SiteBrace

All industries » Healthcare website ADA

Healthcare website ADA compliance: Section 1557, Title III, and the May 2024 HHS rule

Healthcare provider websites sit under two parallel federal regimes: the Americans with Disabilities Act (ADA) Title III for commercial public accommodations, and the Affordable Care Act (ACA) Section 1557 for any covered entity that receives federal financial assistance. The Department of Health and Human Services (HHS) Office for Civil Rights published a final rule in May 2024 that explicitly names WCAG 2.1 Level AA as the conformance standard for Section 1557 covered entities. Site Brace audits provider websites against the same standard for $149 flat.

Short answer: if your practice accepts Medicare, Medicaid, CHIP, or any other federal program payment, your website is a Section 1557 covered entity and must be WCAG 2.1 Level AA conformant under the May 2024 HHS final rule. ADA Title III applies in parallel for any patient-facing website regardless of federal funding. The highest-risk surfaces are patient portals (or the landing pages that link to them), appointment schedulers, downloadable PDF forms, provider directories, and insurance / payment forms. Site Brace audits up to 25 pages for $149 flat. Try a free single-page check on your homepage or patient portal landing first.

The two rules that apply

1. ADA Title III applies to any website with a connection to a "place of public accommodation," which courts have interpreted to include nearly every patient-facing healthcare site (private practices, urgent care, hospital networks, dental offices, specialty clinics). The 9th Circuit's Robles v. Domino's precedent is widely cited. ADA cases do not require federal funding; the litigation pressure on healthcare sites is the same as on e-commerce.

2. ACA Section 1557 applies to "covered entities," which the HHS final rule defines broadly: any health program or activity that receives federal financial assistance, plus all programs administered by HHS itself. In practice, almost every provider that bills Medicare, Medicaid, or CHIP is covered. The May 2024 final rule names WCAG 2.1 Level AA as the conformance standard for covered entities' web content and mobile apps, with a compliance deadline of May 2026 for most covered entities.

For most providers, both rules apply at the same time. The differences worth knowing:

  • ADA Title III is enforced through private lawsuits and DOJ action. Section 1557 is enforced through HHS Office for Civil Rights complaints, investigations, and findings of non-compliance.
  • ADA settlements are typically monetary and remediation-focused. Section 1557 findings can trigger Corrective Action Plans, withholding of federal funds, and reputational exposure that matters for patient acquisition.
  • The technical conformance bar (WCAG 2.1 Level AA) is the same under both. Fixing the site once satisfies both.

Patient portals carry the most weight

The Section 1557 final rule specifically calls out patient-facing digital channels where patients manage their own care. A blind or low-vision patient who cannot read their lab results, request a refill, or message their provider through the portal faces a barrier the rule explicitly prohibits. In practice, the patient portal is often a third-party product (Epic MyChart, athenahealth, eClinicalWorks, NextGen, Cerner) that the provider does not directly control. The provider IS still responsible for:

  • The portal landing page on their own domain (the page that links into the portal product)
  • Patient education content the practice publishes
  • Forms the practice provides (insurance, intake, consent)
  • Any downloadable PDFs the practice produces (the most-litigated single category for healthcare)

The portal vendor handles WCAG conformance inside their product. The practice handles everything on its own domain.

What we typically find on a provider website

Across the healthcare provider sites Site Brace has scanned, the same cluster of WCAG failures shows up.

Findingaxe-core ruleTypical cause
"Patient Portal" link has no accessible name (icon only) link-name Lock icon styled as the entire link with no text
Insurance and intake form fields without labels label Custom form builders that style placeholder text as the label
Downloadable PDF forms not tagged for screen readers Manual finding PDFs exported from Word without accessibility tagging; screen readers cannot navigate
Color contrast on appointment buttons and call-to-actions color-contrast Brand colors (often blue/teal palette) that fail 4.5:1 against white
Provider directory cards lack heading structure heading-order, manual finding <div>-based card grids where provider names should be headings
Appointment scheduler iframe not labeled frame-title Third-party scheduling widget (Zocdoc, NexHealth, etc.) embedded without a frame title
Patient education video has no captions or transcript Manual finding YouTube-embedded provider videos without auto-captions reviewed for accuracy
aria-label on generic elements aria-prohibited-attr WordPress accessibility plugins or theme customizations. See aria-label on a div for why this fails.

A note on PDF forms

Healthcare practices publish more downloadable PDFs than almost any other industry: new-patient intake, insurance authorization, HIPAA notice, consent forms, financial responsibility, post-visit care instructions. PDFs are covered by both ADA Title III and Section 1557, and untagged PDFs are one of the most common Section 1557 complaint categories.

Site Brace's audit covers the HTML pages on your site, not the PDF content itself. Untagged PDFs are a separate workstream (the fix is to either tag the PDF in Acrobat Pro or replace the PDF with an HTML form). The audit will note when a PDF download is linked but cannot test the PDF's interior accessibility.

Why overlays are especially poor fit for healthcare

Overlay tools (accessiBe, UserWay, AudioEye, EqualWeb) are marketed to healthcare providers as a low-effort compliance solution. We have written about why accessibility overlays do not actually make sites WCAG-compliant in detail. For healthcare specifically, two additional considerations apply:

  • Section 1557 is a substantiation regime. The HHS Office for Civil Rights can ask a covered entity to demonstrate WCAG 2.1 Level AA conformance. An overlay subscription is not substantiation; the underlying HTML is what HHS would test.
  • Patient portals require deliberate accessibility work. Overlays do not touch the portal vendor's product. The work of confirming the portal is WCAG conformant is a separate evaluation the practice has to do with the vendor, regardless of whether an overlay is installed on the marketing site.

The FTC's April 2025 settlement with accessiBe ($1 million, 20-year consent decree) adds a third consideration: the federal regulator now treats AI compliance claims as enforceable claims. A provider citing an overlay subscription as evidence of WCAG conformance in response to an HHS complaint would not satisfy the regulator.

How Site Brace audits a healthcare website

The standard page mix for a provider audit covers the high-risk surfaces:

  • Homepage
  • Patient Portal landing page (the page on your domain that links into the portal product)
  • Appointment scheduling page (your page, plus any embedded scheduler iframe)
  • Provider directory (full directory page plus 1-2 individual provider profiles)
  • Services / specialties pages (your top 3-5)
  • Patient resources / forms page (where downloadable PDFs are linked)
  • Insurance accepted / billing pages
  • Contact, Locations, About
  • HIPAA notice, accessibility statement (if you have one), privacy policy

That mix covers up to 25 pages depending on your practice's specific structure. The audit runs axe-core 4.10 against each page, captures element-level screenshots of every contrast failure, and packages the findings into a written report with copy-paste fix code and 12 re-scans included over 12 months.

Pricing is $149 flat, one-time. To see what the report looks like, view a sample report we built for a fictional family-medicine clinic. The findings, the LLM prompts, and the verification steps are representative of what a healthcare provider report contains.

Want to check your own site first? Run a free single-page check on your homepage or your patient portal landing page - one URL, about a minute, no signup needed to see the result.

Start a healthcare website audit, $149

Related: