The HHS Section 504 Web Rule: What Small Healthcare Providers Need to Know About the New Deadlines

If your practice bills Medicaid, CHIP, or Medicare, a federal rule already requires your website and mobile app to meet WCAG 2.1 AA — and the deadline is May 11, 2027 if you have 15 or more employees, or May 10, 2028 if you have fewer. That comes from the Department of Health and Human Services’ Section 504 rule, finalized in May 2024, with deadlines extended one year by an interim final rule HHS published on May 11, 2026.

Most coverage of this rule is written by law firms for hospital systems. But the rule doesn’t stop at hospitals. It reaches the two-chair dental office, the solo therapy practice, and the home-health agency — any organization that takes HHS money. Here’s what the rule says, who it covers, and a realistic first-90-days plan.

What is the HHS Section 504 web accessibility rule?

It’s a 2024 regulation that, for the first time, sets a specific technical standard for the websites and mobile apps of healthcare and human-services organizations that receive federal funds. HHS published the final rule — Nondiscrimination on the Basis of Disability in Programs or Activities Receiving Federal Financial Assistance — on May 9, 2024, and it took effect on July 8, 2024.

Section 504 of the Rehabilitation Act has banned disability discrimination by recipients of federal money since 1973. What the 2024 rule added is precision: a new Subpart I of 45 CFR Part 84, titled “Web, Mobile, and Kiosk Accessibility,” which names WCAG 2.1 Level AA as the standard and attaches hard dates.

The regulation’s own words, at § 84.84: a recipient “shall ensure that the web content and mobile apps that the recipient provides or makes available, directly or through contractual, licensing, or other arrangements, comply with Level A and Level AA success criteria and conformance requirements specified in WCAG 2.1.” If you want the plain-English version of that standard, our guide to WCAG 2.1 AA breaks it down.

Does the rule apply to my small practice?

If you participate in Medicaid, yes — Medicaid payments are federal financial assistance, and taking them makes you a “recipient” under the rule. The regulation defines a recipient as “any public or private agency, institution, organization, or other entity, or any person to which Federal financial assistance is extended directly or through another recipient” (45 CFR § 84.10). There is no small-business exemption. Size only determines which deadline you get.

In practice, that sweeps in the providers nobody is writing compliance memos for:

• A dental practice that accepts Medicaid or CHIP patients
• A private clinic or therapy practice enrolled as a Medicaid provider
• A home-health agency paid through Medicare or a state Medicaid program
• A community health center, pharmacy, or counseling service receiving HHS grants

Law firm McDermott Will & Emery notes the rule reaches providers participating in “Children’s Health Insurance Program, Medicare, and Medicaid,” and adds that even entities “whose only source of federal funds is Medicare Part B are likely to also be required to comply with Section 504” in light of HHS’s parallel Section 1557 rules (McDermott). The old assumption that Part B billing kept you outside these laws is no longer safe.

If none of your revenue touches HHS programs, this specific rule doesn’t bind you — but the ADA can still apply to your website through Title III, which is a separate legal track with its own active litigation. Our comparison of ADA vs. Section 508 vs. WCAG sorts out which law does what.

What are the deadlines after the May 2026 extension?

On May 7, 2026, HHS’s Office for Civil Rights announced a one-year extension of both compliance dates, formalized in an interim final rule published in the Federal Register on May 11, 2026 (91 FR 25496). The extension responded to concerns that many recipients — community health centers, hospitals, and primary care providers among them — could not meet the original dates.

Two things the extension did not do. First, it changed nothing about the substance: same WCAG 2.1 AA standard, same covered content, same exceptions. As accessibility firm Deque put it, “there is no rollback in requirements, no narrowing of scope, no modification to what must be made accessible” (Deque).

Second, it did not pause Section 504 itself. The rule’s general ban on disability discrimination — including in services you deliver through a website — has been in effect since July 8, 2024. An inaccessible patient portal can be a Section 504 problem today; the 2027/2028 dates are just when the specific WCAG benchmark becomes mandatory.

The move also mirrors the Department of Justice, which extended its parallel web-accessibility deadlines for state and local governments the month before (AHA News, May 7, 2026). That DOJ rule is a different regulation for a different audience — we cover it in our Title II web rule explainer — but the two standards are intentionally aligned.

What exactly has to be accessible?

