Transcript

Host: Hello, and welcome to Prevention and Protection, the United Educators Risk Management podcast. Today, Rob Duston, Partner at Saul Ewing, and Melanie Bennett, Senior Risk Management Counsel at United Educators, will discuss digital accessibility. A reminder to listeners that you can find other UE podcasts, as well as UE risk management resources, on our website, www.ue.org. Our podcasts are also available on Apple Podcasts and Spotify.

Now here’s Melanie.

Melanie Bennett: Thank you. Rob, welcome, and thank you for joining me today.

Rob Duston: Thank you, Melanie. I’m happy to be here.

Bennett: So, let’s start by talking about the terminology here. When schools and colleges talk about digital accessibility, what does that mean?

Duston: Digital accessibility is the new catchall term that really encompasses all programs, services, activities, information, and content that an institution — college, university, a K-12 school — delivers in a digital format. And by digital format, it is any kind of electronic format.

We think of websites and website accessibility as one area that there’s been a lot of focus on for years now, but it also includes online classes, it includes content that is delivered over a school’s social media policies. It includes YouTube videos and transmission of ballgames. And pretty much anything that goes out into the ether or gets stored in the cloud, all of that is digital information or content.

And if that content is either by or under the direction of an entity of the university or college or school, then that is content that actually does need to be accessible under these new regulations for public schools.

Bennett: You mentioned the new regulations. So we’re talking about the regulations the Department of Justice released in April 2024 for the Americans with Disabilities Act (ADA). Can you talk more about what’s in those regulations?

Duston: Sure. Let’s get our terminology straight here. The regulations were issued by the Department of Justice to deal with digital accessibility of state and local governmental entities under ADA Title II. The ADA has several different parts, and we’re not dealing with Title I employment issues here. We are indirectly dealing with private schools under ADA Title III, but we’ll talk about that later.

But the regulations are targeted at state and local governmental entities, and that means every single public institution — K-12 or college or university, community colleges, four-year colleges, doesn’t matter — if they are an entity of a state or local government, they’re covered.

Now, what it means is that this regulation has been expected for a long time, and there’s a long history and a long backdrop to digital accessibility or what we used to just refer to as website accessibility issues for higher ed and K-12s. And it goes back more than 20 years.

The Department of Justice has been consistent for a long time that if you have programs and services that are offered digitally or if you have information that supports other programs and services, it may simply be the website that encourages admissions and is delivering content and information for prospective students.

No matter what it is, if it’s either part of your programs and services or it supports those programs and services, and of any of your entities that are affiliated with the college or university or the school, those are covered, all programs and services.

And within that, the Department of Education’s Office of Civil Rights has also been saying for years the same thing. They have focused on a wide variety of things, everything from electronic textbooks to digital classes and online classes. They have been giving guidance to colleges for years. They have been threatening issuing regulations under Section 504 for years. They’ve been using the bully pulpit and investigations, and so has the Department of Justice.

There was actually an effort back in the Obama administration to get regulations out for both public schools and for private schools covered under ADA Title III. That was not completed. It was put on hold. Everything was put on hold, basically, during the Trump administration. And we expected regulations in the Biden administration, this had been a priority, and they made the tactical decision to issue regulations for state and local government entities first because there’s no question about the coverage issues.

When you get into Title III, you get into some different complicating issues for what’s covered and what’s not. So they decided to start with the publics. And what they did first was make a decision about what the standard was that state and local governmental entities had to meet. And they said what we all expected them to say, is that the requirement was the , and anybody who can get that acronym correct, whether it’s WCAG or WCAG or however people choose to use it, that is set as the standard.

And then they gave a deadline for compliance, and DOJ basically said in both its advanced notice of rulemaking and the rule itself, that you’ve known about this for a long, long time. We assume you are well on the way to compliance with this, so we were going to give two years to large institutions and three years to small institutions. But let’s be clear, size matters here and makes a difference. And it’s not based upon the size of the number of employees of your school or your college, it is the state entity that you’re associated with.

So if you are associated with the state of X, by definition, the state of X is going to have to comply with everything, including their colleges and universities. There may be some small K-12 schools in small counties that might fall within the three years, but for the most part everybody’s looking at two years, and that two years is June 24, 2026.

And the fun part is that they say that you must achieve 100% compliance with those WCAG criteria and then maintain them within that two-year period, and that, frankly, is an impossible requirement.

Bennett: Before we come back to that comment about the impossible requirement, which I do want to follow up on, let’s quickly talk about WCAG a little more. WCAG is the Web Content Accessibility Guidelines created by the World Wide Web Consortium.

The ADA regulations, as you said, require institutions to meet WCAG 2.1 Level AA compliance. On a basic level, what does that mean?

Duston: Well, as a backdrop, the World Wide Web Consortium is an international consortium to set consensus standards. It’s like any other industry that has its standards, and this entity has set standards that have been deemed the consensus standards across experts and professionals in digital accessibility. And there have been versions of it around for a long time. There is a competing standard that the federal government requires of contractors selling goods and services references 508, and that was not used, so they took the one that most entities are familiar with, that most developers are familiar with.

