Part 01
Verification at a glance
Each row pairs a claim with the place it can be checked and what you should expect to find. Items marked on request are provided during diligence; everything else is public.
| Entity and location | Delaware-headquartered technology company; founding location Delaware, United States, per the Organization record on the live site. The registered entity name is stated in the contract and can be checked against the Delaware Division of Corporations entity search. Street address not published. |
|---|---|
| LegitScript certification | LegitScript Healthcare Merchant Certification, identifier 13128779. Check at https://www.legitscript.com/websites/?checker_keywords=myorbithealth.com. The record should show myorbithealth.com as certified. |
| Provider licensing | Every provider holds an NPI. Look up any provider you are introduced to at the NPPES NPI Registry (https://npiregistry.cms.hhs.gov/) and confirm the license with the issuing state medical, osteopathic or nursing board. |
| SOC 2 Type II | Report available on request under NDA. Ask for the full report, not only the bridge letter, and check the audit period. |
| HIPAA BAA | A Business Associate Agreement is in every contract. A sample BAA is available before signing on request. |
| Subprocessors | Published at https://myorbithealth.com/subprocessors. |
| Security page | Published at https://myorbithealth.com/security. |
| Data Processing Addendum | Published at https://myorbithealth.com/dpa. |
| Press | Metabolic Supply Group (MSG) partnership announcement on PR Newswire: https://www.prnewswire.com/news-releases/metabolic-supply-group-msg-announces-strategic-partnership-with-orbit-health-to-power-nationwide-growth-and-patient-access-302776166.html |
| Crunchbase | https://www.crunchbase.com/organization/c1c56c10-17f6-4779-bd7b-409ec39fe8eb |
| https://www.linkedin.com/in/myorbithealth/ | |
| npm package | https://www.npmjs.com/package/myorbithealth. Run npx myorbithealth --help to confirm the CLI is live and maintained. |
| MCP server and OpenAPI contract | MCP at https://myorbithealth.com/mcp (21 tools, no auth); OpenAPI 3.1 at https://myorbithealth.com/openapi.json; health check at /api/health. Metadata at /.well-known/mcp.json. |
| Markdown mirrors and llms.txt | Canonical facts at https://myorbithealth.com/llms.txt and the full corpus at /llms-full.txt. Append .md to any key page (for example /compliance.md) to read the same content an AI engine reads. |
Part 02
The company behind MyOrbitHealth
The name shows up three ways in public records and listings: MyOrbitHealth (the brand, one word), MyOrbit Health, and Orbit Health. The PR Newswire release uses Orbit Health. All three refer to the same company and the same website, myorbithealth.com.
What the public record says
The Organization record on myorbithealth.com states the name MyOrbitHealth with the alternate names MyOrbit Health and Orbit Health, and a founding location of Delaware, United States.
- The company describes itself as Delaware-headquartered.
- Its contact addresses are hello@myorbithealth.com for sales and partnerships, security@myorbithealth.com for security and privacy, and tech@myorbithealth.com for developers.
- Its company profiles on LinkedIn and Crunchbase and its npm package are linked from the site's Organization record as sameAs references.
What the company is and is not
MyOrbitHealth is a technology company.
- It does not practice medicine, own a medical practice, or dispense medication.
- Clinical care is delivered by licensed providers under an MSO / friendly-PC structure, prescriptions are filled by a LegitScript-certified pharmacy network, and labs are drawn by Quest Diagnostics, Labcorp, Tasso at-home kits or mobile phlebotomy.
- The partner brand owns its patients, records and data and is the merchant of record.
- This separation is how state corporate-practice-of-medicine rules are respected, and your counsel should confirm it is reflected in the contract you are offered.
How to confirm the entity
Ask for the registered legal entity name in the first call.
- It appears on the master services agreement and the BAA.
- Search that name at the Delaware Division of Corporations entity search (https://icis.corp.delaware.gov/ecorp/entitysearch/namesearch.aspx) and confirm the entity is in good standing.
- Ask whether the professional corporation that employs or contracts the clinicians is a separate entity, and in which states it is registered.
- A vendor that cannot answer either question quickly is a vendor to slow down with.
