Medical website compliance

Three federal rules govern your website. Most practices can't name them.

ADA Title III, HHS Section 504 and HIPAA all reach your practice's website, and they overlap without lining up neatly. Smaller practices carry the same obligations as large health systems, without the compliance staff to manage them. Here's how to tell where you stand, what each rule requires, and what it costs to get this wrong.

Already know you have a problem? Have us audit your site free — it takes a minute.

Section one

Is my website compliant?

Almost certainly not — and that isn't a comment on your practice.

Large-scale surveys of the web find that roughly 95% of home pages fail automated accessibility testing before a human reviewer looks at anything. Medical practice sites are not an exception, and the ones built by reputable agencies fail too. Most of these sites were built to a standard that was normal at the time and has since moved.

The useful question isn't whether you're compliant. It's which specific things on your site would fail, how exposed each one makes you, and how long they'd take to fix.

Five checks you can run yourself in ten minutes

None of these require a developer. If any one of them fails, the rest almost certainly do too — these problems travel together.

  • Can you reach your booking button with the Tab key?

    Click into the page, then press Tab repeatedly without touching your mouse. If you can't see where you are, or can't reach the appointment button, neither can a patient using a keyboard or screen reader.

    Keyboard only

  • Does your intake form label its fields?

    Open your new patient form and click into a field. If the grey prompt text vanishes and nothing else identifies the field, it was a placeholder, not a label. This is the most common serious failure on medical sites.

    Look at the form

  • Is your text dark enough?

    Light grey body copy and pale brand colours are the single most common failure on the web. Contrast is measurable, not a matter of taste — a free checker gives you a pass or fail in seconds.

    WebAIM contrast checker

  • Do your images have alt text?

    Right-click any provider headshot and choose Inspect. If there's no alt attribute, a screen reader announces nothing, or reads the filename aloud.

    Inspect element

  • Does anything track patients behind your portal login?

    Analytics on public pages is fine. The same scripts running inside a patient portal are a different matter entirely, and need a signed Business Associate Agreement.

    Ask your developer

Every one of these is fixable, and most are quick. What matters is knowing which apply to you.

Rather not do it by hand?

We'll run all five, plus the checks that need tooling — contrast measured rather than eyeballed, tracking scripts traced, every page instead of just the homepage — and send you the findings in plain English.

Request free audit

Section two

What medical website compliance actually requires

Three rules, from different agencies, enforced in different ways. Meeting one does nothing for the other two, and almost every independent practice is covered by all three.

ADA Title III

U.S. Department of Justice

Your website is treated as a place of public accommodation. There is no filing, no certification, no warning, and no small-business exemption.

Exposure arrives as a demand letter. Plaintiff's firms find targets with automated scanners and cite the same short list of violations nearly every time.

Section 504

HHS Office for Civil Rights

Applies to any provider receiving federal financial assistance — in practice, anyone billing Medicare or Medicaid.

It names a specific standard: WCAG 2.1 Level AA. Enforcement runs through OCR and is tied to your federal funding rather than a fine.

HIPAA

HHS Office for Civil Rights

Reaches your site wherever patient information moves: intake forms, the patient portal, appointment requests and third-party scripts.

Anywhere data passes to a vendor, a Business Associate Agreement has to pass with it.

The accessibility deadline moved. That's the bad news.

In May 2026, HHS pushed its Section 504 web accessibility deadline back a full year. The standard didn't soften — the extension happened because too few providers were going to meet the original date. The agency has effectively confirmed that most practices are not compliant.

Original deadline May 2026

Extended on 7 May 2026 after HHS received reports that community health centers, small hospitals and primary care practices could not meet it.

15 or more employees 11 May 2027

Websites, patient portals and mobile apps must conform to WCAG 2.1 Level AA. Most independent practices fall into this cohort.

Fewer than 15 employees 10 May 2028

Same standard, one additional year. Smaller practices get more time, not a lighter obligation.

Six problems cause almost every failure

A handful of error types account for the overwhelming majority of accessibility failures across the web. They are unglamorous, they are the ones plaintiff's firms cite, and they are all fixable.

  • Low contrast text

    Pale grey on white, or a brand colour that looked right in the mockup and fails measurement. The most common failure on the web.

    WCAG 1.4.3

  • Images without alt text

    Provider headshots, facility photos and logos that a screen reader announces as nothing at all — or reads aloud as a filename.

    WCAG 1.1.1

  • Form fields without labels

    Usually the new patient intake form, which makes it the one that matters most. A placeholder is not a label — it disappears the moment someone types.

    WCAG 1.3.1 / 3.3.2

  • Empty links

    Icon links, logo links and social buttons with no text inside them. A screen reader reaches them and has nothing to say.

    WCAG 2.4.4

  • Empty buttons

    Menu toggles, search icons and carousel arrows built with an icon and no accessible name.

    WCAG 4.1.2

  • Missing page language

    One missing attribute in the page's opening tag. Seconds to fix, and it decides whether a screen reader pronounces your site correctly at all.