And these criteria are extensive. The first thing to understand is that these success criteria are really measurements of effectiveness of communication or accessibility. It is kind of like construction, where there’s more than one way sometimes to fix a problem. And so they set the criteria for the outcome, but it’s not necessarily one way to achieve that.

And these success criteria are designed to provide accessibility not just to people with hearing impairments and vision impairments, mobility impairments, cognitive impairments, difficulty with manual dexterity, with rules for both mouse and non-mouse access, and a lot of others.

The most familiar example to most people, because it’s been the subject of so much litigation by individuals, is individuals with vision impairments who are using screen reader software. Now, you’re just both surfaces, people will be familiar with that, they’ve been dealing with screen reader software issues and accessibility for decades on a one-on-one student accommodation issue. And in order to ensure that your content works with screen reader software, there are a wide variety of different requirements. Simplest one for people with low vision and partial vision is requiring contrast, color contrast, because if there’s not sufficient color contrast you can’t distinguish. So certain colors and certain contrast ratios help.

Another very basic example is that when you have photographs or any kind of visual material, you have a hidden alternative text that explains what it is that that picture is showing or explaining. It’s like a caption, only it’s not visible to the public, and all of this gets read by a screen reader.

But it gets more complicated than that, because there are lots of things that can happen when you’re designing anything, from a form to be filled out, to a PDF, to lots of other types of digital content. Where if you make mistakes in the coding, then the screener is going along and doing text to speech just fine. And then it stops and it doesn’t know where to go, and it can’t make that jump or that leap to the next thing because of the way that the code has been written.

Bennett: With all of that understanding of WCAG in mind, why do you say that 100% compliance is virtually impossible?

Duston: Well, I don’t have 20 or 30 years of experience doing coding and working in this space, but I’ve talked to all the guys, men and women, who do, and have been working on this for decades. And the quick answer is it is impossible. Unless you have a simple webpage or document that is static and never changes, it is impossible to ensure that that is 100% accessible.

And the reason for that is you test these things through either automated testing or manual testing, and no matter what tool you use for an automated test and what vendor and what they tell you, it does not get every line of code on every page. And every time you run it, it might check a different number of success criteria or different lines of code. And then as our folks in higher ed and K-12 schools know, their websites are changing all the time.

Some change more often than others, some content changes, but think about your Athletics department content that’s going to change every single day of the year, with new content that must be up the next day after or the day of or live stream, because otherwise their alumni are going to get irritated. So you have constantly changing dynamic testing.

And with your manual testing, either by individuals with disabilities or folks who run multiple different screener or software testing these things, those again do not catch everything every single time. And so you can have the best processes in the world and you can still have somebody run a test and find a couple things that are wrong on a particular day.

While it is impossible to have 100% compliance and the Department of Justice’s regulations that have just a really sliver of an exception are not going to be much help, that’s not realistic.

But what is realistic is what all those plaintiff’s counsels and the Department of Justice attorneys have required in prior settlements and what are sort of best practices out there, and that is essentially developing systems and processes to test and fix and repeat. Take any area of your digital content, and you arrange for testing of the content on a regular basis, you go off and remediate it and fix the issues, then you test it again. And then you test it periodically because you’re going to be changing your site regularly, and those processes need to be put in place. And those are the kinds of systems that you’re going to need to do. It involves both upfront testing as well as maintenance testing after you think you’ve got it right the first time.

Bennett: So who all at the institution should be responsible for understanding WCAG and applying the standards?

Duston: In the short term, it’s not just C-suite. It’s certainly not just IT. Every school out there is going to have some folks in their IT department and Disability Services and others who have been working on these issues, and you may well have some very good subject matter experts who are good at code and good in accessible design in-house.

You cannot just direct them to, say, “Fix everything.” Because the first thing they’re going to say is, “What do you mean by everything?”

Our problem and challenge, particularly in higher ed and to a lesser extent in K-12 schools, is that everyone is a content creator. Everybody who drafts anything that gets thrown onto the web or gets thrown onto a department’s website or gets sent on out by a faculty member digitally to an individual class, those are all content creators. And nobody that I know is requiring or feasibly can that everything must go through IT or an outside vendor to be checked and fixed and made accessible before it goes up on the web. That just doesn’t happen.

There’s just too much information all the time. So in a perfect world, you teach all of those content creators how to do things well the first time. I’ve gone through my own training on how to make my Word documents and PowerPoints accessible or more accessible before they go up, those tools are right on your screen if you’ve ever decided to turn them on. But that’s not going to happen easily or quickly. So that’s the long term, is training folks and then putting systems in place.

But in the short term, everybody, to use higher ed, at the chair level or above, needs to understand what the issues are, understand the basics of how this is done, and be able to either be involved in strategies and setting priorities, or be able to implement the ones that are instituted from higher up the chain of command.

And this is eventually going to mean sooner than later you’re going to have to do mandatory training of chairs and above, and you may eventually need to do mandatory training of faculty members as well so that they understand what the processes are, even if they’re turning around and asking their assistants to do the work.

Bennett: What resources are institutions going to need for that?

