The LegitScript compliance guide for behavioral health marketers (2026)

If you want to run Google or Facebook ads for your rehab, you need LegitScript. No cert, no ads. That's the rule. In 2026, it costs $1,395-$1,595 to apply and $2,550-$3,095 a year after that, per facility. It takes 6-12 weeks. Most people take way longer than they need to because they don't prep before applying, then LegitScript denies them and they pay the fee again.

This guide is what I wish someone had handed me the first time we walked a treatment center through this. Skip the parts you already know. If you're new to it, read straight through — the goal is to get you certified on the first try.

What LegitScript is, in plain words

LegitScript is a compliance company. Google hired them back in 2017 to check if rehabs are legit before letting them advertise, because too many bad actors were running scam centers and destroying families. Meta did the same thing in 2018. Microsoft (Bing) followed. Nextdoor too.

If you want your ads to show on those platforms, you need the LegitScript stamp of approval. Period. There's no workaround.

The one you need is called LegitScript Addiction Treatment Certification. Don't confuse it with their pharmacy or healthcare merchant cert. Those are different products.

Who qualifies

Before you even think about applying, you need these six things in order:

1. A current state license to treat addiction or behavioral health in every state where you operate. If you have three locations in three states, that's three licenses.
2. Active accreditation from CARF, Joint Commission, or ACHC. State-approved equivalents count too. If yours expired last year, get it renewed first.
3. Licensed clinical staff. The people on your website need to be real, current, and licensed. If your clinical director's license is under investigation, that's a problem.
4. Evidence-based treatment. CBT, DBT, MAT, motivational interviewing, trauma-informed care. Not "our proprietary healing method." LegitScript won't buy it.
5. HIPAA compliance. Notice of Privacy Practices, BAA agreements with vendors who touch PHI, staff training records. If you don't have those documents, get them written before applying.
6. Honest marketing. Every claim on your website must be true. Every photo must be your actual facility. Every credential must be real. LegitScript checks all of it.

One thing that trips people up: gambling addiction, sex addiction, nicotine cessation, and food addiction all fall outside the addiction treatment cert. If that's your main business, this isn't the right path.

What it costs in 2026

Real numbers: a single-facility operator spends around $4,000-$4,700 in year one (application plus first annual), then $2,550-$3,095 a year after. A 5-facility group is closer to $8,000-$10,000 in year one because you pay per facility, though the per-facility rate drops a bit at scale.

Ballpark this against ad spend: if you run $10,000/month on Google Ads, LegitScript costs you less than half of one day of ad spend per year. It pays back inside the first month.

How long it actually takes

The honest answer: 6-12 weeks. Best case if you have everything ready and answer questions same-day: 6-8 weeks. If you have to hunt down documents mid-application: 8-10 weeks. If you have missing accreditation or a licensing issue: 12+ weeks.

Here's where the time actually goes:

1. Week 1 — Self-check. Look at yourself honestly against the eligibility list. Most people skip this and pay for it.
2. Weeks 2-4 — Gather your paperwork. Every state license, every staff credential, your CARF or Joint Commission cert, your HIPAA docs, into one folder. This is where 80% of delays live. People discover their CARF expired six months ago. Or their medical director's DEA registration is at an old address. Or a state license lapsed and nobody noticed. Fix all of it before you hit submit.
3. Same day — Apply and pay.
4. Weeks 5-7 — LegitScript reviews you. They check your licenses, your accreditation, and they read your entire website looking for problems.
5. Weeks 7-8 — They ask questions. Answer same day and you shave 1-3 weeks off the total. Wait a week to answer and you add a week.
6. Weeks 9-10 — Approval + platform hookup. You get the green light, then register your Google Ads and Meta accounts under the cert. Ads run within 24-48 hours after that.

Rule of thumb: if you need ads running by a specific date, start LegitScript 3-4 months before. Every operator who tries to squeeze this into 4 weeks either misses their window or wastes $500-1000 on expedited review that only saves 2 weeks.

The 6 reasons LegitScript denies people

I've seen the same six mistakes over and over. Fix these before you apply and your odds of first-time approval go from about 40% to 90%.

