Are Your Digital Front Door and Virtual Health Services Accessible?

When considering how patients physically enter a hospital or physician office, state and federal law requires that disability accessibility is implemented in the structure's design and construction. Unbeknownst to many, there are similar accessibility laws governing and requiring accessibility to a provider's website and other technology and virtual services (the provider's "digital front door").

Because information regarding healthcare services is now more frequently obtained through digital technology and providers rely on electronic health records, patient portals, websites and other forms of digital health technology to reach the public and their patients, technology and virtual services must be accessible to those with disabilities when these patients and their companions enter through a provider's digital front door. How information about healthcare services must be accessed, viewed, communicated and interacted with through a provider website, kiosk, mobile apps, telehealth platform and other digital health forms is regulated by three legal authorities: the Americans with Disabilities Act (ADA), Section 504 of the Rehabilitation Act of 1973 and Section 1557 of the Affordable Care Act (ACA).

All three laws prohibit discrimination on the basis of disability, but Section 504 specifically requires implementation of digital accessibility standards necessary for ensuring that individuals with disabilities receive equal access to healthcare. Notably, compliance with Section 504 is required by May 11, 2026, and healthcare providers receiving federal financial assistance should assess their digital front doors to ensure they are meeting the standards set forth in the law.

Consequences of Section 504 Accessibility Discrimination

As with Section 1557 nondiscrimination, the U.S. Department of Health and Human Services' (HHS) Office for Civil Rights (OCR) investigates and enforces violations of Section 504. OCR will investigate complaints, initiate compliance reviews or investigations and, if a violation is found, impose corrective action plans, penalties and suspend federal funding and may refer the matter to the U.S. Department of Justice for legal action. OCR's historical enforcement is complaint-driven and typically includes a resolution and settlement process.

Section 504 also provides individuals with the opportunity to seek relief in federal court through direct legal action against healthcare providers who intentionally discriminate or act with deliberate indifference. Class actions and individual litigation have been prominent in alleged ADA digital accessibility violations. In litigation brought by private parties, a court may award damages for financial losses and injuries directly caused by discrimination (in addition to reasonable attorneys' fees and costs). It may also order injunctive relief requiring ongoing compliance efforts and monitoring. Though the majority of ADA litigation has centered on e-commerce sites, the Section 504 compliance deadline applicable to healthcare providers expands this risk in the healthcare sector. Private legal action is in addition to OCR enforcement and does not require prior enforcement action by OCR.

Who Must Comply?

Healthcare providers who receive federal financial assistance, such as participation in Medicare, Medicaid and other federal health plans, as well as Centers for Medicare & Medicaid Services shared savings programs, federal grants and other federally funded healthcare programs, are required to implement digital health accessibility requirements. HHS estimates that 92 percent of doctors, 43 percent of dentists and all hospitals receive federal financial assistance and, therefore, are required to comply. Website content, mobile apps and kiosks must be provided in compliance with Website Content Accessibility Guidelines (WCAG) 2.1 Level A and AA. OCR also made it clear that a healthcare provider may not delegate its compliance obligations under Section 504 to a technology vendor. Few healthcare providers self-develop digital health platforms. For this reason, the burden rests solely on the healthcare providers to ensure that contracted technology vendors deliver digital healthcare in compliance with Section 504.

Which Technology Must Be Compliant?

Section 504 requires that any website content, mobile apps or kiosks provided by a healthcare provider through contract, licensing or other arrangements must be accessible. These include:

• websites (including content and electronic documents)
• website scheduling, registration, payment and other links used by patients or visitors
• electronic health records and patient portals
• kiosks used for registration or check-in and form completion
• electronic communications through email, chat, text and other platforms
• mobile apps for scheduling, payment, communications, education and delivery of telehealth services
• other telehealth platforms and social media posts

There are exceptions to certain types of website content that are generally excluded from WCAG compliance, including previously archived website content, preexisting "conventional electronic documents," preexisting social media posts, content posted by a third party that is not contracted with the healthcare provider, and individualized password-protected or otherwise secured documents.

What Is Required for Compliance?

Website content, mobile apps and electronic documents must comply with Level A and AA WCAG 2.1 standards.

However, there are exceptions. For example: To the extent that an exception is met, healthcare providers must still provide digital technology to the fullest extent possible in compliance with WCAG standards. The decision must be made by the head of the recipient of federal financial assistance "or their designee after considering all resources available for use in the funding and operation of the program or activity, and must be accompanied by a written statement of the reasons for reaching that conclusion." If there is a determination by the recipient that related financial, administrative and technical burdens would result in a fundamental alteration in the healthcare services and care delivered by a provider, documentation should be maintained to support the exception, along with an integration plan demonstrating the path toward WCAG compliance for website content and mobile apps. OCR did not offer any specific examples related to WCAG compliance but pointed out that staffing shortages or increased costs alone were not considered a fundamental alteration.

A conforming alternate version of website content (as defined in WCAG) may be used when technical or legal limitations prevent full WCAG 2.1 compliance. Providers must maintain documentation to support the conforming alternate version and provide the alternate form in a manner that provides accessible website content or mobile apps to the same extent as provided to nondisabled people. OCR pointed out the resulting administrative burden of being required to maintain two or more websites or apps.

