Document Inventory and Triage: The BAA Gate Comes First

Two gates apply to everyone in this series. Healthcare gets a third gate first, and it's not optional.

Every sector in this series triages documents the same basic way: should this exist at all, does an exception apply, then rank what's left. Healthcare has one more gate in front of all of that, and it's the one that trips people up because it isn't about accessibility law at all. It's about PHI.

The gate that comes before the other two

Patient documents — consent forms, discharge instructions, billing statements, anything with a patient's information attached — cannot leave your organization for outside remediation without a Business Associate Agreement in place. That's not an accessibility rule. It's a data-privacy one, and it overrides everything else in this piece if you get it backwards.

Build this as a procurement checklist line, not a judgment call: before any conversation about sending documents to an outside remediation vendor, the BAA exists, or the work happens in-house. Done as a checklist item, the decision makes itself every time, and nobody has to remember to ask.

Gate one: should this even be a document?

Once the BAA question is settled, the ordinary triage applies. Retire what's superseded or unused. Replace with an actual web page whatever never needed to be a PDF. Recreate from the source file wherever it still exists — always cheaper than remediating a scanned output, and in a typical document estate this step alone clears a meaningful share of the total before a dollar gets spent. These decisions are permanent, and that's the point.

Gate two: does an exception actually apply?

Archived and preexisting-document exceptions exist in the federal rule, and some states layer their own version on top. Test them item by item, in writing, with a named decision-maker — never by folder sweep. An exception removes the default obligation to have already fixed something. It never removes your duty to provide that content accessibly the moment a specific patient asks for it.

Then rank what survives — with clinical stakes weighted in

Rank the survivors by traffic, by stakes, and by complaint volume divided by effort, same as anywhere else in this series — except in this sector, "stakes" has a sharper edge. A discharge instruction a patient can't read isn't just a compliance gap. It's a readmission risk. A consent form locked in an inaccessible format is consent that may not actually hold. Weight your queue accordingly: consent, discharge instructions, and billing communications first, ahead of newsletters and general informational content, even if the general content technically has higher traffic.

One thing overrides the whole ranking, every time: a named complaint. If a specific patient told you a specific document is a barrier, it goes to the top regardless of score. And system-generated documents — portal-generated notices, auto-populated billing statements — skip your queue entirely. Those are a vendor's code change, not your hand-remediation project.

This isn't legal advice on how the exceptions or the BAA requirement apply to your specific document flows — verify both against your own counsel and your compliance office. If you want a fast first read on where a specific document actually stands before you triage it, ask Luke to take a look — it won't replace the manual review, but it's a reasonable place to start a queue. See our methodology for how we verify claims like these.

Previous: your first 90 days · Next: procurement language that actually works

---

Sources: HHS Final Rule — Nondiscrimination in Health Programs and Activities (opens in new window) · Web Content Accessibility Guidelines (WCAG) 2.1 (opens in new window) · HHS Guidance on Section 1557 (opens in new window) · U.S. Access Board — Revised 508 Standards (opens in new window)