1. Your website doesn't match your operation

The number-one denial reason. Your site says you have a trauma specialist — she left six months ago. Your site says "gender-specific programming" — you don't run it. Your site shows a Blue Cross logo — you only take Blue Cross of one state.

LegitScript reads your entire website and compares it to the staff roster and service documentation you submit. Every mismatch is a red flag. Before you apply, walk your site with fresh eyes and update anything that isn't current.

2. Staff credential problems

Someone listed as "counselor" who isn't licensed. A medical director whose DEA registration expired. A clinical director with an open license investigation in another state. LegitScript verifies every named clinician against state boards. If they can't verify, you get denied.

Fix: before you submit, take every staff member off your website who isn't currently licensed, active, and clean.

3. Your accreditation is expired

CARF is a 3-year cycle. Joint Commission is 3 years. I can't count how many operators submit with lapsed accreditation because renewal fell through the cracks. Check your accreditation expiration date before you do anything else.

4. Undisclosed referral payment arrangements

Patient brokering has been illegal since 2018 under a law called EKRA (the Eliminating Kickbacks in Recovery Act). If you're paying anyone on a per-admit basis, that's a federal crime — and LegitScript looks for it.

Pay your marketing agency flat-fee or per-lead, not per-admit. If you have an existing arrangement that's per-admit, restructure it before applying. This one's not just a LegitScript denial — it can be a real legal exposure.

5. Website content that fails the audit

The high-frequency killers:

• Fake testimonials or reviews you wrote yourself
• Stock photos of people or facilities you don't own
• "Guaranteed recovery" language or promises of specific outcomes
• Published success rates you can't back up with data
• Before-and-after photos of clients (huge HIPAA issue too)
• Staff bios for people who don't work there anymore

All of these need to be gone before you apply.

6. State licensing lapses or investigations

A DUI on the owner's record. A state investigation into billing. A lapsed operating license in a satellite state you forgot about. LegitScript pulls this data from public state databases, so hiding it doesn't work.

Better move: if you have a known issue, disclose it up front with a written explanation and a remediation plan. Owning it goes much better than getting caught.

The pre-submission website audit (2 hours, saves you 3-4 weeks)

Before you upload your application, walk your site and check every one of these boxes:

• Every staff photo, name, and credential is current and verified
• Every service you claim is actually offered at the facility
• Every insurance logo is one you actually accept
• Testimonials have first name + last initial and consent forms on file
• Facility photos are your real facility (no stock)
• Zero "guaranteed" outcome language anywhere
• No published success rates unless you can cite the study or source
• HIPAA Notice of Privacy Practices linked from every intake form
• TCPA-compliant consent language on every phone or SMS opt-in
• Current privacy policy and terms of service

Two hours of cleanup here saves you three to four weeks of back-and-forth with LegitScript reviewers later. Do this before you write the check.

Staying certified year after year

Certification isn't a one-and-done. LegitScript watches you continuously. Your ongoing obligations:

• Annual renewal — updated licenses, updated accreditation, current staff roster, annual fee
• Notify LegitScript of new facilities, ownership changes, service line expansions, or key clinical staff turnover
• Keep your marketing aligned — any change to your website should get gut-checked against what's in your cert
• Maintain accreditation — if your CARF or Joint Commission lapses, your cert is at immediate risk
• Keep state licensing clean — any complaint or investigation can trigger a review

The most common way people lose certification mid-year is a state license quietly expiring because nobody was tracking it. Put one person in charge of the compliance calendar. Every expiration date goes in it. Every renewal starts 60 days out.

Is it worth the money?

For most operators, yes. If paid search or social already drives more than 20% of your admissions, the math is easy. Google and Meta together deliver 40-60% of new admits at a typical center. Without the cert, that whole channel is closed to you. The $2,550-$3,095 annual fee usually pays back inside the first month of running ads.

If you run purely on referral, alumni, and organic SEO — the cert isn't required. But it still helps. Insurance case managers and referral sources check for it. Being certified becomes a trust signal even outside paid ads.

The operators who should think twice are the ones with real compliance gaps. Applying with a lapsed accreditation, a lapsed license, or a bunch of website violations means paying $1,500 to have them documented in LegitScript's system before you get denied. Fix the problems first. Then apply.

Frequently asked questions