Accessibility laws · United States (healthcare)

HHS Section 504 Web Rule (Healthcare)

If you bill Medicare or Medicaid, this rule already covers you, whether or not anyone has told you so. Medicare Part B reimbursement on its own is enough, which catches a lot of small practices that have never once thought of themselves as federally funded. What it asks for is WCAG 2.1 Level AA on your web content and your mobile apps. The date is May 11, 2027 if you have 15 or more employees, and May 10, 2028 if you have fewer. Check-in kiosks are covered too, under a plain duty not to shut anyone out rather than a technical standard.

WCAG required: 2.1 AA
Deadline, 15+ employees: May 2027
Deadline, under 15: May 2028
Enforcing office: OCR

What the law is

On May 9, 2024 the Department of Health and Human Services, HHS, finalized a rule under Section 504 of the Rehabilitation Act, the same 1973 statute that Section 508 sits inside. It took effect July 8, 2024. Under it, any organization receiving HHS federal financial assistance has to make its web content and mobile apps conform to WCAG 2.1, Level A and Level AA. HHS built it to match the DOJ Title II rule deliberately. It said it coordinated on the technical standards so that an organization which is both a funding recipient and a public entity would not be held to two different bars. That is why the two rules share a standard, share the same five content exceptions, and got delayed within three weeks of each other. One scoping note before we go on. The web provisions are a small part of a much larger rule that also covers medical treatment decisions, child welfare programs, and accessible medical diagnostic equipment. This page covers the web part.

Federal financial assistance is defined broadly enough to surprise people. It reaches any grant, cooperative agreement, loan, subgrant, or other arrangement through which the Department makes assistance available. That assistance can arrive as funds, as property, as the services of federal personnel, or as any other thing of value. Under the 2024 rulemaking, an organization whose only federal money is Medicare Part B reimbursement is covered, which reversed decades of the Department's own practice. Part B is the outpatient side. So a solo dermatologist with no grant, no federal contract, and no sense of being federally funded is inside this rule. The sources describing it name hospitals, physician practices, community health centers and other federally qualified health centers, long-term care facilities, health plans, medical schools, research institutions, human services programs, and Head Start agencies. The test is the money, not the specialty.

Then the dates moved. On May 7, 2026 an interim final rule pushed both compliance deadlines back a year. HHS concluded the original dates were unlikely to be met by a significant number of recipients, especially local governments and smaller organizations. The evidence behind that sits in the public record, and it is genuinely useful if you are building a budget. The National League of Cities reported one-time quotes for PDF and website remediation running from $10,000 to $20,000, with annual remediation estimates as high as $70,000. It also put a city of about 275,000 people at roughly 1,300 staff hours for training, auditing, remediation oversight, and enforcement support. Primary care associations told the government that federally qualified health centers were struggling most with two things, making electronic documents accessible and keyboard-only navigation. Start there.

One sentence in that interim rule matters more than the new dates. Regardless of the compliance dates, recipients keep an ongoing obligation to make the programs and activities they offer through web content and mobile apps accessible, under the rest of their Section 504 duties. So the deadline moved. The duty did not.

This applies to you if…

You accept Medicare, Medicaid, or any other HHS funding, whether it reaches you directly or through a state program. Medicare Part B reimbursement on its own does it, so a practice with no grants and no federal contracts is still a recipient. Your size changes your deadline. It never changes whether you are covered.
You run patient-facing digital tools of any kind, including a patient portal, a telehealth platform, online intake and scheduling forms, a mobile app, or a check-in kiosk in the waiting room.
You build or host those tools for a covered provider. The rule puts the duty on the recipient, for the web content and mobile apps it provides directly or through contractual, licensing, or other arrangements. So it reaches you through your contract rather than through the statute itself. The practical effect is the same. Your customer cannot comply unless you do.
You are a school, college, or university that takes HHS money. The 2023 proposal carried exceptions for course content at both school and postsecondary level, and HHS removed them from the final rule after heavy negative comment. There is no course-content carve-out to fall back on.