Duston: It starts from the top, so you’re going to need to make commitments. This really is a case where the President and his or her designees and the cabinet really need to lead this and say that this is important if you’re going to reach compliance. And what most schools are going to say is, “Where do I weigh this on the list of all of my other priorities? How does this compare to cybersecurity, for example, and privacy, and compliance with all kinds of other issues?”

And the answer is that’s the risk management decision you have to make. But if you’re committed to complying with this because both DOJ and OCR are looking over you, or in case I have not mentioned this, if you’re doing business overseas, you also have to worry about the .

And basically, if you were covered by GDPR for privacy principles, you’re now covered by that, which fortunately is also WCAG 2.1 Level AA criteria. But you’re going to have to have various certifications and procedures in every country that you’re dealing business in and they’re all going to have their own rules. This stuff isn’t going to go away.

So if you’re worried about all that, you have to decide how much you’re going to commit to it. You are going to need competent in-house people who are going to be able to do some of the work and some of the development, and help train and help get people up to speed on this.

You’re going to need some outside experts. And there are some really, really good ones, and there are a lot of fly-by-night operators who sell snake oil. But there are some good consultants, and you will want them to be periodically checking what your developers are doing. It doesn’t matter whether you’re in-house or outside developers, you’re going to need to have periodic testing and additional manual testing by an outside outfit on a regular basis to doublecheck and to find things that you may have missed in your regular procedures.

And you may want somebody to help you decide best practices and processes. And there are far fewer people who really understand higher ed or K-12 schools and can help at a 30,000-foot-level, strategize, “hat’s the low-hanging fruit? How do I triage? What’s my priorities? Where’s DOJ likely to enforce?”

Your lawyers play a part, a role in that. And there are some good consultants out there who have done similar things over the last 20 years. They won’t necessarily do the fixes for you, but they’ll help you with the strategy.

Bennett: The ADA regulations are limited to public institutions. Should private institutions be taking any action at this point?

Duston: Yeah. Well, the private institutions should have been taking action 10 years ago, and many of them have been, but the Title II regulations do not apply to them directly.

But the first thing we’re likely going to see is have those regulations applied to them through Section 504, and we’ll talk about that in a second. But having set a standard, basically schools can’t say anymore, “I don’t know what the technical standard is.”

It’s going to be WCAG 2.1 Level AA, so there’s no question about that.

And they’re also going to know that, at least for 504 purposes and later regs, it’s going to be all programs and services. And so it is likely that both the criteria and the exceptions and the approach in Title II is going to get applied to private schools, first through Section 504 regulations and maybe eventually under Title III regulations.

Bennett: I also want to focus on vendor content. I know a lot of school website content comes from vendors. So if my institution, for example, uses a vendor to create our LMS and to create the online training within that LMS that we distribute to our students and staff, do the courses, do the LMS that were created by the vendor who doesn’t work for my institution, need to meet the WCAG standards?

Duston: Yes. Next question.

No, the answer is yes. And one of the basic principles in ADA Title II or III, going back to 1990, is schools can’t do indirectly what they can’t do directly. Now, that usually applies to discrimination, but it also goes back to their contracts.

You can have contracts that try to place the responsibility on your vendor to provide accessible materials. Let me be clear, part of your compliance approach will be having contracts with those provisions requiring vendors to provide BPAPs, doublechecking that what they provide is in fact accessible, going back after them for remediation. All of that is a part, and your procurement is part of the puzzle. But you can’t turn around and say, “Well, we don’t have to comply because our vendor created this.” That’s not going to work.

Those forces are your programs and services. They’re covered by the regulation.

There are some narrow exceptions, and part of your strategy process upfront in triaging is deciding how I want to take care of the various exceptions. For example, how much outdated material can I throw into an archive and say is now no longer available to the public so I don’t have to make it accessible? Well, there are a bunch of little things for schools that create some exceptions that you’ll want to take advantage of.

Bennett: So what can we expect from DOJ and the OCR in the next two years when it comes to enforcement?

Duston: Well, DOJ and OCR are still going to investigate complaints of discrimination in certain areas of digital accessibility. I don’t expect them to do any compliance reviews because they’re going to be giving new deadlines.

When they are dealing with complaints, I think their focus will be on, “We’ve been telling you this for years and we want to see evidence that you actually have a plan for reaching compliance within our deadlines, and if you are, we’ll leave you alone and we’ve reserved the right to come on back at the end.” And that the resolution agreement may be something like that. I don’t think we’re going to see resolution agreements that are just partial or piecemeal to some parts of digital and ignore everything else that’s in the regulations.

And as far as resources, I will tell you that since these regs came out, I have been planning to do, or Saul Ewing is planning to doAnd bring in a couple experts, both on the technical side and on the consulting side, in how schools should try to organize themselves and develop processes to take their compliance efforts to the next level.

Bennett: Great. Thank you so much for coming to talk to us about this important issue. That’s it for today’s podcast. Thank you, Rob, for joining me today.

Duston: Thank you, Melanie.

Host: From United Educators Insurance, this is the Prevention and Protection podcast. For additional episodes and other risk management resources, please visit our website at www.ue.org.