What Section 504 covers on a practice website: booking, forms, portals

The Section 504 rule covers the website and apps you offer patients, including booking, intake forms, bill pay and portals that vendors provide for you. There are five narrow exceptions, and an old PDF that patients still use to get care isn't one of them.

Written by the nextwebsite.co team, and last checked on November 9, 2026.

The rule covers what patients use, not just what you built

The Section 504 rule covers web content and mobile apps that a provider makes available "directly or through contractual, licensing, or other arrangements"1. In plain words: if patients use it to find you, book with you or get care from you, it counts, even when a vendor built and runs it.

What's in scope

  • The website itself: every page, its menus, buttons, images, videos and downloads.
  • Online booking, including a booking page or widget supplied by a scheduling vendor.
  • Intake and registration forms, whether they're web forms or PDFs patients fill in.
  • Bill pay, if you link patients to a payment page as part of your service.
  • Patient portals and telehealth, where you provide them to patients under a contract or licence.
  • Mobile apps you offer patients.

Each of these has to meet WCAG 2.1 level AA2. Content that meets WCAG 2.2 AA meets 2.1 AA too3.

The exceptions, and their limits

The rule lists five exceptions4:

  1. Archived content that's kept only for reference, isn't changed, and is clearly marked as archived.
  2. Documents posted before your deadline, such as old PDFs, unless patients still use them to apply for, get or take part in your services.
  3. Content posted by a third party, unless they post it under an arrangement with you.
  4. Password-protected documents about one patient, such as a statement in the portal.
  5. Social media posts from before your deadline.

The second exception is the one practices most often misread. A PDF intake form posted years ago is still used to get care, so it isn't exempt4.

Vendors

You can't rewrite a vendor's booking page, but you choose which vendor you use. Ask each one whether their product meets WCAG 2.1 AA, for their accessibility conformance report, whether it has been tested with a screen reader and by keyboard, and how fast they fix problems. Keep the answers on file, and plan to switch if a vendor can't answer.

The usual problems on practice sites

The failures we see most often are images without text descriptions, form fields without labels, text with too little contrast, buttons that can't be reached by keyboard, and intake forms that exist only as PDFs. All of them are fixable, and most are fixed for good by rebuilding the templates rather than patching page by page. Our free check lists the ones on your site.

This guide is general information, not legal advice.

Checklist

  1. List the website, booking, forms, bill pay, portal, telehealth and apps patients use.
  2. Note which vendor provides each one.
  3. Mark anything that might be exempt, and check it against the five exceptions.
  4. Ask each vendor for their accessibility conformance report and keep the answers.

Check your own site

The free scan checks your pages for the accessibility problems a machine can find, and marks the checks that need a person. It takes under a minute.

Free, takes under a minute, and only reads what any visitor can see.

Or run just this check: the accessibility checker.

Read next

More on section 504 for healthcare, and what we build for medical practices, dental clinics and home health and hospice.