Your practice website and the ADA: what is actually required
Two separate things are in play, and most of what is written about them online is out of date. One is private litigation under ADA Title III, which reaches every practice. The other is the HHS rule for practices that bill Medicare or Medicaid, whose deadline moved in May 2026 and is now 2027.
What the rules actually say
No single federal statute says "a doctor’s website must meet WCAG". Two separate routes get you there, and they land on different practices with different consequences.
- ADA Title III
- The professional office of a health care provider is a place of public accommodation. Courts have read that to cover the website that serves it, and this is the route that produces private lawsuits and demand letters. There is no compliance date, because it already applies.
- The HHS rule
- Section 504 of the Rehabilitation Act, implemented by the final rule of May 9, 2024 and running alongside Section 1557 of the ACA. It applies to recipients of HHS federal financial assistance, which in practice means billing Medicare, Medicaid or CHIP.
- The deadline, as it now stands
- An interim final rule published May 11, 2026 extended both compliance dates by a year: May 11, 2027 for recipients with 15 or more employees, May 10, 2028 for those with fewer. Anything still saying May 2026 was written before that.
- What standard
- WCAG 2.1 level AA, for web content and for mobile apps. That is written into the HHS rule and it is the standard settlements under Title III normally require too.
- What it costs to be wrong
- Under Title III it is not a fine, it is a lawsuit: your own legal costs, the plaintiff’s, and a consent decree that makes you remediate anyway. Under the HHS rule it is an OCR investigation and, at the far end, your federal funding.
Accessibility is not a box ticked once. A template change, a new image with no alt text or a rebuilt form can break compliance without anybody at the practice noticing.
What your website has to do, specifically
The standard is long. On a practice website it comes down to six things, and these are the ones that fail in practice and the ones an accessibility complaint gets built from.
Enough contrast on all text
Text has to stand out from its background enough to be read with low vision. By some distance the most common failure.
How to check it: Look at the light gray text on white: captions, disclaimers, form hints.
Alt text on images
Every image carrying information needs a description a screen reader can read aloud.
How to check it: If a photo of your team says nothing with images turned off, its text is missing.
Labeled forms, usable by keyboard
Every field with its label, and the whole request-an-appointment form reachable with the Tab key, without a mouse.
How to check it: Press Tab from the top: if you reach submit without touching the mouse, it is fine.
Links and buttons with accessible names
A screen reader has to announce where each link goes, not just say "link" or "button".
How to check it: Bare icons with no text, like the phone or the map pin, are the usual suspects.
Zoom allowed on mobile
The page has to let itself be enlarged. Plenty of templates disable it so the layout does not break.
How to check it: Open your site on a phone and pinch to zoom. If nothing moves, it is blocked.
A dated accessibility report you can produce
Not required by name the way an EU accessibility statement is, but it is what a demand letter is answered with, and it is what shows the work was done before somebody complained.
How to check it: If nobody can tell you when the site was last tested, there is nothing to produce.
Which of these reaches your practice?
Worth separating before anything else, because the two routes have different deadlines and different consequences, and one of them may not reach you at all.
The HHS rule may not reach you if
- You do not bill Medicare, Medicaid or CHIP, which is the case for a good number of cash-pay med spas, elective cosmetic practices and private-pay therapy practices.
- Even then, ADA Title III still applies to you, and that is the route that actually produces letters.
If you are outside the HHS rule we tell you so in the audit rather than selling you a deadline that is not yours. What we will still show you is the Title III exposure, because that one has no threshold.
Both reach you if
- You bill Medicare, Medicaid or CHIP in any volume.
- You have 15 or more employees, which sets your HHS date at May 11, 2027 rather than 2028.
- You run a patient portal, online scheduling, online forms or online payment.
- You are a group practice or a DSO, where a single template failure repeats across every site you own.
In the free audit we tell you which of these you are in before you buy anything. If neither reaches you in any serious way, we say so and the conversation ends there.
What actually happens, and in what order
There is no schedule of fines here the way there is in Europe, and anybody quoting you one is describing a different country. This is what the exposure looks like in practice.
