Skip to main content

Category: Compliance

  • Your Emergency Plan Is Probably Fine. Your Evidence File Probably Is Not.

    The CMS emergency preparedness requirements rest on four elements: an all-hazards risk assessment and emergency plan, policies and procedures based on it, a communication plan, and a training and testing program. In our experience, organizations facing a survey have the first two in reasonable shape. The citations come from the third and fourth.

    Why the communication plan fails

    The communication plan is the only element of an emergency preparedness program that decays passively. A risk assessment written two years ago is still broadly valid. A contact list written two years ago is wrong. Staff have left, physicians have changed groups, the emergency management coordinator has a new number, and the after-hours line goes somewhere else now.

    A surveyor does not have to test your plan to find this. They pick three entries and ask when the list was last verified.

    What the training and testing record needs to show

    Not that training occurred — that it occurred, for whom, on what content, and that the people who needed it received it. A defensible file contains:

    • The curriculum or content actually delivered, retained as a document rather than described from memory
    • Attendance records tied to individuals, including contractors where they are in scope
    • Evidence of initial training for new staff, not only the annual cycle
    • Exercise design documents showing what scenario was tested and why
    • After-action reports identifying what did not work, which is the point of the exercise
    • Documentation that after-action findings were incorporated into the plan — this is the loop most organizations leave open

    The after-action loop

    The single most common structural gap we find is an organization that conducts exercises, documents them, identifies problems, and then never records a revision to the plan. From the outside that reads as an organization that tests without learning. Closing the loop — a dated plan revision referencing the exercise that prompted it — converts the same work into evidence of a functioning program.

    A quarterly maintenance rhythm

    Emergency preparedness is badly suited to annual attention. A quarterly rhythm keeps the evidence current with far less total effort: verify a sample of contacts each quarter, confirm new-hire training was completed, review the exercise calendar against the requirement for your provider type, and check that the last after-action findings produced a documented change.

    For Gulf Coast organizations there is an obvious seasonal anchor. The plan should be verified before hurricane season, not after it.


    We build and audit emergency preparedness programs

    Including the evidence file, the exercise calendar and the after-action documentation that closes the loop.

  • The Section 504 Web Accessibility Deadline: What Healthcare Providers Should Be Doing Now

    The U.S. Department of Health and Human Services has adopted the Web Content Accessibility Guidelines (WCAG) 2.1 Level AA as the technical standard for web content and mobile applications under Section 504 of the Rehabilitation Act. In April 2026, the compliance dates were extended by one year. Recipients with 15 or more employees now have until May 11, 2027; those with fewer than 15 employees have until May 10, 2028.

    The parallel rule under ADA Title II, which covers state and local government entities including publicly operated hospitals and clinics, was extended on the same schedule: April 26, 2027 for jurisdictions serving 50,000 or more people, and April 26, 2028 for smaller jurisdictions and special districts.

    Does this apply to my organization?

    Section 504 applies to recipients of federal financial assistance. For healthcare organizations, it turns on the specific programs you participate in and how your payments are characterized, and it is genuinely contested at the margins. This is a question for healthcare counsel, not for a blog post and not for a consultant — and any firm that tells you confidently one way or the other without looking at your payer mix is guessing.

    What is not contested: if you are covered, the standard is WCAG 2.1 Level AA, and the date is fixed.

    Why the extension is not the reprieve it looks like

    Two reasons. First, the Department of Justice indicated it fully anticipates implementing the regulation at the new deadline, so the extension moved the date rather than signaling retreat. Second, and more importantly, the extension did not suspend any existing nondiscrimination obligation. A person who cannot use your website today can bring a claim today. The rule sets a technical standard and a date; it did not create the underlying duty, and it did not pause it.

    Industry trackers reported more than three thousand web accessibility lawsuits filed in 2025, a substantial increase over the prior year. Most were not brought against organizations that had missed a rulemaking deadline. They were brought against organizations whose sites could not be used.

    What WCAG 2.1 Level AA actually asks for

    The standard is long, but the failures that appear on healthcare websites cluster in a predictable set:

    • Contrast. Body text must reach a 4.5:1 contrast ratio against its background. Brand palettes chosen for print routinely fail this, and light grey secondary text fails it almost universally.
    • Keyboard operability. Every control must be reachable and operable without a mouse, with a visible focus indicator. Custom dropdown menus and modal dialogs are the usual offenders.
    • Text alternatives. Images that carry information need alt text; decorative images need empty alt attributes rather than filenames.
    • Form labels. Every input needs a programmatically associated label. Placeholder text is not a label.
    • Heading structure. One H1 per page and no skipped levels — this is how screen reader users navigate a page.
    • Documents. PDFs are web content. An untagged scanned PDF of your patient rights notice is a barrier, and provider sites are full of them.
    • Media. Captions for prerecorded video, and audio description where visual content carries meaning.

    A realistic sequence for the time remaining

    1. Audit. Run an automated scan for mechanical failures, then have a human test keyboard navigation and screen reader flow on your highest-traffic paths. Automated tools catch perhaps a third of real issues.
    2. Fix the template layer first. Contrast, focus indicators, heading structure, and form labels usually live in the theme, so fixing them once fixes them everywhere.
    3. Triage the document library. Remediating every PDF is often unrealistic. Converting the most-requested ones to accessible web pages is usually faster and better.
    4. Publish an accessibility statement. Name your target standard, your known gaps and a remediation timeline, and give people a way to report a barrier and get the information another way in the meantime.
    5. Put it in procurement. The next website, patient portal or scheduling widget you buy should carry a conformance commitment in the contract. Third-party embeds are the most common source of failures an organization cannot fix itself.

    The part most organizations get wrong

    Accessibility overlay widgets — the floating accessibility button that promises automatic compliance — do not achieve conformance, and a substantial share of accessibility litigation has been filed against sites that had one installed. They are not a substitute for fixing the underlying markup.


    This article is general information about regulatory developments and is not legal advice. Whether your organization is a covered recipient under Section 504, and what that requires of you, should be determined with counsel.

    Need help scoping this?

    We work with therapy, home health, ABA and physician organizations on compliance programs, and website accessibility has become part of that conversation. We can help you scope the audit and the remediation plan.