In certain limited circumstances, an alternative form of access is permitted. To the extent that technology, such as a kiosk used for check-in, is not designed to accommodate certain disabilities, then an alternative workaround should be made available that offers the same access, convenience and confidentiality as the website, mobile app or kiosk system. In the final rule, HHS noted that at this time, an acceptable workaround for kiosk inaccessibility is to "allow persons with disabilities to go directly to the personnel at the main desk to register for necessary services." A home health provider who participates in a qualifying program and offers an artificial intelligence-enabled virtual nurse to a patient with a hearing disability must ensure that the technology-enabled services are delivered in a manner that accommodates the patient's hearing impairment through, for instance, real-time close captioning or live transcription. However, OCR has noted that providing telephone access as an alternative to online access is not an acceptable alternative, as it does not likely meet the timeliness or ease-of-use requirements. In such limited circumstances when an alternative is available, a healthcare provider may also demonstrate that the noncompliance has such a minimal impact on access that it would not affect the individual's ability to access the same information, engage in the same interactions, conduct the same transactions or otherwise participate in the same healthcare activities as individuals without disabilities. The alternative must allow access in a matter that provides substantially the same timeliness, privacy, independence and ease of use.

HHS has provided examples of practices that it may consider noncompliant such as "requiring people to schedule vaccinations on websites that are not compatible with screen-reader software," requiring "the use of a computer mouse to select necessary boxes," "using an online application for benefits for a human service program that is incompatible with screen readers," "providing health care information on videos on websites or mobile apps that are not captioned" or "using a telehealth platform that does not permit the addition of a sign language interpreter on a video call."

Though this alert focuses on digital accessibility compliance requirements, note that the final rule for Section 504, effective July 8, 2024, addresses a number of other nondiscrimination compliance obligations. The final rule adopted regulatory provisions reflecting many ADA requirements in addition to digital accessibility and the final rule requires that all providers communicate effectively with disabled patients and disabled companions of patients through auxiliary aids and services, including interpretation for hearing impaired. This communication requirement mirrors the existing requirement in Section 1557 of the ACA regarding communications and availability of auxiliary aids and applies to written and spoken communications, telecommunications and other forms of communication (effective on July 8, 2024). Other compliance obligations relate to providing accessible medical equipment effective as of July 8, 2026. The HHS website contains information regarding the full scope of Section 504 nondiscrimination requirements.

When Must a Provider Comply?

For providers with more than 15 employees, the deadline to comply is May 11, 2026. For providers with 15 employees or fewer, the compliance deadline is May 10, 2027. 

Practical Considerations and Steps

Now is the time for healthcare providers to make sure their digital front door is open to everyone and that virtual services are available to all patients regardless of disability status. To ensure they can comply by the deadline, providers should engage in a number of tasks that include the following:

• Budget for appropriate resources necessary for compliance and assign staff or departmental responsibilities, including appointing an individual to oversee compliance, field accommodation requests and serve as a liaison to OCR if needed.
• Develop a prioritized remediation plan to ensure full compliance by the applicable deadline (as early as May 11, 2026).
• Adopt and implement policies and procedures and train staff. Although Section 504 does not require policies, OCR will review policies and procedures in its investigation of alleged noncompliance.
• Implement processes to identify disabilities in patients and companions, engage in usability testing, create a mechanism for reporting barriers, respond to requests for accommodations and incorporate feedback from people with disabilities on website content and mobile apps.
• Identify all website content, mobile apps and kiosks and assess all digital health technologies or compliance with WCAG standards, which may require coordination and cooperation of vendors. Providers should also consult with legal counsel to consider engaging a qualified third-party accessibility auditor, under privilege, to examine accessibility issues.
• Review electronic documents, such as patient handbooks, notice of privacy practices and other documents made available electronically, for WCAG compliance.
• Consider and assess potential comparable alternatives for inaccessible digital health and accommodations for various forms of disabilities (i.e., hearing-impaired, speech disability, sight-impaired, hearing- and sight-impaired, intellectually impaired, mobility impairment and mental health disabilities).
• Integrate accessibility requirements into vendor and services procurement diligence and implement periodic audit, evaluation and monitoring processes.
• Review digital health contracts and license agreements and incorporate appropriate provisions for compliance obligations and risk mitigation.
• Document and maintain written records of initial and ongoing compliance efforts, including audits performed, remediation steps taken, training logs and vendor communication to help demonstrate good faith and defend against claims of "deliberate indifference."
• Document all alternative forms of accessibility offered.
• To the extent that compliance results in a "fundamental alteration" in a healthcare program or undue financial and administrative burden, the exception must be documented as required by the law.

Conclusion

In today's environment, a healthcare provider's digital front door is likely a patient's or visitor's first experience with the provider. Creating and offering a digital presence that affords equal access to, and delivery of, healthcare services requires coordinated compliance activities, cooperation of technology vendors, and leveraging of outside resources and expertise. As always, the objective for providers remains the same: ensuring that all individuals have access to quality healthcare.

If you have further questions on this matter, please contact the authors.

Information contained in this alert is for the general education and knowledge of our readers. It is not designed to be, and should not be used as, the sole source of information when analyzing and resolving a legal problem, and it should not be substituted for legal advice, which relies on a specific factual analysis. Moreover, the laws of each jurisdiction are different and are constantly changing. This information is not intended to create, and receipt of it does not constitute, an attorney-client relationship. If you have specific questions regarding a particular fact situation, we urge you to consult the authors of this publication, your Holland & Knight representative or other competent legal counsel.