The usual first contact
A plaintiff firm runs an automated scan, finds the contrast and the unlabeled buttons, and writes. It costs money to answer whether or not it has merit.
3,117 filed in 2025
Federal web accessibility filings, up 27% on 2024 and the second highest year on record. Over 5,000 counting state courts. Healthcare is about 2 to 3% of them.
HHS recipients only
Complaint-driven or a proactive compliance review, with referral to the Department of Justice available and federal funding at the far end of it.
Source: Filing counts from the annual ADA Title III federal court tracking published by Seyfarth Shaw; HHS obligations from the Section 504 final rule of May 9, 2024 and the interim final rule of May 11, 2026 extending its compliance dates.
A separate point, because practices are still being sold the wrong version of it: tracking pixels on your public pages are not a HIPAA violation on their own. The part of the OCR bulletin that said otherwise was vacated in American Hospital Association v. Becerra on June 20, 2024 and OCR withdrew its appeal that August. Anything behind a patient portal login is a different matter and is still covered.
What a public test finds on 2,136 private clinic websites
These numbers are Spanish, and we say so every time we use them. In August 2026 we drew 6,499 centers at random from the Spanish national register of healthcare centers and ran the accessibility test against the 2,136 websites we could identify and verify. We publish them here because the tool is the free one anybody can run on your site, and because contrast, unlabeled buttons and disabled zoom are template failures rather than national ones.
95.5%
fail at least one accessibility criterion
122 of 125
hospitals and hospital groups, the ones with no size exemption anywhere
4 failures
account for almost all of it, and all four are fixable without a rebuild
And it is almost always the same four things
- 79.5%Insufficient color contrastLight gray text on white that somebody with low vision cannot read.
- 65.2%Links and buttons with no accessible nameA screen reader announces "link" and nothing else, so there is no way to know where it goes.
- 48.8%Headings out of orderAnybody navigating by jumping between headings loses the structure of the page.
- 24.3%Zoom disabled on mobileStops somebody enlarging the screen to read, right at the point of requesting an appointment.
Method: Google Lighthouse via PageSpeed Insights, free and public, run in August 2026 against a stratified random sample of the Spanish national register of healthcare centers. Percentages are over the 2,136 verified websites. You can reproduce any of these figures by putting your own address into that tool, which is the point of quoting them.
What we do
Audit, remediation and a dated record that the work was done. On the website you already have, without rebuilding it unless there is no other way.
We audit criterion by criterion
With the same public test used in the study, plus the manual review an automated tool cannot do.
We fix what fails
Contrast, alt text, link and button names, heading structure, zoom and full keyboard navigation.
We test the step that matters
That an appointment can be requested with a screen reader and with the screen enlarged on a phone. That is where accessibility stops being theoretical.
We date the record
A report with the score before and after, so if a letter arrives you can show the work predates it.
We check the tracking
Separate from accessibility. Analytics and ad pixels on public pages are fine; anything gathering data behind a portal login is not, and that distinction is where practices get into trouble.
We measure again every month
Because a change to the website can break compliance, and a stale report proves nothing.
And a site we build starts compliant
Every website we publish is checked against WCAG 2.1 level AA before it goes live. This site passes with no violations, and you can verify that with the public tool.
How we work
Free audit
We run your website through the test and give you back the list of criteria it fails and how serious each one is. No cost, no obligation.
We tell you which rules reach you
Whether the HHS rule applies, what your date is, and what your Title III exposure looks like regardless. If the answer is "not much", we say that.
We fix it
On the website you already have. We only propose rebuilding it if it is too old to take the corrections.
We document it
A dated report with the score before and after, which is what answers a demand letter.
We keep watch
Monthly measurement and an alert if a change has broken something, with the same person on the phone the rest of the month.
Client results
We track what happens from the first inquiry to the appointment the patient attends.
72
new patient inquiries in the first month
19
appointments recovered from leads that had gone cold
$17,200
in treatment booked by patients the clinic already had
What our clients say
We have been working with 360 for several years and they have always been professional and reliable. They have helped us grow the business and build steady acquisition funnels that bring a constant flow of patients. They also look after our reputation and our social media.
