Guide · Healthcare
HHS Section 504 web accessibility deadline for healthcare providers
Hospitals, health centers and other HHS-funded providers have an extra year to make their websites and apps accessible. Here are the new dates and how to use the time.
The short answer
In May 2024 the U.S. Department of Health and Human Services (HHS) issued a final rule under Section 504 of the Rehabilitation Act. Among other things, it requires recipients of HHS federal financial assistance to make their websites and mobile apps meet WCAG 2.1 Level AA.
An interim final rule (announced by HHS and summarized by the American Hospital Association) that took effect on May 7, 2026 moved the compliance dates back by one year:
- May 11, 2027 for recipients with 15 or more employees (previously May 11, 2026).
- May 10, 2028 for recipients with fewer than 15 employees (previously May 10, 2027).
The extension lines up with the similar one-year delay DOJ announced in April 2026 for state and local governments. HHS said it may propose changes to the rule during the delay; if it does not, it expects to apply the rule at the new dates.
Who is covered
The rule applies to organizations that receive federal financial assistance from HHS. In healthcare that commonly includes many hospitals and health systems, community health centers, and state health and human services agencies, along with other providers and programs that receive HHS funding. Your date depends on how many people you employ.
Whether your organization is a recipient, and how employees are counted, are legal questions. If you are not sure, ask your compliance team or counsel before you plan around the later date.
If your organization runs several sites, such as a health system with many small clinics, confirm with counsel how employees are counted before you assume a small site has until 2028. Planning for the earlier date is the safer default.
What is covered
The rule covers web content and mobile apps that a recipient provides directly or through contractual, licensing or other arrangements. That last part matters: a scheduling tool, patient portal or payment page run by a vendor on your behalf is still part of your responsibility.
Documents deserve particular attention. Intake and consent forms, notices of privacy practices, financial assistance applications and patient education handouts are often posted as PDFs that were never tagged. Like the DOJ rule, the HHS rule includes some limited exceptions, for example for certain archived or older content; check with counsel before you rely on one.
What WCAG 2.1 AA means in practice
WCAG 2.1 AA is a set of testable success criteria. For a healthcare website, the common failures are:
- Booking, bill-pay and contact forms that cannot be completed with a keyboard or that lack field labels.
- Images, icons and buttons without text alternatives.
- Low-contrast text, for example light grey on white.
- Patient education videos without captions.
- PDF forms and notices with no tags, so screen readers cannot read them in order.
Mobile apps
If you offer a patient app, test it on real phones with the built-in screen readers, VoiceOver on iOS and TalkBack on Android. Check that every button has a spoken label, that text can be enlarged without breaking the layout, that the app works in both portrait and landscape unless a specific orientation is essential (WCAG 1.3.4), and that sign-in, booking and messaging can be completed without precise gestures. Many apps are built by vendors, so make these checks part of acceptance testing for each release, not only a one-time review.
Documents to fix first
Many providers have hundreds of PDFs online. Start with the ones patients need to receive care or understand their rights and costs:
- Registration, intake and consent forms that patients are asked to complete before a visit.
- Notices, such as the notice of privacy practices and nondiscrimination notices.
- Financial assistance policies and applications, and billing information.
- Patient education materials and discharge instructions that are posted online.
- Provider directories and location guides published as PDFs.
Where a form is used often, consider replacing the PDF with an accessible web form. Where the PDF must stay, have it remediated and tested, and fix the source file so future versions start out accessible.
Questions to ask your vendors
Much of a provider’s digital presence is built on vendor platforms. Before renewals and new purchases, ask:
- Do you have a current ACR for the version we use, and which WCAG version and edition does it cover?
- Which issues in the ACR are still open, and by what date will they be fixed?
- Who tests your releases for accessibility, and with which tools and screen readers?
- Will you commit to WCAG 2.1 AA in our contract?
A plan for the time you have
A year passes quickly once budgets and vendor contracts are involved. A workable order is:
- Inventory. List every website, portal, app, online form and posted document, and the vendor behind each one.
- Test key journeys. Audit the tasks patients rely on: finding a provider or location, booking, paying a bill, completing forms. Our website audits test against WCAG 2.1 AA with keyboard and screen-reader checks.
- Fix the highest-use items first. Shared templates and components fix many pages at once. Remediate the PDFs patients download most through document remediation, and add captions to key videos through media accessibility.
- Hold vendors to the standard. Ask each vendor for a current Accessibility Conformance Report and a dated plan for any gaps. Our guide What is a VPAT / ACR? explains what to look for.
- Keep it accessible. New content and releases can undo fixes. Regular monitoring catches regressions early.
If your PDF forms and notices are the biggest gap, contact us for a quote, or ask whether you are eligible for our free PDF test, so you can see the result on your own files first.
Prepared by ClearLayer Access. Published October 31, 2026; dates, rules and references checked against official sources on October 31, 2026. This guide is general information, not legal advice, and following it does not guarantee compliance or any legal outcome.
Frequently asked questions
Under the HHS interim final rule effective May 7, 2026, recipients with 15 or more employees must comply by May 11, 2027, and recipients with fewer than 15 employees by May 10, 2028.
WCAG 2.1 Level AA for web content and mobile apps. The interim final rule changed only the dates, not the standard.
Yes. It covers web content and mobile apps a recipient provides, including those provided through contractual, licensing or other arrangements, such as a vendor-run portal or scheduling tool.
If a practice receives federal financial assistance from HHS, it is covered. Recipients with fewer than 15 employees have until May 10, 2028. Ask counsel whether your organization is a recipient.
Start with your patient forms.
Tell us what you publish, from intake forms to notices, and we will confirm the scope, timeline and cost.