Digital health regulation map: which rule names which standard, by region

29 September 2026

Accessibility & health literacy Accessibility & Regulation Trust, Ethics & Safety

The main accessibility and privacy instruments in the United States, the European Union, the United Kingdom and Australia, which standard each one names, and what that changes on a screen. No dates, no verdicts.

Not legal advice This map is an education resource for designers. It names instruments and says which standard each one points to, and it leaves out compliance dates so that it dates slowly. It is not legal advice and not a compliance verdict on any product. Which rule applies depends on the organisation, the product and the place; check the primary sources and ask a qualified adviser.

Health products cross borders more easily than the rules that govern them. A patient portal built for one market may be sold into three, and each market points to a different accessibility benchmark and a different set of privacy expectations. This map lists, region by region, what each main instrument is, which technical standard it names, and what that changes on a screen. Compliance dates are left out because they have moved before and will move again; the articles linked at the end carry the dated detail.

How to read the map

For each region the map covers the accessibility benchmark that is named, the rules that shape consent and privacy on screen, and anything specific to health. The benchmark is usually WCAG, the Web Content Accessibility Guidelines from the W3C. Version 2.2 is current and builds on 2.1, so a product that meets 2.2 at Level AA also meets 2.1 at Level AA. What differs from place to place is which version a given rule names, and how much legal force it has.

United States

Section 504 of the Rehabilitation Act, through the 2024 rule from the Department of Health and Human Services. It covers recipients of HHS financial assistance, a group that includes many hospitals and health systems, and names WCAG 2.1 Level AA.
Title II of the Americans with Disabilities Act, through the 2024 Department of Justice rule. It covers state and local government bodies and names WCAG 2.1 Level AA as well.
Title III of the ADA lets individuals sue businesses that are open to the public. The statute names no technical standard; courts and settlements have mostly landed on WCAG 2.1 Level AA, not 2.2.
Section 508 applies to federal agencies' own technology, and its revised standards align with WCAG 2.0.
HIPAA Privacy Rule applies to covered entities such as health care providers and plans. The Federal Trade Commission's Health Breach Notification Rule covers many health apps outside HIPAA and treats sharing health information without authorisation as a breach.
21st Century Cures Act rule requires that patients can electronically access their health information at no cost, and restricts practices that block that access, with exceptions.
On the screen: design to WCAG 2.2 Level AA, which covers the 2.1 benchmark. Do not assume a rule or a court asks about 2.2 yet. Where an app sits outside HIPAA, make consent choices visible. Assume a patient may see a result before a clinician has explained it.

European Union

Web Accessibility Directive covers public sector websites and apps. Whether a particular health organisation counts as a public sector body is a question to confirm.
European Accessibility Act covers a list of products and services, such as e-commerce and consumer banking. The list does not name healthcare, so whether a health app falls inside it is a question for national law.
EN 301 549 is the standard both instruments connect to, and meeting it gives a presumption of conformity. The reference version, 3.2.1 from 2021, mirrors WCAG 2.1. Version 4.1.1 moves to WCAG 2.2, but the older version stays the reference until the European Commission cites the new one in the Official Journal.
GDPR treats data concerning health as a special category (Article 9), so what is collected, who sees it and how a person can decline are design questions.
European Health Data Space Regulation (EU) 2025/327 sets how people get access to and control over their electronic health data, and how it can be shared. It phases in over several years.
On the screen: WCAG 2.2 Level AA covers the 2.1-based reference version and the newer one. Design consent and access to a person's own data as things they can find and change at any time.

United Kingdom

Public Sector Bodies (Websites and Mobile Applications) (No. 2) Accessibility Regulations 2018. According to GOV.UK, public sector websites and apps must meet WCAG 2.2 Level AA and publish an accessibility statement. GOV.UK lists exemptions, including some non-government organisations such as charities. Whether a given health organisation is in scope is a question to confirm.
Equality Act 2010 requires service providers to make reasonable adjustments for disabled people. The duty is anticipatory: providers think ahead about barriers instead of waiting for a complaint. GOV.UK's quick-start guide for service providers describes it and mentions providing information in an accessible format; it does not specifically mention websites.
UK GDPR and the Information Commissioner's Office guidance on valid consent: consent has to be freely given, specific, informed and an unambiguous choice. The Showcase card Consent, not coercion audits a screen against that guidance.
DCB0129 and DCB0160 are England's clinical risk management standards for health IT, one for the manufacturers and one for the organisations that deploy it. Both name a Clinical Safety Officer. Both have been under national review; see Trust, Ethics & Safety for the current position.
On the screen: WCAG 2.2 Level AA is the level named for public sector sites. For other providers the duty is to anticipate barriers, so ask what a disabled user of your product would meet before anyone complains. Make declining as easy as agreeing.

Australia

Disability Discrimination Act 1992 makes disability discrimination in providing goods, services and facilities unlawful. It is written in general terms and names no WCAG version. Complaints go to the Australian Human Rights Commission, with conciliation first, and most are resolved there.
Guidelines on equal access to digital goods and services from the Australian Human Rights Commission (April 2025) say organisations should conform to WCAG 2.2 Level AA as a minimum. They are not legally binding, and following them does not protect an organisation from a discrimination finding.
Digital Experience Policy from the Digital Transformation Agency requires government agencies to follow the latest version of WCAG without naming one. That is currently WCAG 2.2.
Australian Privacy Principles govern how personal information is handled, and health service providers must follow them.
My Health Records Act 2012 and the 2025 Sharing by Default amendment. Key categories of health information now upload by default, with the right to opt out. Most pathology reports have been viewable by patients on upload since October 2025.
On the screen: the closed cases turned on a digital-only path with no equivalent for a blind user. A redesign can remove access that already existed, and a self-service kiosk counts as a service. Carry the opt-out as an action people can find at any time, not as a one-time enrolment step.

What stays the same wherever you build

Designing to WCAG 2.2 Level AA covers a rule that names 2.1 Level AA, because 2.2 builds on 2.1. Check which version your rule, contract or policy names, and do not assume it is the newest.
Consent and access to a person's own data need to be findable and reversible. Sharing by default and special-category health data both push consent into the interface.
A patient may see a result before anyone has explained it. Write the screen for that moment.
A redesign is a new chance to remove access. Check it before launch, not only at the first build.

What to raise with your team

Which of these instruments applies to your organisation and product. That is a decision for legal and compliance advisers, not for the design team.
Which WCAG version your contracts, procurement rules or policies name.
Whether your product counts as a medical device, or as health IT under a clinical safety standard.
Who owns the accessibility statement, where one is required.
How you will re-check when a rule changes.

Where the detail lives

Accessibility & Regulation: WCAG and how rules in several regions refer to it, with dates.
DDA and healthcare accessibility: three closed Australian cases.
My Health Record sharing by default: what the 2025 change means for design.
Healthcare accessibility lawsuits: the United States legal structure and a dated snapshot.
Trust, Ethics & Safety: privacy, consent and who is accountable.
The Library holds the primary sources for several of these instruments, including WCAG 2.2, EN 301 549, the ADA guidance, Section 504 and the My Health Records Act 2012.