Someone sent you a letter. Here is what happens next.
ADA demand letters, cyber-insurance questionnaires, privacy complaints and HIPAA tracking rules all land on the website. I fix the site so the answer is yes.
What usually arrives
- An ADA or WCAG complaintA demand letter or a lawsuit threat about the website. The fix is an audit against WCAG 2.2 AA, remediation in priority order, and evidence you can hand to your lawyer.
- A cyber-insurance questionnaireThe insurer wants MFA, patching, backups, headers, a WAF and proof. I have run that remediation across a whole client portfolio and I know what the underwriters actually check.
- A privacy or cookie complaintGDPR, CCPA and the state laws that followed. Consent that blocks trackers until it is given, and receipts that prove it. I built CookieSteward for exactly this.
- HIPAA tracking guidanceHealthcare sites with Google Analytics, the Meta Pixel or session replay on them. Tracking removed or hard-blocked, and the site checked afterward. I have been the HIPAA compliance officer at an agency, so I know what the guidance means in practice and where PHI hides in a website.
- A hacked siteContainment, forensics, cleanup, re-hardening, and the awkward conversation with your customers. I have done this more times than I would like.
What I do
- Audit against the actual standard or the actual questionnaire, in plain language, with findings ranked by risk
- Fix the worst problems first, on the live site, with your approval at each step
- Document what changed and why, so you have evidence for the lawyer, insurer or auditor
- Keep it from regressing: monitoring, scheduled checks and a care plan if you want one
Work I have done
- Dozens of accessibility remediations to verified WCAG AA, for B2C and healthcare clients
- Cyber-insurance audit remediation across a large client portfolio, including CSP, HSTS and WAF hardening
- Incident response and cleanup for compromised sites, from containment through client communication
- HIPAA-scoped sites, and CookieSteward with its HIPAA mode that keeps tracking pixels off healthcare pages
- Served as an agency's HIPAA compliance officer: business associate agreements, PHI and PII handling rules, and vendor decisions made with those rules in the room
What you get
- A findings report written in plain English
- The fixes, with before and after evidence
- A statement of what was done, written for the insurer, lawyer or auditor who asked
- A plan for keeping it that way
Related
Questions
Is this a certification?
No. Nobody certifies a website as compliant. What you get is work done against the standard and evidence of it, which is what lawyers, insurers and auditors actually ask for.
How fast can you start?
Letters have deadlines, so audits start within days. The first findings and the highest-risk fixes come first; the rest follows a plan we agree.
Will it change how the site looks?
Rarely, and never without your approval. Most accessibility and security fixes are invisible to visitors.
Do you work with our lawyer or insurer?
Yes. I write the technical side in their terms and join the call if it helps.