Services · By industry
A Patient Portal Audit Leaves Results Patients Can Read
For the practice or health system that wants every patient reading their own results, messaging their own doctor, and refilling their own prescriptions without handing the screen to a relative.
What We Keep Finding
A patient portal is the one part of a health system people use alone, at home, with nobody to ask. Results land there. Refills start there. The message to the doctor goes through there. It also sits behind a login, which means no public scanner has ever opened it, and neither has the vendor demo you were shown before you bought it. We test it the way a patient does, signed in with test credentials your team provides, from the login screen through to the last secure message.
There is a rule with a date attached, and it reaches further than most practices expect. The HHS Section 504 web rule asks recipients of federal health money for WCAG 2.1 Level A and AA across their web content and mobile apps. The date is May 11, 2027 if you have 15 or more employees, and May 10, 2028 if you have fewer. What catches people out is who counts as a recipient. Medicare Part B reimbursement on its own is enough, so a solo outpatient practice with no grant, no federal contract and no sense of being federally funded is inside the rule anyway.
One sentence in that rule is worth more than either date. Whatever the compliance date says, the duty to make your programs reachable through your web content is already running under the rest of Section 504. The deadline moved back a year in May 2026. The obligation never moved at all. Which is the honest way to look at a portal in any case, because a result a patient cannot read is a patient ringing the front desk to have it read out to them.
What We Check
- Sign in with your test credentials and work the portal the way a patient would
- Read lab results and after-visit summaries with NVDA, JAWS, or VoiceOver
- Send and read secure messages by screen reader, then again by keyboard alone
- Request an appointment and a refill end to end, wrong entries included
- Check result tables for the header structure a screen reader needs to speak them
- Mark each finding as yours to fix or your portal vendor's to answer
What You Get
Every service on this site runs the same three-pass engine: an automated scan, an expert review of all 55 WCAG 2.2 A and AA rules, and a hands-on session with a professional blind screen-reader user. You get one report with every finding screenshotted, ranked by user impact, and linked to its fix. Your team fixes, we verify: the re-audit is half price within 3 months.
The format is not a mystery either. Read the sample report before you spend anything.
The Honest Limit
One honest limit and one scoping question we will ask before we start. The limit is your portal vendor. Where the portal ships inside an EHR your team cannot edit, the fix belongs to that vendor. We audit it anyway, because dated evidence naming the exact element is the only thing that moves a vendor ticket. Meanwhile the standard leaves you two positions rather than none. Monitor the vendor's screens and repair what breaks within two business days, and your claim holds. Or publish that the page would conform if the vendor's part were removed, described clearly enough for a patient to recognise it. The scoping question is narrower and it saves you money. The rule exempts documents that are both about one specific person and kept behind a password, so some of what sits inside your portal may fall outside it. We will settle that boundary with you when we confirm scope rather than bill you for testing content the rule never reached.
What It Costs
Rapid Audit: $499, up to 10 pages you pick, report in 5 business days. Standard Audit: $1,499, up to 25 pages in 10 business days. Flat rates, no discovery calls, and a real blind screen-reader user on every engagement. Pick your pages. We bring the humans.
Worth Reading Next
Related on this site
Guides, checklists, tools, and terms that go with this service.