Can you sell prescriptions on Shopify?

What exactly is the problem?

Two things, and the second is the one that bites.

No BAA. Under HIPAA, a vendor handling protected health information on your behalf has to sign a business associate agreement. Shopify does not sign one for its commerce platform, so it cannot lawfully be that vendor.

The acceptable use policy. It prohibits using Shopify to collect, store or process PHI. So this is not a gap you can accept the risk on quietly. It is a term of service you would be breaking, with account-level consequences available to them.

The trap is that it is easy to cross without noticing. A storefront alone is fine. Add one intake question about a medical condition, or a note on an order about a prescription, and you have put PHI in a system that is not allowed to hold it.

What do brands actually do?

They split it. Shopify does the catalogue, the cart and the payment. A separate HIPAA-compliant system does the intake, the clinical review, the prescription and the pharmacy routing. It is a real and common architecture.

What it costs you is the seams. Two systems means two sources of truth about a customer, and the joins are where things go wrong: a patient approved clinically but never charged, a subscription that renews after a prescription lapsed, a refund in one system that the other does not know about.

It also costs you the renewal, which is where telehealth revenue actually lives. A refill needs to know whether the prescription is still valid and whether a fresh intake is due, and that is clinical state living in the other system. Wiring that across a boundary is the most expensive integration in the build, and it is the one most hybrid setups do last and badly.

What does a prescription store need that a commerce platform does not have?

Six things, and none of them are a plugin.

Intake that branches and whose answers are treated as medical records rather than order notes.

A clinical decision in the middle of checkout, where a licensed prescriber can approve, ask a question or decline, and the order waits for them.

Charging that follows the decision, so a declined patient is not billed and an approved one is, which is not how a cart works.

State rules per product, enforced before payment rather than after.

Pharmacy routing, with the prescription, the dose and the shipment tracked back to the order.

Renewals that understand prescriptions, including when a new intake or a new visit is required before the next charge.

When is Shopify still the right answer?

When nothing you sell is a prescription. Supplements, cosmetics, devices and wellness products with no clinical gate are exactly what it is good at, and no amount of compliance architecture improves on it there.

It is also reasonable when you already have a large Shopify business and are adding a prescription line, because the cost of the seams may be less than the cost of moving everything. That is a real calculation and it sometimes comes out that way.

What does not work is treating a prescription brand as a Shopify store with a questionnaire bolted on. The questionnaire is the part that makes it a different kind of business, and it is the part Shopify's own terms exclude.

Dispense Flow is the other shape: storefront, intake, licensed providers, pharmacy routing, subscriptions and payments in one system, with a signed BAA on every plan. Pricing is published, which is also not the norm in this category.