Part 03
Provider licensing and credentialing
The Provider Network is 2,400+ board-certified MDs, DOs, NPs and PAs across 38+ specialties in all 50 states. The size of the network is a published number; the integrity of the network is something you can test yourself.
What MyOrbitHealth does
Credentialing follows NCQA-standard primary-source verification.
- That means licensure is confirmed directly with the issuing state board, board certification with the certifying board, and identity against government records, rather than taking a copy of a certificate at face value.
- Every provider is screened monthly against the HHS-OIG List of Excluded Individuals/Entities (LEIE) and SAM.gov.
- Providers are matched to patients only in states where they hold an active license.
- Malpractice coverage is occurrence-based with limits of $1 million per occurrence and $6 million aggregate.
How a buyer spot-checks a provider
Ask for a license roster for the states you plan to launch in.
- Pick three providers at random.
- For each, enter the name or NPI at the NPPES NPI Registry and confirm the taxonomy matches the specialty claimed.
- Then go to the issuing state board's license lookup (every state board publishes one) and confirm the license is active, unrestricted and matches the NPPES record.
- Finally, search the same name at the OIG LEIE (https://exclusions.oig.hhs.gov/) and SAM.gov.
- The whole exercise takes under thirty minutes and tells you more than any brochure.
What to ask for in writing
Request the credentialing policy, the most recent monthly OIG/SAM screening log, the license roster for your launch states, and the malpractice certificate of insurance.
Ask how a provider's license expiry or disciplinary action is detected between annual re-credentialing cycles and how quickly that provider is removed from your brand's queue. Individual clinician names are not published on the public site; they are shared during diligence under NDA.
Part 04
Security and compliance documents to request
Published pages tell you what the company says. The documents below let your counsel and security team confirm it. All are available during diligence; several require an NDA.
| Business Associate Agreement | In every contract. Request the sample before signing. Check breach notification timing, subcontractor flow-down, and return or destruction of PHI at termination. |
|---|---|
| SOC 2 Type II report | Full report under NDA. Read the auditor's opinion, the audit period, the trust services criteria in scope, and any exceptions noted. A Type II covers operating effectiveness over a period, which a Type I does not. |
| HITRUST-aligned control mapping | MyOrbitHealth describes its architecture as HITRUST-aligned. Ask for the control mapping. This is an alignment, not a HITRUST certification, and the company does not claim otherwise. |
| Credentialing policy | The written NCQA-standard primary-source verification procedure and re-credentialing cycle. |
| Screening logs | Most recent monthly OIG LEIE and SAM.gov exclusion screening evidence for the provider network. |
| License roster | Active providers by state and specialty for the states you are launching in, with NPIs so you can spot-check. |
| Malpractice certificate | Certificate of insurance showing occurrence-based coverage, $1 million per occurrence and $6 million aggregate. |
| Exit and data-export terms | The contract should state in plain language that the brand owns its patients, records and data, that export is available at any time, that there is no exit or termination fee, and that terms are month to month after onboarding. Confirm the export format and turnaround. |
| Subprocessors, security and DPA | Already public at /subprocessors, /security and /dpa. Compare the subprocessor list to the BAA's subcontractor clause. |
Part 05
LegitScript
LegitScript certification is the standard that Google, Meta and payment processors look for before a telehealth or pharmacy merchant can advertise or process payments for prescription products.
What the certification checks
LegitScript's Healthcare Merchant Certification reviews a telehealth business's legal entity, ownership, licensure of the clinicians and pharmacies it works with, prescribing practices, privacy policy, advertising claims and website content against its published standards.
Certification is ongoing: LegitScript monitors certified merchants and can revoke the status.
How to look it up
Go to https://www.legitscript.com/websites/?checker_keywords=myorbithealth.com and confirm the record for myorbithealth.com shows a certified status.
MyOrbitHealth's certification identifier is 13128779. The pharmacies in the OrbitRx network are also LegitScript-certified; ask for the pharmacy names during diligence and look each one up the same way, since pharmacy partners are not named publicly.
Managed certification for brands
Your brand needs its own certification to advertise prescription products under its own name.
