How We Score Providers
Vial scores online TRT, peptide, GLP-1, and longevity providers based on public records: federal, state, and industry. We don’t measure the quality of care anyone delivers. We look at whether a provider’s paperwork holds up.
Two providers can look identical on a homepage. One has clean federal records, named clinicians, public pricing, and a real pharmacy partner. The other has none of that, or has an FDA action sitting on its record. Same vibe, very different reality. The score makes that gap visible.
Every provider carries two numbers. The Vial Check is the headline score: of the things we checked, how many checked out. Record Depthsits next to it and says how much of the record we were able to examine in the first place. Read together, they separate “we looked hard and the record is strong” from “there simply isn’t much on file yet.”
The two numbers
Every provider carries a Vial Check and a Record Depth. One says how much checked out. The other says how much there was to check.
Vial Check
The headline 0 to 100 number. It answers one question: of the things we checked, how many checked out? A provider that confirms a clean federal record, names its clinicians, discloses its pharmacy, and posts its pricing rates high. One that leaves those blank rates lower. The Rating is about what the record confirms, not how much of it exists.
Record Depth
A second 0 to 100 number, shown next to the Rating: how much of the possible record we were actually able to examine. A thin file (few signals on record) gets a low Record Depth and a “Limited data” note, and its Rating is pulled toward a neutral middle rather than swinging high or low on a handful of facts. Missing information lowers Record Depth. It is not counted against the provider as if it were bad news.
What feeds the Rating
Four kinds of public record. We keep the exact weighting proprietary, the way a credit score does, so this is what we examine, not how much each one moves the number.
Regulatory record
Has the FDA, DEA, or OIG taken action against this provider? Is there an active enforcement matter, or only a closed one from years ago? Recent and active findings carry far more weight than old, resolved ones.
Clinical record
Are the actual prescribing clinicians named, or is it just “our team of doctors”? Are they registered in the federal NPI database? Telehealth platforms, clinics, and labs are each held to the standard that fits them, because the relevant signals differ.
Pharmacy and fulfillment
Where do the medications actually come from? Are pharmacy partners disclosed? For a compounding pharmacy, do they hold PCAB accreditation or meet USP standards?
Commercial record
Is pricing visible before signup? Is the membership model clear? Is the domain registered to a real company, or hidden behind a privacy service?
What the colors mean
The Rating sorts into four bands. Only one is a warning color, and it is the only one that needs a confirmed concern behind it.
High Confidence
A clean federal record paired with a well-documented public profile. Strong, but never an endorsement of the care itself.
Well Documented
A clean federal record with an ordinary public footprint. Documented, with some transparency gaps that are normal for the category.
Limited Confidence
A thin or lightly documented record, shown in neutral gray. This is not a warning. It usually means a provider is newer or simply has not disclosed much yet.
Flagged
The only red band, and the only one that requires a confirmed concern: an active federal enforcement matter, an OIG exclusion, a DEA action, or a grey-market classification. A low score on its own never turns red. A score drops into Flagged only when there is something specific on the record.
How scores behave
A few principles worth knowing:
Recent events count more.
A warning letter from 2024 hits harder than one from 2015.
Different provider types get scored differently.
A compounding pharmacy isn’t judged by whether it names physicians. A telehealth platform is.
Severe stuff caps the score.
An active OIG exclusion or active FDA enforcement substantially limits how high a provider can score, regardless of other factors.
Missing data isn’t the same as bad data.
When we can’t find information, the provider doesn’t get penalized. The Record Depth number reflects that we have less to go on, and the Rating settles toward a neutral middle.
Red requires a real concern.
A provider only turns red (Flagged) when there is a confirmed adverse finding on the record: active federal enforcement, an OIG exclusion, a DEA action, or a grey-market classification. A simply thin or low record stays neutral gray, never red.
How we score platforms vs. the companies they use
Some providers, like telehealth platforms, routing services, and lab platforms, don’t own the infrastructure behind your treatment. They route lab work to Quest. They have prescriptions compounded by Empower. They use Labcorp for blood draws.
When we score those platforms, we score them, not their lab partner or their pharmacy partner. A platform’s score reflects what the platform is responsible for: clinical oversight, data handling, pricing transparency, accurate marketing, and its own regulatory standing.
We don’t roll a partner’s compliance into the platform’s score. Quest holding CLIA accreditation doesn’t lift the score of every telehealth company that uses Quest. Two platforms routing through the same lab can score very differently, because the difference is in how the platforms operate, not in the infrastructure they share underneath.
When a partner is disclosed on a provider’s profile, you can look up that partner’s own Vial Check directly. The full chain is visible without conflating it.
If a provider is mis-typed, categorized as something it isn’t, like a routing service typed as a lab, we fix the type, not the score. The Type controls which signals get evaluated. The right Type produces the right score.
Where the data comes from
Public records, all of them:
Warning letters, injunctions, consent decrees, and untitled letters issued by the FDA against providers and manufacturers.
List of Excluded Individuals and Entities. Providers barred from federal healthcare programs.
National Provider Identifier database. Verifies clinicians' active licensing status.
