The Section 504 web accessibility rule for healthcare and HHS-funded organizations
What the HHS Section 504 rule requires of federal health funding recipients: WCAG 2.1 AA for web and mobile apps, the 2027 and 2028 deadlines, and how to prepare.
Last updated . General information, not legal advice.
In May 2024 the U.S. Department of Health and Human Services (HHS) updated its Section 504 regulation, 45 CFR Part 84. Among other changes, it now requires recipients of HHS financial assistance to make their web content and mobile apps accessible to WCAG 2.1 Level AA. For hospitals, clinics and other health and human services organizations this is the web accessibility rule that applies to you, whether or not you are also a government entity.
The deadlines
| Recipient | Compliance date |
|---|---|
| 15 or more employees | May 11, 2027 |
| Fewer than 15 employees | May 10, 2028 |
The original dates were one year earlier. Check the date that applies to you with our deadline calculator and confirm it with counsel.
Who is covered
The rule applies to anyone that receives federal financial assistance from HHS. That includes hospitals, clinics, nursing homes, health plans and providers that take Medicaid, state and local health and human services agencies, and universities and nonprofits with HHS grants. Medicare Part B payments on their own do not count as federal financial assistance, which is a common point of confusion. If you are unsure whether you receive HHS funds, ask your finance or compliance team.
What the rule requires
Web content and mobile apps that a recipient provides or makes available must conform to WCAG 2.1 Level AA. That includes your public site, patient portals, online scheduling and bill pay, forms, and content a vendor runs for you. Testing to WCAG 2.2 AA covers 2.1 AA as well and is the safer target.
The rule has exceptions similar to the ADA Title II rule: archived content, preexisting documents that are not currently needed to access a service, third-party content, individualized password-protected documents and preexisting social media posts. It also recognizes fundamental alteration and undue burden limits, with a written determination required. See the Title II guide for the detail, since the structure is parallel.
Why healthcare sites need extra care
- Portals and forms. Patient intake, scheduling and payment flows are where most barriers cause real harm. Test them first.
- Third-party systems. Scheduling, telehealth and portal vendors are your responsibility to hold to the standard. Ask each for a VPAT or ACR.
- Documents. Consent forms, instructions and bills posted as PDFs need tagging, titles and a stated language.
- Plain language. WCAG covers readability only at its highest level, but clear instructions help everyone, and are often the first thing a patient with a cognitive disability needs.
How to prepare
- Confirm whether you receive HHS financial assistance and how many employees you have.
- Inventory your sites, portals and apps, including vendor-run ones.
- Run a baseline audit to find what automation can detect.
- Fix critical and serious issues on patient-facing flows first, then test by hand with a keyboard and a screen reader.
- Update vendor contracts and request conformance documentation.
- Publish an accessibility statement with a way to report barriers.
- Monitor on a schedule so new content does not reintroduce old problems.
Frequently asked questions
Who is covered by the HHS Section 504 web accessibility rule?
Recipients of financial assistance from the U.S. Department of Health and Human Services, such as hospitals, clinics, nursing homes, health plans that take Medicaid, state and local health agencies and universities with HHS grants. Medicare Part B payments alone do not count as federal financial assistance.
What standard does the Section 504 rule require?
WCAG 2.1 Level AA for web content and mobile apps that a recipient provides or makes available. Content that meets WCAG 2.2 Level AA generally meets 2.1 AA as well.
What are the Section 504 compliance deadlines?
May 11, 2027 for recipients with 15 or more employees and May 10, 2028 for recipients with fewer than 15 employees. The original dates were one year earlier.
Is Section 504 different from ADA Title II?
They are separate laws enforced by different agencies, and many organizations are covered by both. The technical standard is the same, WCAG 2.1 AA, but the deadlines, the covered entities and the enforcing agency differ.
See where your site stands
Request a free WCAG 2.2 AA audit of your website. The report names the exact success criterion for every finding and the deadline that applies to you.