Accessibility & Regulation

A patient who cannot read a lab result with a screen reader, tap a small button with a tremor, or finish a login that asks them to remember a code is locked out of care, not merely inconvenienced. Accessibility standards exist to reduce those lockouts, and in a growing number of places law now points to them. This article explains the main standard, what its newest version added, and how rules in different regions refer to it.

The standard: WCAG and its levels

The Web Content Accessibility Guidelines (WCAG) are published by the World Wide Web Consortium (W3C), the body that maintains web standards. They are built around four ideas: content should be perceivable, operable, understandable and robust. Each idea is broken into testable statements called success criteria, and every criterion carries a conformance level. Level A is the most basic, Level AA is the intermediate level, and Level AAA is the highest.

Three versions are current: WCAG 2.0 (December 2008), 2.1 (June 2018) and 2.2 (October 2023). Each is backwards compatible, so content that meets 2.2 also meets the earlier two. The W3C encourages people to use the latest version.

What changed in WCAG 2.2

Version 2.2 added nine success criteria and retired one obsolete criterion about how page code is written. Six of the new ones sit at Levels A and AA, the levels laws tend to name; the other three are Level AAA, the optional top level. In plain words:

• Target size: tappable controls should be at least 24 by 24 CSS pixels (a screen unit), or spaced far enough apart, so people who find precise tapping hard can hit them.
• Dragging: anything done by dragging must also be possible with simple clicks or taps.
• Focus not obscured: when someone moves through a page by keyboard, the item they are on must not be fully hidden, for example behind a sticky banner.
• Accessible authentication: logging in should not depend on a memory or puzzle test unless an alternative is offered.
• Redundant entry: do not make people re-enter information they already gave in the same process.
• Consistent help: help options should appear in the same place from page to page.

How law points to the standard: international

In the United States, two rules published in 2024 name WCAG 2.1 Level AA, not 2.2. The Department of Health and Human Services rule under Section 504 of the Rehabilitation Act covers recipients of HHS financial assistance. Its compliance dates were moved back a year in 2026 to 11 May 2027 for recipients with 15 or more employees and 10 May 2028 for smaller ones. The Department of Justice rule under Title II of the Americans with Disabilities Act covers state and local governments, with dates moved to 26 April 2027 for populations of 50,000 or more and 26 April 2028 for the rest. Federal agencies' own technology falls under Section 508, whose revised standards were aligned with WCAG 2.0. Justice Department web guidance lists WCAG as helpful but says it has no legal force.

In the European Union, the Web Accessibility Directive covers public sector websites and apps, and the European Accessibility Act covers listed products and services from 28 June 2025, such as e-commerce and consumer banking. The list of services in the Act does not name healthcare, so whether a health app falls inside it is a question for national law. Both instruments connect to the standard EN 301 549, which gives a presumption of conformity: meeting it is presumed to meet the law. The version now serving as the reference, 3.2.1 from 2021, mirrors WCAG 2.1. Version 4.1.1, published in September 2026, moves to WCAG 2.2, but the European Commission's accessibility centre says the older version stays the reference until the new one is cited in the Official Journal of the European Union.

How law points to the standard: Australia

The Disability Discrimination Act 1992 makes disability discrimination in providing goods, services and facilities unlawful. It is written in general terms and names no WCAG version. Whether a website counts as a service has been tested: W3C's case summary describes a 2000 decision by the Human Rights and Equal Opportunity Commission upholding a blind user's complaint about the Sydney Olympics website. Complaints about unlawful discrimination are handled under a separate law, the Australian Human Rights Commission Act 1986, whose headings set out a complaint to the Commission, conciliation by its President and, if a complaint is terminated, an application to court.

With no version in the Act, the technical benchmark comes from guidance and policy. According to accessibility organisations, the Australian Human Rights Commission published Guidelines on equal access to digital goods and services in April 2025, updating its 2014 advisory note on web access. One accessibility vendor reports that they name WCAG 2.2 Level AA as a minimum benchmark. The Commission's own pages could not be opened for this article, so check the guidelines directly.

For government services, W3C's policy summary lists the Digital Transformation Agency's Digital Experience Policy (2024) as using WCAG 2.2, and the 2024 Commonwealth Procurement Rules as using a WCAG 2.1-based standard aligned with EN 301 549. The agency's own pages could not be opened for this article, so confirm the requirement and its start date at source. The Australian and international rules run in parallel, and neither overrides the other.

What this means for design work

In the instruments read here, WCAG 2.1 Level AA is the most commonly named benchmark. Version 2.2 appears in the newest European standard and, according to secondary sources, in Australian government policy and guidelines. Because 2.2 is backwards compatible, designing to 2.2 Level AA covers both.

An illustrative case: a patient portal login sends a six-digit code by text and blocks pasting, which fails accessible authentication for anyone who cannot hold digits in mind. Reschedule buttons sit a few pixels apart on a phone, which strains target size. A drag-to-reorder medication list has no button alternative. A chat banner covers the Confirm button when it receives keyboard focus.

Related Showcase cards

• Status is never colour alone - WCAG 2.2 SC 1.4.1 applied to a health reading.
• Target Size (Minimum) - WCAG 2.2 SC 2.5.8 applied to a booking flow.