Two compliance issues show up in nearly every digital front door assessment I run, and both have moved from theoretical risk to documented cost. Neither requires a redesign to start fixing. Both require someone to actually go look.
1. Tracking technology on authenticated pages
Health systems have paid more than $100 million across roughly 19 settlements tied to tools like Meta Pixel and Google Analytics running on authenticated patient portal sessions. Allina Health settled for $12.5 million in 2026. Atrium Health settled for up to $1.8 million. These aren’t hypothetical exposures anymore — they’re a documented pattern of litigation with a consistent fact pattern: a third-party script, loading on a page where a patient is logged in or discussing a specific health condition, sending data to a company with no Business Associate Agreement covering it.
In the audits I’ve run of large healthcare organizations’ public-facing pages, the findings vary more than you’d expect. Some are genuinely clean — no ad-tech or social pixels detected anywhere in the pages tested, which is a real, defensible differentiator worth stating confidently once verified. Others carry a specific, narrower risk: a legitimate vendor, like an embedded chat widget, sitting on a sensitive-topic page and receiving visitor interaction data with no documented confirmation of its BAA status. That’s a fundamentally different, more manageable problem than an undisclosed ad-tech pixel — but it still needs an answer, in writing, from whoever owns that vendor relationship.
What to actually check:
- Which third-party scripts load on authenticated pages and on named sensitive-topic content (behavioral health, oncology, reproductive health, and similar).
- Whether a consent mechanism exists, and whether it actually gates those scripts from firing before consent is given, not just after.
- Whether your booking or scheduling flow — often the single highest-intent, most identity-adjacent page in the entire experience — sits inside your own consent governance or has quietly moved to a third-party vendor domain outside it.
- Whether every vendor with access to patient-adjacent data has a current, specific BAA on file.
2. Accessibility deadlines that are no longer optional
HHS’s rule under Section 504 and Section 1557 requires WCAG 2.1 AA conformance for organizations receiving HHS federal financial assistance — which covers most hospitals and health systems in the country, including any whose only federal assistance is Medicare Part B. HHS pushed the deadline back a year in May 2026: May 11, 2027 for organizations with 15 or more employees, May 10, 2028 for smaller ones. The lawsuits haven’t waited for the deadline to arrive — Frazier v. HCA Holdings alone named more than 159 hospitals and facilities over inaccessible websites.
What moving deadlines don’t change is what the actual defects tend to look like once someone runs a real scan instead of a visual glance. Across the audits I’ve run, the same small set of issues recurs constantly: heading structure that skips levels or is missing entirely, pages with no main content landmark for assistive technology to jump to, interactive elements — icon-only buttons, image-wrapped links — with no accessible name at all, insufficient color contrast on navigation and call-to-action elements, and video content with no caption track.
None of these require a redesign. Most are config-level or component-level fixes — a heading tag, an aria-label, a CSS color value, a caption file. The catch is that automated scanning tools only reliably catch roughly a third to half of WCAG’s actual success criteria; the rest — reading order, focus behavior, real screen-reader flow — needs a human to actually test it. A clean automated scan is a floor, not a finish line.
Governance as an enabler, not a blocker
I don’t think compliance work should be the department that says no. The better question isn’t “can we do this” — it’s “how do we accomplish the goal while responsibly managing the risk.” Sometimes that means an MVP instead of a perfect solution on day one. Sometimes it means fixing the two or three highest-severity findings this month and sequencing the rest. Either way, the fix starts with an honest, specific inventory of what’s actually running on your pages today — not an assumption based on what your last vendor contract said should be there.
Know what’s actually running on your pages?
Sources: aggregated pixel-tracking settlement analysis; HIPAA Journal on the Allina Health and Atrium Health settlements; HHS OCR interim final rule (May 7, 2026) extending the Section 504/1557 WCAG 2.1 AA deadline to May 11, 2027 (15+ employees) / May 10, 2028 (under 15 employees); Frazier v. HCA Holdings; Jackson Lewis and AudioEye on DOJ Title II vs. HHS Section 504/1557 accessibility deadlines.
