The State of US Healthcare Accessibility 2026

FQHC associations were the only healthcare commenters, and they described specific difficulties: uneven understanding of the requirements, document accessibility, keyboard navigation. Before running a single scan, we registered a hypothesis: if that account is accurate, FQHCs should score measurably worse than hospitals, and disproportionately on keyboard operability.

They do not. The difference in mean score is 0.36 points in favour of FQHCs, with a 95% confidence interval from -0.95 to +1.64 (p=0.9827). On keyboard failures specifically, the limb of the hypothesis we could test directly, the gap runs the other way and is not significant (p=0.5452). A randomly chosen FQHC outscores a randomly chosen hospital 50% of the time.

That interval is the finding, not the p-value. A confidence interval spanning roughly one point in either direction, on a 100-point scale, is evidence that these groups are alike. It is not the shrug of an underpowered test that could not tell them apart. Had FQHCs been meaningfully worse, an interval this tight would have shown it.

So the segment that spoke is not the segment in trouble, and the segments that said nothing at all, hospitals of every size, are no better prepared. The hypothesis was registered before the scan, and the null result is reported as it came.

This is the strongest finding in the study, and it is strongest precisely where the confounder is removed. Across all segments the raw gap is 46% for Epic against 100% and 83% for the other two. Holding segment constant does not shrink that gap; it widens it.

Two cautions, both of which matter. These are small cells: 9 Epic FQHC sites means the 11% figure is a single site with a keyboard failure. The comparison clears significance because the other groups are so nearly unanimous, not because the Epic cell is large.

Unstratified, Epic-running sites average 5 points above Oracle Health/Cerner sites (p=0.0241). But Epic skews large and Cerner skews community, so this is the comparison most at risk of measuring budget rather than product. Restricted to community hospitals, where both have enough deployments: Epic 90.4 (n=14) against Oracle Health/Cerner 84.6 (n=11).

The gap does not disappear. It is slightly larger within segment, 5.72 points, but at those cell sizes it no longer clears significance (p=0.0578). We report that as it stands: the direction is consistent and the effect size holds up, but once organisation size is controlled, this sample is not large enough to call the score gap statistically significant. Anyone citing the 5-point figure should cite the stratified result alongside it.

An accessibility statement is not itself a legal requirement under 45 CFR 84.84, and its absence is not a violation. What it signals is whether an organisation has an accessibility posture at all: a named contact, a stated standard, a route for a patient to report a barrier.

Where a statement does exist, it creates something the rest of this report cannot: a claim that can be disproved rather than merely correlated against. WCAG conformance is defined as all applicable success criteria being satisfied. It is not a score, a percentage, or a good-faith effort. So where a site states that it conforms to WCAG 2.1 Level AA, and an automated scan finds a genuine 2.1 AA failure on that same public site, the stated claim is false, by the definition of the term the site invoked. A single confirmed failure is sufficient, because conformance admits no exceptions.

WCAG 4.1.2 governs whether a control tells assistive technology what it is. A button a screen reader announces as “button” with no name, a custom dropdown that reports no state, a toggle that never says whether it is on: each is a 4.1.2 failure, and each turns a working interface into an unusable one for someone who cannot see it.

It is also the criterion most tightly bound to the shift from plain HTML to component frameworks. A native button with text inside satisfies 4.1.2 for free. A div wired up with JavaScript satisfies nothing unless someone adds the role, the name and the state by hand. At 78%, this is not a handful of neglected pages; it is the default outcome of how healthcare sites are currently built.

Absence is recorded as a third state, alongside pass and fail. It is never folded into a score, because doing so would reward it: an organisation with no online booking cannot fail a booking page, and averaging it away would let a missing service register as a clean result.

The distinction matters more here than anywhere else in this study. An inaccessible booking page fails WCAG, and a patient who encounters it may still get through with difficulty, or with help. An absent one fails the patient outright. If there is no online path to request an appointment, there is no independent path for anyone who cannot comfortably use a telephone, which includes deaf and hard-of-hearing patients, many people with speech disabilities, people with anxiety disorders for whom a phone call is a genuine barrier, and anyone who needs time to compose what they want to say.

For that group, the accessibility of the booking page is not the question. Whether one exists is.

The portal itself is out of scope. Patient portals sit behind authentication and were not scanned. This is the single most important limitation here. The portal is where patients read results, message clinicians and retrieve records, the things that matter most, and it is exactly what we cannot measure. What we measured is the login page: public, unavoidable, and the place where the vendor’s own markup is most visible. A finding about login pages is a finding about login pages.

Automated testing detects a minority of WCAG failures. Automated rules are good at contrast, names and roles, structure and form labelling. They cannot judge whether alt text is meaningful, whether reading order makes sense, or whether a task can be completed with a screen reader. Every score here is a floor, not a verdict. A site that scores well has passed automated checks; it has not passed an audit.

“Large facilities” is a proxy, and not the one the rule uses. Segmentation is by bed count: 350 or more beds is treated as a large facility. CMS publishes facilities, not corporate parents, so this label does not denote a verified multi-hospital system. More importantly, HHS’s actual threshold is 15 employees, which determines whether an organisation faces the 2027 or 2028 date, and staffing is not derivable from the CMS data at all. This study therefore cannot compare the two compliance deadlines, and nothing here should be read as doing so.

10 providers were attempted but never scored, and they are not a random 10. Three were lost because robots.txt disallowed the homepage and two to WAFs; seven were FQHCs and three were large facilities, with no community hospital lost. Failure to scan plausibly correlates with defensive infrastructure, which correlates with budget, so the scored sample may slightly under-represent the best-defended organisations. Across the pages that were scanned, 29 were blocked by a WAF (Akamai 15, Cloudflare 8, Imperva 6), affecting 6% of providers.

The sample draw is not perfectly reproducible. Corroboration depends on live pages responding. Two runs over the same candidate seeds upgraded 15 and 14 respectively, differing by a single community hospital, because a locations page that times out on one run answers on the next. Re-running moves the verified count by a seed or two in either direction. It does not move any segment across the minimum sample floor.