How to Vet a Healthcare Website Design Agency

Section 504’s 2024 final rule sets a specific technical target for federally funded healthcare programs: web content and mobile apps must conform to WCAG 2.1 Level AA ¹. That includes text, images, audio, video, controls, animations, and conventional electronic documents delivered through the site ². A treatment center receiving federal funds does not get to negotiate the standard down to a lower conformance level based on aesthetics, brand guidelines, or budget cycles.

The rule also carves out five exceptions, including archived web content and certain preexisting conventional electronic documents ¹. Any agency proposing to lean on those exceptions to reduce scope should be able to name which category applies, cite the rule’s language, and document the decision. Vague reassurance that “most of the site is covered” is not the same as a written exception analysis.

The practical vetting move: ask the agency which recipient-size compliance deadline applies to the organization, what its documented WCAG 2.1 AA testing methodology looks like, and how it handles the five statutory exceptions when scoping content migration. A vendor that cannot answer those three questions in specifics has not built a healthcare practice around this rule.

An agency page that says “ADA compliant” or “accessibility ready” tells the procurement team nothing. The RFP should force written answers to questions a defense attorney or OCR investigator would ask later.

Ask the vendor to name its target conformance level in exact terms: WCAG 2.1 Level AA, per Section 504’s final rule ³. Ask for the automated tools it uses, the manual testing protocol it runs against those tools, and how many hours of manual testing are budgeted per template. Ask which team members hold accessibility credentials, and whether testing is performed in-house or outsourced.

Ask for a sample Voluntary Product Accessibility Template or accessibility conformance report from a recent healthcare engagement, with client details redacted. Ask how the agency tests with assistive technology, including screen readers and keyboard-only navigation ¹⁰. Ask what the remediation SLA looks like when a defect is found post-launch, and who pays for fixes attributable to the agency’s build.

For content migration, ask how the vendor handles legacy PDFs, embedded video captions, and image alt text at scale. These are the categories where WCAG 2.1 AA failures cluster and where the Section 504 exceptions are most often misread ¹.

An agency that answers each of these in writing, with artifacts, is operating a conformance practice. An agency that answers with adjectives is selling a redesign.

HHS treats risk analysis as the first step in identifying and implementing safeguards for electronic protected health information, and the process must be documented and updated as new technologies or business changes are introduced ⁴. A treatment center’s design agency does not sign the risk analysis, but its choices populate it: which forms collect what fields, where those fields transit, which subprocessors touch the data, and which scripts fire on which pages.

The Security Rule reaches covered entities and their business associates ⁶. A web vendor building an intake form, a chat widget, or a scheduling module for a treatment center is operating inside that perimeter the moment PHI can flow through the code it ships.

The vetting question is whether the agency treats risk analysis as a live operating discipline or as a client problem. Ask for the agency’s internal data-flow documentation from a recent build. Ask which threats and vulnerabilities it identifies at the form layer, the hosting layer, and the third-party script layer, and how it revises that documentation when a marketing team adds a new tag. A vendor that cannot produce artifacts here is one that will hand the risk analysis burden back to the CMO and legal team after launch.

The HHS bulletin on online tracking technologies defines tracking as scripts or code used to gather information about users or their actions, and it warns that tracking technology vendors may themselves be business associates. Disclosures of PHI for marketing purposes without HIPAA-compliant authorization are impermissible under the guidance ⁵. Consent banners and privacy policies do not cure that; a checkbox does not authorize a PHI disclosure that the underlying script was never allowed to make.

On June 20, 2024, a federal court vacated part of that guidance as applied to certain unauthenticated public webpages ⁵. That partial vacatur is the reason the correct answer to “can we run Meta Pixel on the treatment page” is neither a flat yes nor a flat no. The bulletin’s framework for authenticated pages, patient portals, and pages where identifiable health information is collected still stands. What changed is the treatment of some general public marketing pages that do not authenticate the visitor or collect identifiable health information.

An agency that cannot explain the pre- and post-vacatur posture in specifics should not be the vendor writing the tag manager configuration for an addiction treatment site. The right RFP moves are concrete:

• Ask which pages are classified as authenticated versus unauthenticated in the vendor’s proposed architecture.
• Ask how the vendor evaluates each script against the bulletin’s definition of tracking technologies.
• Ask which vendors it treats as business associates and can produce signed BAAs for, and which it refuses to deploy on regulated pages.
• Ask what the incident-response path looks like if a marketing team member installs an unapproved pixel through Google Tag Manager after launch.

The bulletin also matters for session replay, heatmaps, and chatbot transcripts. Each captures user actions in ways that can implicate PHI depending on page context. A defensible agency has a written classification of every category of script it deploys, mapped to the bulletin’s definition and to whether a BAA is required ⁵.

Hosting and CMS decisions carry the same business-associate weight as tracking scripts. HHS guidance on cloud computing requires a business associate agreement that obligates the business associate to report security incidents involving ePHI to the covered entity whose ePHI it maintains ⁷. A treatment center’s website vendor should be able to name every subprocessor in the stack that could touch ePHI and produce the BAA chain for each.

Ask the agency to list the CMS, the hosting provider, the CDN, the form processor, the email delivery service, the chat vendor, and the analytics stack it proposes. For each, ask whether a BAA is in place, who signs it, and what the security-incident reporting SLA looks like. Ask how the vendor handles a subprocessor change mid-contract.

A useful maturity lens for these answers is the NIST Privacy Framework, which frames privacy risk management as an enterprise activity spanning data minimization, transparency, and governance rather than a vendor-questionnaire checkbox ⁸. An agency that speaks that language is one that will not quietly swap a form vendor for a cheaper option that never signed a BAA.

AHRQ’s guide for developers and purchasers of health IT is specific about what “designed for comprehension” means. Content should use plain and clear language, present relevant information, sit in formats conducive to reading and comprehension, and be refined through iterative testing and revision with the intended audience ⁹. The same guide tells purchasers to use HTML over other formats for internet-facing content ⁹. A treatment center site heavy with PDFs, embedded slide decks, or JavaScript-rendered text that never resolves to HTML fails that test before a copywriter opens a document.

ODPHP’s Health Literacy Online guide adds the structural pieces. Page titles and section headings should be marked up consistently, and every task on the site should be completable with a keyboard alone ¹⁰. Those are testable properties. A vendor can be asked to demo a full admissions inquiry using only the Tab, Shift+Tab, and Enter keys, without a mouse.

The vetting move is to ask the agency how it runs iterative user testing with people who match the site’s actual audience, not internal stakeholders. Ask how many rounds are budgeted, at what fidelity, and how findings are logged against specific pages before launch.

The vetting frame narrows here from general healthcare to behavioral health and addiction treatment sites, where the visitor is often in crisis, reading on a phone at 2 a.m., or a family member searching on behalf of someone else. Stigma changes what people will click. Low health literacy changes what they will read. Both change what a competent agency ships.

An agency that has actually built for this audience can point to specific design decisions:

• Level-of-care pages written in plain language rather than clinical taxonomy.
• Insurance verification forms that collect only the fields needed for a VOB.
• Cost and program-length information stated in the same paragraph as the call-to-action.
• Navigation that does not force a visitor through a marketing narrative before reaching a phone number.

These match AHRQ’s guidance on relevant content and comprehension-friendly formats ⁹ and ODPHP’s guidance on consistent headings and keyboard-completable tasks ¹⁰.

Ask candidates to walk a family-member persona through a live client site end-to-end. What they skip, defend, or fail to explain is the portfolio review that matters.