What it technically requires

Your web content and your mobile apps have to conform to WCAG 2.1, Level A and Level AA, by the date that matches your headcount. Fifteen or more employees and that date is May 11, 2027. Fewer than fifteen and it is May 10, 2028. The rule pins WCAG 2.1 to the June 2018 version of the standard by incorporating that exact document, so WCAG 2.2 does not become your legal requirement on its own. One honest gap here. Nothing we could find in the rule or the published guidance says whether those fifteen employees are counted full-time, full-time-equivalent, or every name on the payroll. If you sit anywhere near fifteen, plan for the earlier date.
If you are also a state or local government body, a second federal clock runs fifteen days ahead of that one. The ADA Title II rule wants WCAG 2.1 Level AA by April 26, 2027 from a public entity whose Census population is 50,000 or more, and this rule wants it by May 11, 2027 from a recipient with fifteen or more employees. Public hospital districts, county health departments, university clinics and school districts billing Medicaid are routinely both things at once. Neither clock doubles the work. The standard is identical, and the five content exceptions in the two rules are written in almost the same words, which is exactly what HHS meant when it said it had coordinated with the Department of Justice. What differs is the threshold, because one counts your Census population and the other counts the people you employ. So you can land in the later tier of one rule and the earlier tier of the other. Build to whichever date comes first and the second one looks after itself.
The rule covers the whole patient journey, not just the marketing site most people picture first. Booking, medical records access, billing, and telehealth sessions are all part of how a patient actually receives care, so all of them sit inside it.
Check-in kiosks are covered by the rule but not by WCAG. The kiosk provision is one sentence of plain nondiscrimination language. No qualified individual with a disability may be excluded from, denied the benefits of, or discriminated against in a program delivered through a kiosk. No technical standard is attached to it. In practice that means a workaround is allowed, and it has to give the same access, the same convenience, and the same confidentiality the kiosk gives everyone else. A clipboard handed over at a busy front desk fails the confidentiality half of that test.
Five categories of content are exempt, which is three more than most organizations realize. Archived web content is exempt. Conventional electronic documents posted before your compliance date are exempt, unless they are currently used to apply for, get access to, or take part in your programs, which is exactly what most intake PDFs are. Third-party content is exempt, except where it was posted because of a contract, a license, or another arrangement with you. A document is exempt where it is both about one specific person, their property, or their account, and password-protected or otherwise secured. Both halves have to be true. Social media posts made before your compliance date are exempt.
The escape valves are narrower than they sound, and every one of them asks you to show your work. Undue financial and administrative burden, or a fundamental alteration of your program, excuses you only up to the point where the burden begins. You still comply as far as you can. And HHS describes what claiming it looks like, meaning the recipient reviews its budget, weighs the options, reaches a conclusion, and writes down the reasons for it. A conforming alternate version is allowed only where technical or legal limits make direct accessibility impossible. And a narrow minimal-impact provision deems you compliant where a nonconformance has so little effect on access that it would not change whether someone with a disability can use the content as anyone else would. That is not a rule saying 98 percent is fine, and the burden of proving it sits with you.
You are allowed to get there another way, as long as the result is at least as good. The rule permits alternative designs, methods, or techniques where they produce substantially equivalent or greater accessibility and usability. That is the provision behind the question everyone asks, which is whether to skip ahead and build to WCAG 2.2. Build to it, by all means. Just do not assume it covers you, because it does not quite. WCAG 2.2 dropped success criterion 4.1.1 Parsing, and HHS said in this rule that conformance to 4.1.1 is still required by it. The DOJ said the same about its own rule, in nearly the same words. So test 4.1.1 as well, or be ready to argue that section 84.89's minimal-impact provision covers the gap.

All roads lead to WCAG. Start with Level AA, the legal standard or the full 55-rule library. Unfamiliar term along the way? The A to Z glossary decodes it.

How it is enforced

The HHS Office for Civil Rights, OCR, investigates complaints and can require corrective action once it finds a violation. What gives that real weight is the money. Section 504 conditions HHS funding on not discriminating, so the lever behind an OCR finding is the funding a recipient depends on to operate.

Section 504 also carries a private right of action, which means a patient can sue you directly with OCR never involved, and a court may award a reasonable attorney's fee to the prevailing party. HHS said something worth reading twice when it delayed the deadlines. It explained that it could not simply stop enforcing, because a court may consider the 2024 final rule when ruling on a private right of action. In plain terms, this rule is the yardstick in a private lawsuit whether or not a regulator ever knocks.

The same document flags something that should give any provider pause. HHS wrote that litigation risk is heightened because some recipients may be generating covered web content with generative AI that is potentially inaccessible. The DOJ made a parallel point about the limits of AI for remediation a few weeks earlier. Two federal agencies, inside a month, putting on the record that automatically produced content and automatic fixes are part of the problem rather than the answer to it.

If you have heard that Section 504 is being challenged in court, the detail matters more than the headline. Seventeen states sued over the 2024 rule in September 2024, and what they challenged is gender dysphoria as a disability and the integration mandate. The web provisions are not part of it. The states have since said they no longer seek to have Section 504 itself declared unconstitutional, and the case has been stayed. Your web deadline is not waiting on that litigation.

Key dates

Jul 8, 2024HHS Section 504 final rule takes effect
May 7, 2026HHS extends the digital accessibility deadlines by one year
May 11, 2027Deadline: recipients with 15 or more employees
May 10, 2028Deadline: recipients with fewer than 15 employees

What to do about it

Every obligation on this page is measured against WCAG, so the first step is knowing where you actually stand. Run the free 10-page scan for the machine-checkable slice. For the rest, we review the key journeys with an expert and a real blind screen-reader user, then attach a screenshot and a fix to every finding. $499, 5 business days.

Order your audit Run the free scan

Primary sources

Other laws

Related on this site

What to read next, and the terms this page uses.

Orientation only, current as of August 2026. Not legal advice, and no attorney-client relationship is created. For your specific situation, talk to your own lawyer.