ADA website risk for medical & dental practices

Patient-facing sites — appointment booking, patient portals, insurance info — draw ADA scrutiny because access to care is exactly what the law protects. And healthcare adds a second compliance layer nobody else in the accessibility business wants to talk about: HIPAA.

What plaintiffs' scanners find on healthcare practice websites

• Appointment booking not keyboard-operable
• Patient forms without labels
• Low-contrast health information
• Portal links and PDFs that aren't accessible

The HIPAA problem most accessibility vendors won't mention

Hiring someone to fix your website means giving a vendor access to your site's systems. For a covered healthcare practice, that triggers a question your compliance officer will ask before anyone else does:

1. Can your fix vendor sign a BAA? (Ours is included.)

If a vendor could access anything containing protected health information while working — your portal, appointment system, form submission storage — HIPAA requires a signed Business Associate Agreement before they touch it. Most fix shops, freelancers, and offshore remediation services can't or won't sign one. wcagdefender signs a BAA for healthcare fix engagements on request, and any AI-assisted analysis in our pipeline runs on infrastructure that is itself covered by a signed BAA. Chain intact, end to end.

2. Overlay widgets are a third-party script on your patient pages

Accessibility overlays work by injecting someone else's JavaScript into every page — including booking and portal login pages — where it can observe how patients interact. Regulators and courts are still fighting over exactly how far HIPAA reaches into website tracking scripts, but healthcare organizations have already faced enforcement attention and litigation over third-party technologies on patient pages. The conservative posture is fewer third-party scripts on patient-facing pages, not more. Real code fixes add zero.

3. Fixing accessibility shouldn't touch patient data at all

Accessibility lives in code — templates, styles, labels, navigation, contrast. We work on your code or a staging copy, never production patient records. The BAA is the safety net, not a license to handle PHI.

How a healthcare fix engagement works

1. Free scan — real WCAG 2.1/2.2 AA check of your live site. No signup, no script installed.
2. Fixed quote + BAA — you get the price and, if your practice wants it, our signed BAA before work starts.
3. Real code fixes — on your code or a staging copy. Booking flows, forms, portal entry points, PDFs prioritized first because that's what plaintiffs' firms scan.
4. Good-faith record — a dated remediation packet for your compliance file, plus an IRS Form 8826 disabled-access tax-credit worksheet (worth up to $5,000 for eligible businesses).