The HHS Section 508 Web Checklist is an Excel spreadsheet published by the U.S. Department of Health and Human Services for evaluating whether a website or web application meets Section 508 accessibility standards.
Federal agencies, contractors selling to federal agencies, and vendors responding to procurement requests are often asked to complete it as documentation that their digital product has been reviewed against the relevant criteria.
Download the Section 508 Checklist in Excel format. The checklist covers Web Sites, Web Applications & Software.
It is one of two common formats for documenting a Section 508 evaluation. The other is a VPAT, formally an Accessibility Conformance Report (ACR), which is the more widely used document across federal agencies, enterprise buyers, universities, and most private-sector procurement teams. Both documents cover essentially the same criteria. The differences are in format, identifiers, and audience.
| Aspect | HHS Section 508 Web Apps Checklist | VPAT 2.5 (Accessibility Conformance Report) |
|---|---|---|
| Format | Excel workbook with three sheets | Word document or PDF |
| Issued by | U.S. Department of Health and Human Services | Information Technology Industry Council (ITI) |
| Standard referenced | WCAG 2.0 plus Section 508 software requirements | Section 508, WCAG, or EN 301 549 (separate editions) |
| Identifiers | HHS-specific IDs (1A, 2B, 5E, 9K, etc.) | Standard 508 and WCAG criterion numbering |
| Primary audience | HHS procurement teams | Federal agencies, enterprise, universities, private sector |
| Reusability | HHS-specific | Universal across procurement contexts |
| Underlying work | Audit by a technical accessibility expert | Audit by a technical accessibility expert |
Table of Contents
What’s in the Checklist
The workbook contains three sheets. The first, “Report Details,” captures basic information about the review: reviewer name, review date, URL, a description of the site or application, the operating system and browser used during the review, and an overall result. The second sheet, “Results,” is where the actual evaluation lives.
It lists every applicable success criterion, each tied to a WCAG 2.0 reference number (1.1.1, 1.4.3, 2.4.7, and so on) and an HHS-specific identifier (2A, 2B, 5E, 9K, and so forth). The third sheet, “Time-Based Media,” covers captions, transcripts, audio descriptions, and similar requirements that only apply when video or audio content is present.
Every row on the Results sheet describes a specific failure condition. Rather than asking “is this accessible,” the checklist asks the reviewer to confirm whether a particular failure exists. Row 5E asks whether text and images of text have a contrast ratio of at least 4.5:1. Row 9K asks whether keyboard focus is visually apparent as a user tabs through the page.
Row 13B asks whether the name, role, and value of custom controls, page tabs, progress bars, and form controls can be programmatically determined and exposed to assistive technology. The checklist runs through roughly 70 of these conditions, organized under the WCAG principles of Perceivable, Operable, Understandable, and Robust, plus a section covering Section 508 software requirements (502, 503, 504).
How to Fill It Out
Filling out the checklist requires an accessibility audit conducted by a technical accessibility expert. This basically comes down to your ability to technically evaluate each and every criterion. If you’re not already an expert with years of experience, you don’t have the knowledge or skills to do this. Also note that the criteria require judgment that cannot be produced by any software or automated scan.
Determining whether alternative text is appropriate and concise, whether reading order is logical and intuitive, whether form labels are informative, or whether a custom widget exposes the correct ARIA role and state to assistive technology requires hands-on review with screen readers, keyboard-only navigation, and source code inspection.
For each row, the reviewer enters a result (typically Pass, Fail, or Not Applicable) and, where a failure is found, documents the screen and location so the issue can be reproduced and fixed. A reviewer who does not know how to evaluate these criteria will produce a checklist that is either inaccurate or vague, and an inaccurate checklist creates real risk in a federal procurement context.
Why We Usually Recommend the VPAT
Our VPAT service is priced at $350 and for most procurement requirements, acts as an alternative to the checklist. The audit work behind both documents is the same, so a client who orders a VPAT receives a deliverable that satisfies the HHS request and also works for every future procurement conversation, RFP response, customer security review, or public-facing accessibility statement. A client who orders only the HHS checklist can end up requesting VPAT service a few months later when a different buyer asks for an Accessibility Conformance Report (ACR).
If a client specifically needs the HHS checklist completed and prefers that exact format, we are happy to do it. The price is the same, $350, and the underlying audit, populated results, and failure documentation are equivalent. The deliverable is just structured around the HHS layout rather than the VPAT format.
Frequently Asked Questions
Can the checklist be completed with an automated scanner?
No. Automated tools only flag a limited number of issues (approximately 25%), including some color contrast errors, missing alt attributes, and certain ARIA mistakes, but they cannot evaluate most of the criteria on the checklist. Whether reading order is logical, whether labels are informative, whether keyboard focus moves correctly through dynamic widgets, and whether custom controls expose the right roles and states all require human evaluation with assistive technology and code inspection. An honest checklist requires an audit conducted by a technical accessibility expert.
Do I need the HHS checklist or a VPAT?
If the request came specifically from HHS and the procurement team wants their format, the HHS checklist is the safe answer. For every other context, a VPAT is the standard, and many vendors submit a VPAT in HHS contexts as well since it covers the same Section 508 criteria.
What WCAG version does the checklist reference?
The current version of the HHS checklist (03/2020) references WCAG 2.0 Level A and AA. For a VPAT, we typically recommend the WCAG edition and virtually all clients opt for WCAG 2.1 or 2.2 AA as the standard.
Does the checklist need to be updated if our site changes?
Yes. The checklist reflects the state of the site or application at the time of the audit. Substantial changes to navigation, forms, components, or content typically warrant a refreshed audit and an updated document. For products that change frequently, an annual cadence is common.
What does the $350 cover?
The price covers the audit conducted against WCAG 2.0 Level A and AA, completion of the checklist (or VPAT) with results and failure documentation for each applicable criterion, and delivery of the finished document. Remediation of any issues identified during the audit is a separate engagement.
Get Started
If you have a checklist or VPAT request on your desk and want to talk through which format makes sense for your situation, contact us.
