Use this section to verify the technical conditions that affect safe data handling, crawl access, page usability, and truthful machine-readable information. Do not mark a checkpoint passed because a tool reports a green score; retain evidence that a responsible owner reviewed the underlying configuration and public behavior.
Checkpoint: Encrypted transport and inquiry-data flow. Evidence required: a crawl showing secure page and asset delivery, an inventory of every inquiry or intake field, the destination system for submitted data, vendor agreements or other privacy documentation required by the organization's reviewers, and access-control records.
Pass condition: no intended public page or submission path downgrades to insecure transport, and the designated privacy/security reviewer has approved the documented data flow for its actual use. Fail condition: insecure delivery, unknown destinations, unnecessary collection, uncontrolled access, or missing required review.
Severity: Critical where patient or prospective-patient information could be exposed; otherwise High. Owner: security/privacy lead with web engineering and the form-system administrator. Corrective action: remove unnecessary fields, correct insecure requests, restrict access, update the data-flow record, and route vendor or contract issues to the responsible reviewer.
Validation step: recrawl the affected paths, submit a controlled test with non-sensitive test data, verify the destination and permissions, and record reviewer sign-off. Tools: Qualys SSL Labs, Screaming Frog.
Checkpoint: Mobile performance and layout stability. Evidence required: representative mobile performance reports, field data when available, template-level findings, and manual testing on pages used to find clinicians, contact the program, or understand care.
Pass condition: priority pages render usable content without blocking errors or disruptive layout movement, and any performance targets are documented as internal operating goals rather than guarantees.
Fail condition: slow or unstable templates materially obstruct reading, navigation, or contact actions. Severity: High on access-critical pages and Medium elsewhere. Owner: web engineering with product or content operations.
Corrective action: reduce avoidable script and media cost, reserve space for late-loading elements, optimize critical assets, and retest the affected template. Validation step: compare before-and-after mobile results and manually confirm the corrected page on a constrained connection. Tools: Google PageSpeed Insights, Search Console.
Checkpoint: Accurate MedicalOrganization and Physician structured data. Evidence required: rendered markup, the corresponding visible page facts, the internal source for names, affiliations, specialties, and credentials, plus syntax validation.
Pass condition: markup is syntactically valid, matches visible content, and does not state qualifications or services that the organization cannot substantiate. Fail condition: hidden-only claims, stale affiliations, unsupported credentials, duplicate entities that create ambiguity, or invalid markup.
Severity: Medium unless the markup repeats a materially misleading medical or identity claim, which is High. Owner: technical SEO or web engineering with credential verification by the appropriate clinical or medical-staff owner.
Corrective action: remove unsupported properties, align entity facts with the page, and correct syntax. Validation step: compare markup line by line with the rendered page and authoritative internal records, then retest.
Tools: Schema.org, Google Rich Results Test. Structured data does not by itself guarantee rankings, rich results, or AI inclusion.
Checkpoint: Lead capture appropriate to the organization's HIPAA obligations. Evidence required: form-field inventory, system architecture, retention and access rules, vendor documentation, and a determination by the organization's responsible privacy/legal reviewer about which HIPAA requirements apply to the specific workflow.
Pass condition: the implemented collection and handling match that reviewed determination and the public form does not request more information than the workflow needs. Fail condition: the team cannot explain where data goes, who can access it, how long it is retained, or which reviewed requirement governs it.
Severity: Critical for exposed sensitive information; otherwise High. Owner: privacy/legal, security, and the operational owner of intake. Corrective action: minimize collection, change routing or permissions, update vendor arrangements as required by the responsible reviewer, and revise the form copy to set accurate expectations.
Validation step: run an end-to-end test with non-sensitive test data and document approval of the final flow. Tools: Jotform HIPAA, Formstack. Tool branding alone is not evidence that a particular implementation meets legal obligations.
Checkpoint: Accessibility review using WCAG 2.1 as the existing benchmark in this source. Evidence required: automated scan results, keyboard-only review, screen-reader checks on key flows, text alternatives, focus behavior, form labels and error handling, plus any organization-specific accessibility requirements approved by counsel or accessibility leadership.
Pass condition: high-priority barriers found in the tested flows are resolved or have an approved remediation plan, and the team does not equate a single scanner score with legal compliance. Fail condition: a user cannot reliably navigate, understand, or submit a key public flow with supported assistive methods.
Severity: High for access-blocking barriers and Medium for less consequential defects. Owner: accessibility lead with design and engineering. Corrective action: remediate the defect at the component or template level where possible and update the regression test.
Validation step: repeat both automated and manual checks on the corrected experience. Tools: Axe DevTools, WAVE Evaluation Tool.