    WCAG 3.1.1

If someone sold you an accessibility widget, you are not covered

Overlay tools promise compliance from a single line of JavaScript. They don't deliver it, and courts have not treated them as a defence. In the first half of 2025, roughly 23% of all web accessibility lawsuits named websites that already had an overlay widget installed.

The Federal Trade Commission fined overlay vendor accessiBe $1 million in 2025 for misrepresenting its product as guaranteed ADA compliance.

We don't sell overlays. Accessibility is something a site is built to be, in its markup and its design decisions — not something applied to the outside of it afterward.

Where your analytics sit matters more than whether you have any

A 2024 federal court decision in American Hospital Association v. Becerra vacated the HHS guidance that treated an IP address plus a visit to a public health-related page as protected health information, and OCR withdrew its appeal in August 2024. Analytics on your homepage is not, by itself, a HIPAA violation. Anyone telling you otherwise is behind on the case law or selling you something.

That ruling did not touch authenticated pages. Tracking scripts inside a patient portal still require a signed Business Associate Agreement or valid patient authorisation, and most practices have neither. Separately from HIPAA, pixel-based class actions under state wiretapping and privacy statutes remain active and have produced multi-million-dollar settlements against health systems.

Section three

What non-compliance costs

You'll see very large numbers quoted on this subject, usually by companies selling a widget. The honest picture is more useful: the ceiling is high, the realistic exposure for an independent practice is lower, and the cost that actually catches practices out is the emergency remediation, not the penalty.

HIPAA penalties

HIPAA is the only one of the three with a published fine schedule. Penalties sit in four tiers according to culpability, and HHS adjusts them annually for inflation. The figures below took effect on 28 January 2026.

HIPAA civil monetary penalties, effective 28 January 2026
Tier Applies when Per violation Annual cap
Tier 1 You did not know, and could not reasonably have known $145 – $73,011 $36,506
Tier 2 Reasonable cause, not wilful neglect $1,461 – $73,011 $146,053
Tier 3 Wilful neglect, corrected within 30 days $14,602 – $73,011 $365,052
Tier 4 Wilful neglect, not corrected $73,011 – $2,190,294 $2,190,294

The $2.19 million figure you'll see quoted in marketing material is the Tier 4 ceiling — wilful neglect, left uncorrected. A practice that discovers a tracking script behind its portal and fixes it is in Tier 1 or 2, where OCR's published enforcement discretion caps annual exposure far lower.

ADA lawsuits and demand letters

Federal ADA Title III gives a private plaintiff no automatic money damages — only a court order to fix the site, plus their legal fees. That sounds mild until you look at how it works in practice. Plaintiff's firms attach state law claims that do carry damages: California's Unruh Civil Rights Act provides a statutory minimum of $4,000 per violation, per visit, and New York's human rights laws allow compensatory damages with no cap. New York and California together account for roughly three-quarters of all filings.

Typical resolution costs, web accessibility claims
How it resolves Typical cost What's included
Demand letter ~$5,000 Settled before filing, usually with a remediation commitment attached
Settled out of court ~$30,000 Payment plus plaintiff's legal fees plus a remediation deadline
Full lawsuit $45,000 – $75,000 Combined settlement, your own defence costs and court-ordered remediation

There is no small-business exemption, and the majority of web accessibility suits target companies with under $25 million in annual revenue.

Section 504 and your federal funding

Section 504 works differently, and the difference matters. There is no fine schedule. OCR investigates complaints, requires corrective action within a set timeframe, and the ultimate sanction is termination of federal financial assistance — meaning your Medicare and Medicaid participation. That outcome is rare and reserved for sustained refusal to cooperate. The realistic consequence is an OCR investigation, a corrective action plan, and remediation carried out on the government's timetable rather than yours.

The number that actually catches practices out

It isn't the penalty. It's that remediation performed under a legal deadline costs roughly three to four times what the same work costs when it's planned. You lose the ability to schedule it, to bundle it with a redesign you were going to do anyway, and to choose who does it.

A practice that fixes its site in 2026 pays for a website. A practice that fixes it in response to a demand letter pays for a website, a lawyer, a settlement and a rush fee — for the same site.

Free, no obligation

Find out what your site would fail on today

Enter your practice's web address and we'll run the full audit — WCAG 2.1 AA findings, form and tracking review, and a plain-English summary of what each finding means and how serious it is. Usually back within one business day.

We'll send the report and nothing else. No newsletter, no follow-up sequence unless you ask for one.

Sources

  1. HHS Office for Civil Rights, Section 504 web accessibility compliance date extension, 7 May 2026.
  2. HHS civil monetary penalty inflation adjustment, Federal Register, 28 January 2026; OCR notification of enforcement discretion, 30 April 2019.
  3. American Hospital Association v. Becerra, N.D. Tex., 20 June 2024; OCR notice of appeal withdrawn 29 August 2024.
  4. Federal Trade Commission enforcement action against accessiBe, 2025.
  5. WebAIM Million annual accessibility evaluation; published ADA Title III litigation tracking, 2025 and first half of 2026.
  6. California Civil Code §51 (Unruh Civil Rights Act); New York State and New York City Human Rights Laws.