Enforcement actions against providers handling controlled substances, including testosterone (Schedule III).
Accreditation status for compounding pharmacies meeting USP <795> and <797> standards.
Accreditation status, ratings, complaint counts, and alerts. Used as a tertiary signal.
What the score can and can’t tell you
The score is a research tool, not a verdict.
It can tell you
It cannot tell you
A high score isn’t an endorsement. A low score isn’t necessarily disqualifying: sometimes it just means a provider is new or hasn’t disclosed much yet. Treat it like a credit score: useful signal, not the whole picture.
How we stay independent
Providers can pay to add disclosures to their profile. That’s the only thing they can pay for. They can’t pay to influence the score, change placement, or remove anything. A provider with a lowVial Check who pays the verification fee still has a low Vial Check.
Full details on the About page →What Vial Does Not Do: Limits of Public-Record Verification
Not a medical opinion
Vial does not independently audit providers, conduct physical inspections, or issue certifications. All data is sourced from publicly available federal, state, and third-party records. A high Vial Checkreflects strong public compliance signals - it is not a guarantee of quality or safety. Always consult with a healthcare professional before beginning any protocol.
Signal-Specific Breakdowns
Per-signal scoring breakdowns live below. Each section explains how the underlying public record gets weighted in the Vial Check. Detailed pages are in progress.
FDA Enforcement Scoring
Detailed breakdown coming soon.
LegitScript Weighting
Detailed breakdown coming soon.
OIG Exclusion
Detailed breakdown coming soon.
NPI Verification
Detailed breakdown coming soon.
Methodology Changelog
Naming only, no scoring change: the consumer-facing headline score is now called the Vial Check. It was previously named the Confidence Rating (original) and briefly the Verification Score (interim); both names are retired. The 0 to 100 scale, the four examined areas, Record Depth, and every cap and floor are unchanged. Internal identifiers (the Trust Score field, score bands) are unaffected.
Fidelity fix: the care model bonus signal (3 pts, consumer providers only) now requires an explicit sub-classifier confirming how the provider structures its care — single_specialty_focused, primary_care_focused, or maintains_physician_network. A pipeline-written description field that had served as a fallback proxy was removed. The signal itself is unchanged; only what counts as evidence of care-model disclosure is corrected to reflect provider-derived facts, not enrichment coverage.
Moved to a dual model built around two numbers. The Confidence Rating now answers a single question: of the signals we checked, how many checked out. A separate Record Depth number shows how much of the possible record we were able to examine, and a thin record (low Record Depth) pulls the Rating toward a neutral middle instead of swinging it high or low on a few facts. Missing information lowers Record Depth, never the Rating. The four examined areas (regulatory, clinical, pharmacy and fulfillment, commercial) are unchanged, but the page no longer publishes their relative weights. The band-floor rule is now explicit: the red Flagged band requires a confirmed concern (active federal enforcement, an OIG exclusion, a DEA action, or a grey-market classification). A low Rating on its own resolves to a neutral Limited band, never red. Corroborated federal enforcement caps (FDA, OIG, DEA) are unchanged.
Collapsed to four fact-only dimensions: Regulatory Record, Clinical Record, Pharmacy Fulfillment, and Commercial Record. Removed un-auditable inputs from scoring — BBB rating, states served, HSA/FSA acceptance, and membership model no longer affect the score. Founded year and business age are no longer an ‘older is better’ positive signal; instead, a very recently established operation has limited verifiable public history, and the Confidence Rating is capped to reflect that (a newness guard) — this is not a penalty for being new. Age otherwise appears as a displayed fact. Public company status remains a small positive (verifiable SEC reporting), and its prior score floor was removed — public status contributes, it never guarantees. Removed the BBB and domain-newness caps; the misleading domain creation date was replaced with a validated business-age determination. The displayed dimension weights now match the engine exactly. All removed inputs remain visible as ‘Also on record’ facts — shown, never scored. Corroborated federal enforcement caps (FDA, OIG, DEA) are unchanged.
Stated explicit position on platform vs. partner-infrastructure scoring following an internal methodology audit. No algorithmic change. Reclassified two providers (Function Health, InsideTracker) from Lab / Diagnostic to Telehealth Platform. Both route lab work to third-party infrastructure (Quest, Labcorp) and were being evaluated against signals appropriate to lab operators. Type correction produces corrected scores on the next recalc cycle.
Replaced the single-formula scoring with a six-dimension architecture. Each dimension now scores independently and is weighted into a final score. Negative signals are time-decayed (recent events count more than old ones). Severe enforcement actions apply heavier penalties; active federal enforcement caps the final score. Record Depth is now scored separately so providers aren't penalized when public records are sparse. Sparse data lowers Record Depth, not the Confidence Rating. Different provider types get type-aware baselines: a compounding pharmacy and a telehealth platform are evaluated against different signal sets.
Initial release. Single-formula 0-100 score derived from a flat checklist of regulatory and disclosure signals. No dimensional separation, no time-decay weighting, no multiplicative penalties for active enforcement. Provided the baseline corpus for surfacing providers in the directory; superseded by the v2 multi-factor architecture in May 2026.