Salud Dental BlancoSpainBefore working with 360, we were generating leads but losing too many because follow-up was inconsistent. Their team gave us a more structured system to contact, qualify and book patients into the clinic.
Dra VianySpainWe used to have several agencies and tools running different parts of our marketing, but there was no strategy holding them together. With 360 everything sits in one place: advertising, SEO, the website, social media, online reputation and patient follow-up. Now it feels like there is a team watching the whole process, from attracting the patient to making sure they actually arrive at the clinic.
TricapSpainFlat monthly fee, month to month
Compliance sits inside the Growth 360 plan, along with your website. If you only want the legal side, say so in the audit and we will quote it separately.
New Patients
$1,490/month
Ads, every new patient call and form answered in minutes, appointments booked, and your recall list worked.
- Ad creative: video, image and copy
- Campaign management, A/B tests and monthly reporting
- Every inquiry called and texted back within minutes
- Screening, scheduling and confirmation before the appointment
- Reactivation campaigns for overdue recall and unscheduled treatment
Growth 360
Most chosen$2,990/month
Everything above plus your website, your rankings, your content, your social and your reviews.
- Everything in the New Patients plan
- A fast website, built and maintained by us
- WCAG 2.1 AA verified, with a dated report you can show if asked
- Full SEO audit and technical fixes every month
- Up to 30 articles published on your site each month
- Original research reports that earn links and bring patients in
- Keyword and competitor research, tracked over time
- Managed presence on Instagram, Facebook and LinkedIn
- Outreach by email and LinkedIn, with the replies handled
- Reviews and reputation managed on your Google Business Profile
All our services
Compliance is one of the eight. You can buy them separately or all together, and open each one to see what it covers.
Frequently asked questions
Is my practice website legally required to be accessible?
Two answers, and you probably have both. Under ADA Title III a health care provider’s office is a place of public accommodation, courts have read that onto the website, and there is no threshold and no start date because it already applies. Separately, if you bill Medicare, Medicaid or CHIP, the HHS Section 504 rule requires WCAG 2.1 level AA by a fixed date.
What is the deadline? I keep seeing May 2026.
It moved. The original dates were May 11, 2026 for recipients with 15 or more employees and May 10, 2027 for smaller ones. An interim final rule published on May 11, 2026 extended both by a year, so they are now May 11, 2027 and May 10, 2028. A lot of pages written in early 2026 still quote the old date and have not been updated.
We are cash pay and take no insurance. Does any of this reach us?
The HHS rule probably does not, and we will tell you that rather than sell you a deadline that is not yours. ADA Title III still does, and that is the one that produces demand letters, so the practical answer is that you should still be able to show your site was tested.
How likely is a lawsuit, really?
Federal web accessibility filings hit 3,117 in 2025, up 27% on the year, and healthcare is roughly 2 to 3% of them. So healthcare is not the most targeted sector and we are not going to tell you it is. What has changed is that plaintiff firms scan at scale, and a site failing contrast and button names on every page is trivially easy to find.
Do I have to rebuild the whole website?
Almost never. Most of what we measure is fixed on the existing site. If it is too old to take the corrections we say so and consider rebuilding, but that is not the usual case.
How do I prove I complied?
With a dated audit report showing the score before and after and the criteria corrected, kept current. The date is the part that matters: a report produced after a letter arrives is worth much less than one produced a year before it.
Is my Google or Meta pixel a HIPAA problem?
On your public pages, no, and anybody telling you otherwise is quoting a document that no longer stands. The Northern District of Texas vacated that part of the OCR tracking bulletin in June 2024 and OCR withdrew its appeal that August. Behind a patient portal login it is a different question and the answer there is still yes, be careful.
Where do your figures come from?
The litigation counts come from the annual ADA Title III federal filing tracker. The 95.5% is our own study, and it is Spanish: in August 2026 we drew 6,499 centers from the Spanish national health register and audited the 2,136 websites we could verify, with Google Lighthouse via PageSpeed Insights. We have not run the equivalent census in the United States, so we do not claim a US percentage.
Check whether your website would survive a scan
We run your website through the same public test a plaintiff firm would, and tell you what it fails, which rules reach your practice and what it would take to fix. Within 24 hours, no obligation.