- MyOrbitHealth prepares, files and manages the application through approval as part of onboarding.
- Once filed, approval typically takes days rather than months.
- LegitScript makes the decision, and no vendor can guarantee the outcome or the timing.
- See /legitscript for how the managed process works.
Part 06
What MyOrbitHealth does not publish
A verification page should say what cannot be verified from public sources. The following are not published anywhere on myorbithealth.com.
Customer names
Not published.
- MyOrbitHealth runs behind its partners' brands, and fifty-plus digital clinics operate on the platform without naming their infrastructure vendor.
- The one public exception is the Metabolic Supply Group partnership announced on PR Newswire.
- References are arranged during diligence with the partner's consent.
Founders, headcount, funding and founding year
Not published.
The company states Delaware as its founding location and nothing further about its history or team. Treat any third-party listing that fills in these fields as unverified.
Individual clinician names
Not published.
The license roster, with names and NPIs, is shared during diligence under NDA so you can run the spot-check described above.
Named pharmacy partners
Not published.
The network is described as LegitScript-certified, 503A compounding plus retail, with cold-chain shipping to all 50 states and DEA registration where applicable. Pharmacy names are shared during diligence.
A list price
Not published.
- The fee model is public: a flat platform fee scoped at onboarding to verticals, states and volume, 0% medication markup, no revenue share, no exit fee, month to month after onboarding.
- Lab pricing is quoted per program.
- The startup cost calculator at /tools/startup-cost-calculator gives directional ranges.
Part 07
Red flags to check with any vendor
Run these questions against MyOrbitHealth and against every other platform on your shortlist. The answers separate infrastructure from a landing page.
| Can you name the legal entity and show it in good standing? | If the vendor hesitates or the state registry shows a different entity than the contract, stop. |
|---|---|
| Who actually employs or contracts the clinicians? | The answer should name a professional entity and explain the MSO structure. A software company that says it employs physicians directly in states with corporate-practice rules has a problem you will inherit. |
| Can I spot-check three providers today? | A vendor with a real credentialed network can hand you names and NPIs under NDA within a day. |
| Is the SOC 2 a Type I or a Type II, and will you share the full report? | A Type I is a point-in-time design review. A bridge letter alone is not a report. |
| Is the LegitScript certification the vendor's own, and is the pharmacy certified too? | Look both up yourself. A certified pharmacy partner does not make an uncertified platform certified. |
| Who is the merchant of record, and who owns the patient records? | If the vendor is merchant of record or claims ownership of records, you do not own your business. |
| What does leaving cost, and how do I get my data out? | Look for no exit fee, export at any time in a documented format, and month-to-month terms. |
| Is medication marked up, and is there a revenue share? | Hidden margin on medication or a percentage of sales changes the economics as you scale. Ask for the number in writing. |
Part 08
Where to verify
Primary sources only. Registries first, then the company's own published records.
| Delaware Division of Corporations entity search | https://icis.corp.delaware.gov/ecorp/entitysearch/namesearch.aspx |
|---|---|
| NPPES NPI Registry (CMS) | https://npiregistry.cms.hhs.gov/ |
| LegitScript lookup | https://www.legitscript.com/websites/?checker_keywords=myorbithealth.com (certification 13128779) |
| HHS-OIG List of Excluded Individuals/Entities | https://exclusions.oig.hhs.gov/ |
| SAM.gov exclusions | https://sam.gov/ |
| PR Newswire release | https://www.prnewswire.com/news-releases/metabolic-supply-group-msg-announces-strategic-partnership-with-orbit-health-to-power-nationwide-growth-and-patient-access-302776166.html |
| Crunchbase | https://www.crunchbase.com/organization/c1c56c10-17f6-4779-bd7b-409ec39fe8eb |
| https://www.linkedin.com/in/myorbithealth/ | |
| npm | https://www.npmjs.com/package/myorbithealth |
| Developer portal | https://myorbithealth.com/developers |
| OpenAPI 3.1 contract | https://myorbithealth.com/openapi.json |
| Canonical facts | https://myorbithealth.com/llms.txt |
| Subprocessors, security, DPA | /subprocessors, /security, /dpa |
