Voluntary Product Accessibility Template (VPAT) - an emerging standard for Section 508 Compliance documentation

In 2001, the Information Technology Industry Council partnered with the General Services Administration to create a tool that would assist Federal contracting and procurement officials in fulfilling the market research requirements specified in Section 508 (governing the accessiblity of Web sites and software applications to disabled users). The result of their collaboration was the 508 Evaluation Template – a simple, web-based checklist that allows Vendors to document how their product did or did not meet the various Section 508 Requirements.

Today, I finally got around to producing a Voluntary Product Accessibility Template (VPAT) document that defines our committment to Section 508, which I've blogged about many times. Recently, we have seen versions of the VPAT attached to several RFPs from various federal agencies and public institutions, so it appears to be heading towards becoming a standard first step for 508 Compliance evaluation.

Now we are at the point with Section 508 compliance where we were in 2001 with PCI compliance (self-assessment). Over time, I expect that we and others in our industry will move towards fully-audited compliance and independent reports for Section 508, as we now have with PCI level 1 compliance.

Amendments to Americans with Disabilities Act Broaden Coverage, Portend More Employment Litigation

Last week, President Bush signed into law amendments to the American Disabilities Act (ADA). Effective January 1, 2009, these changes broaden the definition of "disability", and large employers should expect an increase in employee disability claims.

ADA and Section 508 Compliance for Web Sites

For the most part, event planners outside of the Federal government ignore ADA compliance for their Web sites and online registration forms. Looking at the history of ADA applicability to the Web, a trend is becoming clear:

1. Originally, only public Web sites of U.S. Federal Government agencies had to comply with ADA Web guidelines.
2. Later, enforcement extended to state and local government Web sites if those agencies accepted federal funds (as most do)
3. Recently, Target v. National Federation of the Blind set a precedent that commercial Web sites must be ADA compliant if the site is accessible to the public
4. Now, these new ADA amendments broaden the definition of disability in the employee-employer relationship. This makes me think that soon employee-only Web sites (such as Intranets and employee event registration forms) may soon fall under ADA regulation.

What to do as a Meeting Planner?

I don’t hear a lot about ADA compliance in the meetings industry press or trade shows, but I think now is the time for organizations to create long-term plans for all of their Web sites to become compliant with the international W3C Web Content Accesibility Guidelines (which include the U.S. ADA and Section 508 guidelines).

I've previously described our strategy at Certain for doing this.

Why be ADA compliant? Look at National Federation of the Blind v. Target Corporation

In the September 1, 2008 issue of Computerworld ("Benchmarks Last Week", p. 13):

"Target Corp. agreed to modify its Web site and pay $6 million in damages to settle a class-action lawsuit filed by the National Federation of the Blind. The NFB will test the site's accessibility annually for three years."

I've written previously on the need to build Web sites that are compliant with the American Disabilities Act and Section 508 of the Workforce Rehabilitation Act of 1973, but my reasons focused on the work we conduct for U.S. federal and state government agencies.

Now it appears that commercial Web sites in addition to government ones soon will be required to adhere to accessibility standards . I applaud this movement, since the Section 508 and W3C WCAG guidelines are mature and allow standards-based Web development that is accessible to the largest number of people possible.

Developing a Section 508 Compliance Strategy for Web Site Accessibility

(This post is a continuation of my article on Section 508 compliance for Web accessibility.)

I've been working with a federal government agency to validate Section 508 compliance for their online registration form. Before this process began, had you asked me if our attendee-facing web pages were Section 508 compliant, I would have replied, "Absolutely, yes." But working with Angela Hooker (http://www.angelahooker.com/) on this project, I've learned a few things about web accessibility:

1. You cannot rely on automated testing tools, like WebXact, to insure Section 508 compliance.
2. You must validate compliance with multiple applications geared toward different audiences. For example, try JAWS for sight-impaired users, navigate without a mouse to simulate motor-skill deficient users, and view pages with a lower resolution for technologically-disadvantaged users.
3. Complying with the spirit of the law (i.e., to provide universal accessibility to Web content) requires an expert who can show you the end users' experience, beyond strict compliance with the letter of the law.

