Healthcare websites and the HHS Section 504 rule: the deadlines

If your practice accepts federal funds such as Medicare or Medicaid, the HHS Section 504 rule requires your website and apps to meet WCAG 2.1 AA. Practices with 15 or more employees must comply from 11 May 2027, and smaller ones from 10 May 2028.

Written by the nextwebsite.co team, and last checked on November 7, 2026.

Who the rule covers

Section 504 of the Rehabilitation Act bars discrimination on the basis of disability by anyone who receives federal financial assistance. For healthcare, that usually means providers that accept Medicare or Medicaid. In 2024 HHS added specific web requirements to its Section 504 rule, and in May 2026 it extended the deadlines by a year¹.

What it requires

Websites and mobile apps must meet WCAG 2.1 level AA¹. That includes the parts you don't build yourself: online booking, patient forms, bill payment and portals, if you provide them to patients through a contract or a licence. Meeting WCAG 2.2 AA covers WCAG 2.1 AA².

The deadlines

15 or more employees: from 11 May 2027.
Fewer than 15 employees: from 10 May 2028.

The dates come from the rule as amended on 11 May 2026¹. Check them again before you rely on them, because they have moved once already.

Privacy belongs in the same review

The same pages that need to be accessible often collect health information, such as appointment requests and intake forms. HHS has warned providers about tracking technologies, like advertising pixels, on pages where patients enter health details. A federal court vacated part of that guidance in June 2024, but the warning about authenticated pages and patient portals still stands³. When you review a page for accessibility, check what scripts it loads too.

Why act before the deadline

Section 504 isn't the only exposure. More than 5,000 digital accessibility lawsuits were filed in the US in 2025⁴, under the ADA rather than Section 504. A site that meets WCAG 2.2 AA answers the rule and a demand letter at the same time.

This guide is general information, not legal advice. If you're unsure whether the rule applies to you, ask a healthcare compliance lawyer.

Checklist

Confirm whether you receive federal financial assistance, and count your employees.
Test the site, booking flow and patient forms against WCAG 2.1 AA; WCAG 2.2 AA covers it.
Check the third-party pieces too: booking widgets, payment pages and patient portals.
Remove tracking pixels from pages where patients enter health information.
Fix, re-test, and keep a dated record before your deadline.

Check your own site

The free scan checks your pages for the accessibility problems a machine can find, and marks the checks that need a person. It takes under a minute.

Or run just this check: the accessibility checker.