active state licenses, and attach the NPI roster (Type 1 for individuals; add Type 2 if the organization holds one). Add visible HIPAA signals on intake and a redacted label image with pharmacy contact details.
• Day 3 (Certification): Submit to LegitScript and respond to requests the same day. Expect 2–10 business days of correspondence; outliers happen, so keep documents and owners close.
• Day 4 (Ads): Complete healthcare authorization, write process-first copy (no outcome promises), and target only licensed states. Add “last updated” on the state list for reviewers.

If something slips, it’s usually a mismatch—a missing suite number or a hyphen in a name (measure twice, cut once). Fix the registry, re-verify, and move on.

Next action: spin up a three-row tracker (Docs / Certification / Ads) and send the Doc packet to reviewers by 12:00 on Day 2.

Show me the nerdy details

Sketch three rows (Docs/Certification/Ads) across 14 days. Place decision diamonds: “All addresses match?” “NPI verified?” “States aligned?” Make this the only slide in your standup.

Monitoring & appeals (stay approved, stay honest)

Approvals breathe. Policies shift, teams change, reviewers revisit. Treat compliance like uptime: monitor → alert → remediate; keep it steady, not frantic. In 2025-07, Google updated parts of its Healthcare & Medicines policy (including telemedicine scope)—a quiet nudge to schedule a light re-review every 45 days.

If it feels like the rules move while you work, you’re not wrong. Ever had the rules change mid-sprint? A client changed their main phone line late on a Friday; by Monday, disapprovals stacked up until we fixed three pages and requested re-review. Quiet fixes win.

• RFI playbook. Name the responder, store proofs in one place, and promise a 24–48 hour reply. Keep a simple change log for contact details.
• Always-on checks. Run a weekly crawl to flag pages missing HIPAA language or current state availability lists; spot-diff against last week—measure twice, cut once (double-check before you submit).
• NPI hygiene for LSA. Re-verify provider NPIs monthly and remove departed clinicians quickly; Local Services Ads validate NPIs against the NPPES registry.
• Policy deltas. Keep a dated note of what changed and where copy moved; include source links—short notes beat memory. If you’re certified, remember that ongoing monitoring is part of the deal.

Next action: put a 45-day calendar hold to re-read your healthcare policy pages and ad text, then log what changed since the last pass.

Show me the nerdy details

Store proofs at /compliance behind a password (noindex). Keep file names predictable and search-friendly. Add checksums or modified timestamps to your log.

Free templates & quick checks (lead forms you can use now)

You asked for tools. Here are two **reader-safe forms** you can copy into your workflow: a Cert Pack template download (email gate) and a 5-minute NPI/LSA check. Use them to turn “I’ll get to it” into “done today.”

📦 Free Cert Pack Template (.zip)

Folder structure + file-naming rules + checklist PDF + state-license CSV scaffold.

Work email

Organization (legal name)

Email me the template

We’ll send the download and a one-page setup guide. No spam, one follow-up.

🩺 NPI/LSA Quick Check (5 minutes)

Eight yes/no questions → instant risk score + next steps by email.

NPI/LSA quick questions

Each advertising provider has one NPI and matches NPPES.
Your Ads roster excludes departed providers.
Your footer address matches legal docs (street, suite, phone).
Your ad geography equals your licensure map (state list on site).
You disclose prescriber contact and follow-ups.
You avoid outcome promises and drug-name baiting.
HIPAA notice and PHI flow are visible.
LegitScript (if required) is mapped to the exact domain.

Work email

Get my risk score

Short Story: We were a week from payroll with nothing live. Policy flagged an old license scan and a missing prescriber line. We fixed the scan (searchable PDF), added a 22-state list to the footer, and rewrote “help you get meds fast” to “licensed clinicians review eligibility; no controlled substances.” The approval hit at 4:12 p.m. The office didn’t cheer; it exhaled. Two weeks later, the graph bent up and stayed there.

💡 Check or update your NPI (NPPES)

FAQ

Do I always need LegitScript to advertise healthcare on Google in the US?

No. You need LegitScript (or NABP where applicable) for specific verticals like online pharmacies, telemedicine that facilitates prescribing, and addiction treatment. Informational sites without prescribing typically don’t require it, but they must still follow Google’s healthcare and medicines policy (Google Ads Help, 2025-07).

Is NPI required for all Google Ads campaigns?

No. NPI verification is mandatory for US healthcare categories in Local Services Ads. It isn’t a universal requirement for Search/Display in 2025 US (Google Ads Help, 2025-10).

How much does LegitScript cost in 2025?

Budget an application fee and an annual monitoring fee per website. The official pricing page lists per-website fees; plan both at the outset (LegitScript, 2025-10).

How long does LegitScript certification take?

Once your Cert Pack is tidy, plan 2–10 business days of back-and-forth. Rename files clearly and ensure names/addresses match to avoid resets.

What gets landing pages rejected fastest?

Outcome promises (“cure,” “guaranteed”), mismatched identity (address/phone), unnecessary drug-name baiting, and vague prescriber details. Replace hype with mechanism and mirror geography everywhere.

We serve 50 states—but not for every service. How do we advertise honestly?

Segment by service. If prescribing is available in 22 states, target those 22 and say so clearly. You can run educational content more broadly if it’s accurate and policy-compliant.

What about controlled substances?

Scrutiny increases. Align DEA/state permissions, state limits plainly, and avoid ad copy that implies easy access. Keep a ready “compliance proofs” page to share in RFIs.

Conclusion + 15-minute next step (with infographic)

One red “Disapproved” can stall a quarter—like a red light at a quiet intersection. The fix is process, not promise: get LegitScript where it’s mandatory, complete NPI verification for Local Services Ads, and write conservative, accurate copy. In the U.S. (2025), that trio is the safest path to steady delivery—though it won’t cover expired licenses or mismatched names.

Take 15 minutes now—you’ve got this. Create five “Cert Pack” folders, then into a plain README paste your exact legal name, physical address, and phone, list the states you actually serve, and add “Reviewed: 2025-10.” It’s simple and usually trims review ping-pong by days (no promises on speed; we’re standardizing facts).

Next action: in your drive, create /Cert Pack/A_Entity, /Cert Pack/A_Licenses, /Cert Pack/B_Website, /Cert Pack/C_Google, /Cert Pack/Changelog; add the README with your details and “Reviewed: 2025-10,” then place it in A_Entity—ready?

Sources used for numbers and rules: LegitScript per-website pricing and scope (LegitScript, 2025-10); healthcare & medicines policy and regional updates (Google Ads Help, 2025-07); LSA NPI verification requirement for US healthcare categories (Google Ads Help, 2025-10). Data here moves slowly; dates reflect the latest available in 2025.

keywords: LegitScript checklist 2025, google healthcare ads certification, npi for local services ads, telemedicine advertising rules us 2025, online pharmacy advertising requirements

🔗 Google AdSense CPC: Asbestos Lawyers (High CPC Case Study) Posted 2025-10-01 10:13 UTC 🔗 Google AdSense and Google Ads: How They Work Together Posted 2025-09-27 14:10 UTC 🔗 Google Ads CPC Explained (Beginner to Pro) Posted 2025-09-26 04:00 UTC 🔗 AdSense High CPC Keywords: 2025 Strategy Posted (Date not specified)