I also learned that the World Wide Web Consortium (W3C) and International Organization for Standardization (ISO) are both following the United States' lead in web accessibility guidelines, and in the future Section 508 regulations will be rolled into the international standards embodied in the W3C Web Content Accessibility Guidelines 2.0 (WCAG). Adopting Section 508 compliance now gives you a head start on interoperability with the next generation of web browsers and platforms (such as iPhones and tablet PCs).

Specific Issues with Section 508 Compliance

Over the past month, I've identified and resolved a few issues with our Section 508 compliance of the online registration forms:

• We disabled a client-side Javascript function, which hid payment fields that did not apply to your selected payment method. Although this area passed the WebXact screening, the script confused the JAWS screen reader and resulted in content being read out of order.
• We added text and hyperlinks designed specifically for blind users. We inserted these instructions in a white font color (on a white background), so that they would be "invisible" and not detract from the experience of sighted users.
• We replaced a web mail interface with a simple "mailto" link. The web mail interface had the same look and feel as the registration form, but opening an e-mail message in your client application (such as Outlook) made us 508-compliant.

Looking at the bigger picture, however, we don't want to have to deal with Section 508 issues one form at a time. So I've been working with our IT, Development, and QA groups in order to develop a systematic approach to build, maintain, and audit Section 508-compliant Web applications.

Developing a Company Policy for Section 508 Compliance

The goals of our Section 508 compliance policy are to:

• Meet U.S. Federal regulations for our public sector clients (comply with the letter of the law)
• Produce Web sites that are universally accessible (comply with the spirit of the law)
• Educate our staff on Section 508 requirements
• Adopt international standards for more consistent development of Web applications

Why be Section 508 compliant?

• It is a law for U.S. federal government (and many state/local government) agencies, representing about 25% of both our current and potential customer base.
• Section 508 compliance is spreading beyond the public sector, becoming an internal requirement for major corporations and non-profit organizations
• Section 508 regulations are being merged into the W3C Web Content Accessibility Guidelines (WCAG 2.0) and ISO standards, so compliance with these HTML standards help us operate on future web browsers and platforms (PDAs, phones, etc.)
• Section 508 is a design standard for universal accessibility, just as PCI Compliance is a design standard for financial data security. Following Section 508 guidelines can help multiple developers in a globally-distributed work environment produce consistent, quality HTML code.

Section 508 Compliance Policy

Our policy for Section 508 compliance is:

1. 100% compliant on the registrant-facing side (i.e., Forms and Web Sites)
2. Strive for compliance with documentation and Help files, or offer a 508-compliant option
3. Strive for compliance on Admin side (intranet application), but not at the expense of harming the UI experience for sighted users.

"Strive for compliance" means that where possible on the Admin side and Help files, we should write HTML to the standards of the W3C WCAG and Section 508 guidelines. These standards are international best practices and insure maximum interoperability of HTML as the web moves to new browsers, mobile devices, kiosks, etc. So all images should have ALT tags, all form fields should have ID attributes with Label tags, all data tables should have header descriptors (as defined in the standards), all HTML should be checked for syntax errors such as end tags and tag nesting.

But for areas where meeting 508 compliance would result in an inferior UI for sighted users, we can make an exception in the admin side and Help files. An example here is the Help files "Table of Contents", which is not 508 compliant but has a much better UI for sighted readers through its dynamic interface.

In cases where compliance will not be achieved, then we should try to offer a 508-compliant alternative. For example, Robohelp allows us to save Help files in a separate 508 compliant format, which we can add to our Certain Support Center for vision-impaired users.

Section 508 Compliance Implementation

Many teams will work together to build, maintain, and certify our Section 508 compliance.

Developers and QA engineers:

• Read the Section 508 Rules
• Take Jim Thatcher's Tutorial on developing accessible Web applications and apply the lessons learned when writing HTML

QA Testing:

• For as many releases as possible (i.e., if automated and feasible), we should validate Section 508 compliance on a "sample" form and web site with Watchfire WebXact (included in HP Mercury testing tool)
• This automated tool is a good first pass for testing - it gives the specific line number of problems, along with a proposed solution for the developer

Note that the automated testing tools may return "508 Compliant" when a web site is not truly compatible with the advanced screen readers that disabled users actually employ. In order to comply with the spirit of the law, further User Acceptance Testing is needed.