Everything digital that patients use to reach your services — including the parts you rent. The rule covers web content and mobile apps you provide “directly or through contractual, licensing, or other arrangements” (45 CFR § 84.84). For a typical small provider, that means:

• Your marketing website — locations, hours, provider bios, insurance information
• Online scheduling and intake — including third-party booking widgets embedded on your site
• Patient portals and telehealth platforms — even when a vendor runs them under your name
• Documents patients actually use — intake forms, consent forms, billing PDFs (see our post on the PDF compliance gap)
• Your mobile app, if you offer one

The same subpart also addresses check-in kiosks. Section 84.83 prohibits excluding people with disabilities from any program “provided through kiosks” — the self-service machines patients use to check in, enter information, or have vitals taken. Kiosks don’t get a WCAG deadline, but the nondiscrimination duty applies now, so a kiosk-only check-in flow with no staffed alternative is a real risk.

The vendor point deserves emphasis. Outsourcing the portal does not outsource the obligation — the rule explicitly ropes in content provided through contracts and licenses. Ask vendors for evidence of WCAG 2.1 AA conformance, not a marketing page. A VPAT or accessibility conformance report is the document to request.

What’s exempt?

Five categories, listed at 45 CFR § 84.85 — and each is narrower than it sounds:

1. Archived web content — old material kept purely for reference in a clearly labeled archive area, never updated after archiving.
2. Preexisting conventional electronic documents — PDFs, Word files, spreadsheets, and slide decks posted before your deadline. The catch: the exemption vanishes if the document is “currently used to apply for, gain access to, or participate in” your services. Your intake packet doesn’t qualify.
3. Third-party content — things outsiders post, like patient comments. Content from your vendors and contractors is not exempt.
4. Individualized, password-protected documents — a specific patient’s secured statement or record.
5. Preexisting social media posts — posts published before your compliance date.

There is also an escape valve for “undue financial and administrative burdens” — but it’s deliberately hard to use. Under § 84.88, the head of the organization (or a designee) must make that determination after considering all available resources and document it in a written statement, and you still must do everything that isn’t an undue burden. It is a narrow defense, not a waiver.

What happens if a provider doesn’t comply?

HHS “may initiate a compliance review on its own or in response to a complaint submitted to HHS by an individual,” and an investigation can end in “fines or other penalties to the non-compliant entity,” as law firm Katten summarizes the enforcement framework (Katten). For a practice that depends on Medicaid revenue, a compliance dispute with the agency that funds you is worth avoiding.

There’s a compounding factor: the same barriers that violate this rule — unlabeled form fields, poor color contrast, keyboard traps in a booking widget — are exactly what drives private ADA website lawsuits, which Katten notes “have been on the rise in recent years” under Title III. Fixing your site once addresses both exposures. The fixes are also just good business: accessible scheduling works better for every patient, including the growing share who are older or on mobile devices.

Your first 90 days: a realistic plan

You don’t need to solve this in a quarter. You need to be underway, with the highest-risk items handled first. Here’s the sequence we recommend to small providers:

1. Confirm you’re covered (week 1). List every HHS-connected revenue source: Medicaid, CHIP, Medicare, HHS grants. One yes means the rule applies. Note your employee count — it sets your deadline.
2. Inventory your digital front door (weeks 1–2). Website, booking tool, portal, telehealth platform, app, kiosks, and every PDF patients must use. Note which are vendor-supplied.
3. Run a baseline scan (week 2). An automated pass catches machine-detectable issues like contrast failures and missing alt text in minutes — just remember an automated check is a floor, not a verdict, because it can’t test what a screen-reader user actually experiences.
4. Get a manual audit of critical patient flows (weeks 3–6). Scheduling, intake, contact, and billing — tested with a keyboard and a screen reader against WCAG 2.1 AA. That’s what a proper accessibility audit covers.
5. Send vendor letters (weeks 3–4). Ask your portal, booking, and telehealth vendors for current WCAG 2.1 AA conformance documentation and a remediation timeline for gaps. Get it in writing.
6. Fix the blockers first (weeks 6–12). Prioritize anything that stops a patient from booking, completing intake, or paying. Manual remediation of real code is what holds up — a widget or overlay won’t get you there.
7. Rebuild active documents (weeks 8–12). Replace inaccessible intake and consent PDFs with accessible HTML forms or properly tagged PDFs.
8. Set a maintenance rhythm (ongoing). New pages and vendor updates reintroduce barriers, so schedule recurring checks well before your 2027 or 2028 date.

One caveat, as always: this article is general information, not legal advice. Deadlines and interpretations can shift — HHS is accepting public comments on the extension through July 6, 2026, and could adjust the rule after reviewing them — so if you’re making coverage decisions, involve a healthcare attorney.

The extension bought small providers a year. The providers who’ll spend spring 2027 calmly are the ones who used it. If you want to know exactly where your site stands against WCAG 2.1 AA, start with a free scan — it takes about a minute and gives you the baseline your 90-day plan starts from.