User Acceptance Testing (UAT)

In order to comply with the spirit of accessibility, UAT should follow the guidelines outlined in Section 3 of Jim Thatcher's tutorial for checking the accessibility of our web pages.

• With major releases, or once per quarter, UAT should run through a comprehensive "standard" form and web site with the JAWS screen reader (the 40 minute version is adequate for this) - this exemplifies how vision-disabled users experience the web site
• UAT should navigate the sample form and web site without using a mouse (using Tab and keyboard only) - this exemplifies how motor-disabled users experience the web site

Compliance/Audit (IT)

• We should conduct an annual or biannual audit with an independent third party expert, e.g. Jim Thatcher (http://www.jimthatcher.com/) or Angela Hooker (http://www.angelahooker.com/)

One deliverable from the audit is for the consultant to produce a Section 508 compliance report for sales to be able to give to clients and prospects instead of having to conduct multiple internal audits one at a time.

Web Site Accessibility (Section 508 or ADA Compliance)

The day before my annual family reunion in Myrtle Beach, we received a call from a client stating that the payments page of their online registration form was not "Section 508 ADA compliant". This rang some alarm bells, since we have tried to support the Section 508 accessibility guidelines since signing our first federal government agency client in 2002. I started my research at the "Quick Reference Guide to Section 508 Resource Documents", but at 144 pages I realized that I was going to need a "Quicker Reference Guide" in order for our developers and QA engineers to understand the legal requirements and best practices surrounding Web site accessibility for visually impaired users.

Background Information: Laws and Recommendations

(If you don't have time for the background information, then skip to "The Short Version" at the end.)

Web accessibility is the practice of making web sites accessible by all people regardless of physical disabilitiy or lack of access to the latest technology (such as JavaScript). In the United States, web site design should follow the accessibility standards set by the American Disabilities Act, Section 508 of the Rehabilitation Act, and the World Wide Web Consortium.

The American Disabilities Act (ADA) is a 1990 civil rights law that affords protection against discrimination to Americans with disabilities. Title II of the ADA places non-discrimination requirements on the web sites of public agencies (state and local government).

Section 508 was a 1986 amendment to the Workforce Rehabilitation Act of 1973. It proved to be ineffective, and in 1998 the proposed Federal Electronic and Information Technology Accessibility and Compliance Act was enacted as the new Section 508. In particular, sub-part B, 1194.22 provides 16 rules for Web-based intranet and internet information and applications.

The standards of Section 508 web page design are complementary to the recommendations laid out in the Web Content Accessibility Guidelines (WCAG 1.0) of the Web Accessibility Initiative (WAI) of the World Wide Web Consortium (W3C), which is the international standards organization for the World Wide Web. A working draft of WCAG version 2.0 was published on May 17, 2007.

Additional sources of information about Section 508 standards include:

United States Access Board - The Access Board developed the accessibility standards used in the Federal government's procurement regulations for the various technologies covered by Section 508

Section 508.gov - GSA’s Office of Governmentwide Policy, Center for IT Accommodation (CITA) is charged with educating Federal employees and building the infrastructure to support section 508 implementation.

ADA.gov - Department of Justice's Civil Rights Division explains how to maintain ADA compliance for State and Local government web sites

Accessibility Forum - The GSA has created a "Buy Accessible" system to help decide when a federal government purchase must comply with Section 508

Information Technology Technical Assistance and Training Center - The ITTATC reached the end of its 5-year grant on May 16, 2006, so this information is for historical purposes only

Who Does It Apply To?

While Section 508 attempts to follow the WCAG standards, and the WAI tries to accommodate international legal policy, it is important to recognize that the W3C publishes recommendations for users of the World Wide Web, while Section 508 and ADA are laws that apply to many web sites in the U.S.

I'm not a lawyer, but my research indicates that ADA Title II applies to all state and local government web sites, while Section 508 applies to all public agencies that receive federal funding. In addition, vendors (like Certain Software) that provide web sites to federal agencies must comply with Section 508 as a requirement of the purchasing process. Compliance requirements may be expanding to private web sites, however, as USWeb.com reports that "A few sites have already been sued under the ADA, including two major travel sites (Priceline and Ramada.com) that must now meet web accessibility standards and reimburse the court for tens of thousands of dollars."

Besides the legal requirements, following the W3C guidelines for web site development is simply good business - it ensures compatibility with future web browsers and reaches the widest possible audience. Again from USWeb.com, "According to the Civil Rights Division of the U.S. Department of Justice, there are 50 million people with disabilities in the United States with $175 billion in discretionary spending power." When you consider that Section 508 Compliance benefits not only blind people, but mature audiences and people with visual impairments, the need to serve these groups in our aging population is clear.

Implementing Web Accessibility Guidelines

The best place to start is to read the 16 rules for web site design in Section 508 Sub-part B 1194.22. The Access Board provides examples of implementing these 16 rules with greater detail. Also, Chapter 5 of the "ADA Best Practices Tool Kit for State and Local Governments" provides examples of designing web sites that comply with Title II of the ADA.

For experienced Web designers, Jim Thatcher wrote a comprehensive 12-page Web Accessibility Tutorial on implementing Section 508 compliance and published it on his web site JimThatcher.com. This is the best resource for Web User Interface (UI) developers who want to learn how to implement Section 508 compliance.

And for the truly zealous, the Web Content Accessibility Guidelines version 2.0 is the ultimate compilation of best practices for accessibile web design.

Validating Compliance

Jim Thatcher has an excellent 5-page tutorial on Testing for Accessibility. The most popular program, Bobby, was started as a free service by the Center for Applied Special Technology. It was rolled into the Watchfire WebXact testing tool, which unfortunately will no longer be available for free use after July 15, 2007. (Bobby offers a free 10-day evaluation with registration, or it is available for purchase for $299.) Watchfire also offers a comprehensive WebXM Application Scanner, which looks for security, spelling, and compliance errors in your web pages and can be integrated into QA processes via solutions such as the HP Mercury Quality Center, IBM Rational ClearQuest, and Microsoft Visual Studio Team System.

I used the free testing tool at WebXact on a sample registration form created to test the payment page of our online registration process. It is an excellent product. You simply enter a web site URL, it scans that page, and then provides a concise report showing the errors and warnings your HTML has compared to either the Section 508 or W3C WCAG standards. You can click on any of the warnings to see the specific checkpoint line in the relevant standard that triggered the message, along with instructions for resolving the issue. Below are screenshots I took of this process.

Going back to the reason for this article, readers who carefully inspect the WebXact results will notice that we did have a Section 508 non-compliance error on our payments page - the "Billing Address" form fields were not identified with labels. Our client's form, however, did not use these fields, and thus it was in compliance. The original issue that they raised regarded our use of JavaScript to show or hide form fields based on the payment method that the registrant selects. JavaScript (or "Dynamic HTML") in itself, however, is not in violation with Section 508 or W3C standards, because it was designed to "show all" fields if JavaScript is disabled in the user's browser, or if the user is visually impaired and using a screen reader tool to access the page. I was able to demonstrate this by disabling JavaScript on my browser (in IE 7, this is under Tools > Internet Options > Security > Custom Levels, scroll down to Scripting, under "Active Scripting" select "Disabled", then close and re-open the browser) and re-loading the payments page, which correctly showed the form fields for all payment methods.

So, What Does It "Look" Like to Visually Impaired Users?

The best way to experience your web site or application through the eyes of impaired users is to either use a test-only browser or screen reader software.

The most popular text browser is "Lynx". You can see it in action by entering a URL from your Web site at the free Lynx Viewer available at http://www.delorie.com/web/lynxview.html. Below is a screenshot of the "Lynx" (text-only) view of the same payment page shown above.



The most popular screen reader is JAWS. It's an interesting exercise to load it on your PC and have it read your web site to you. You can select from several electronic voices and adjust the speed to match your preferences. I once watched an accessibility expert at the Equal Employment Opportunity Commission (EEOC) use JAWS on our registration application at a blistering pace. She (and according to her, most blind people who use screen readers regularly) could navigate through a page using the electronic voice faster than I could read it.

The Short Version

If you want to be compliant with the ADA and Section 508 accessibility guidelines:

1. Read the Section 508 Rules.
2. Have your Web designer read Jim Thatcher's Web Accessibility Tutorial
3. Validate compliance on your web site with Watchfire WebXact or one of the other tools listed in Jim Thatcher's Six Tools for Testing.