Why This Deadline Is Different
Most of what businesses hear about "ADA website deadlines" is noise: ADA Title III — the part of the law that applies to private businesses — has never had a federal compliance date or a codified technical standard.
The HHS Section 504 rule is the exception. It is a real federal regulation, with a real technical standard (WCAG 2.1 Level AA) and real calendar dates, that applies directly to private healthcare providers — medical practices, dental offices, clinics, pharmacies, therapy practices — if they receive federal financial assistance from the Department of Health and Human Services. Because Medicare and Medicaid participation counts as federal financial assistance, that covers most of the US healthcare sector.
If you run the website for a healthcare organization, this is the regulation to build your accessibility plan around. Here is the rule, the dates, the pending litigation that could move those dates again, and a practical path to conformance.
What the HHS Section 504 Rule Requires
Section 504 of the Rehabilitation Act prohibits disability discrimination by recipients of federal financial assistance. In May 2024, HHS published a final rule updating its Section 504 regulations to, for the first time, set an explicit technical standard for digital accessibility: covered providers' websites, mobile apps, and web-based patient tools must conform to WCAG 2.1 Level AA.
In scope, that means the digital front door of a practice, not just its homepage:
- The practice website itself — pages, forms, documents
- Online appointment scheduling and intake forms
- Patient portals and secure messaging interfaces
- Telehealth platforms and video visit flows
- Billing and payment tools
- Mobile apps offered to patients
The rule reflects a consistent federal position: WCAG 2.1 AA is the same standard the DOJ codified for state and local governments under ADA Title II, and the same benchmark courts use in private ADA website litigation. Healthcare simply gets it in binding, dated form.
Who Is Covered: If You Bill Medicare or Medicaid, Probably You
Coverage under Section 504 follows the money: the rule applies to recipients of HHS federal financial assistance. In practice, the covered population includes:
- Physician practices and specialists participating in Medicare or Medicaid
- Dental practices that accept Medicaid or other HHS-funded programs
- Clinics, urgent care centers, and community health centers
- Pharmacies participating in federally funded programs
- Hospitals and health systems (virtually all receive HHS funds)
- Skilled nursing, home health, behavioral health, and therapy providers billing federal programs
- Health plans and other entities receiving HHS funding
For most private practices, the honest self-assessment is simple: if Medicare or Medicaid revenue appears anywhere in your billing, you should plan as a covered entity. Cash-only practices with genuinely no HHS-funded revenue streams fall outside this rule — but remain exposed to private ADA litigation like every consumer-facing business (more on that below).
The Deadlines: May 2027 and May 2028 — For Now
The 2024 final rule originally gave providers until May 2026 to conform. In May 2026, days before that deadline arrived, HHS published a rule extending the compliance dates by one year (Federal Register 2026-09266):
| Provider size | Web accessibility deadline |
|---------------|---------------------------|
| 15 or more employees | May 11, 2027 |
| Fewer than 15 employees | May 10, 2028 |
If that last-minute pattern sounds familiar, it should: one month earlier, the DOJ had done the same thing with the ADA Title II deadline for public entities, moving it from April 24, 2026 to April 26, 2027 — four days before it took effect. The full account of that extension is in our Title II deadline explainer.
The standard itself did not change in either case. WCAG 2.1 Level AA remains the requirement; only the dates moved.
The Delay Is Being Challenged in Court
The extension is not settled law. The National Federation of the Blind's May 2026 lawsuit challenges the federal accessibility deadline delays — arguing the government violated the Administrative Procedure Act — and asks the court to reinstate the original compliance dates.
That case is pending, and its outcome cannot be predicted. But the planning implication for healthcare providers is concrete: the May 2027 date could move closer. If the challenge succeeds, providers could face restored deadlines with little or no runway. A practice that treats May 2027 as distant and May 2028 as irrelevant is making a bet on litigation it does not control.
The rational posture is the same one we recommend to public entities under Title II: treat the extension as extra runway for an active program, not as permission to wait.
What WCAG 2.1 AA Means for a Healthcare Website
WCAG 2.1 Level AA is a set of 50 testable success criteria. For a typical practice website and patient-facing tools, the highest-impact requirements look like this:
Patients must be able to complete your forms. Intake forms, appointment requests, and portal registration need programmatically associated labels, clear error messages, and full keyboard operability. A form a screen reader user cannot complete is both a WCAG failure and, functionally, a patient turned away at the door.
Documents must be readable. Healthcare websites are unusually PDF-heavy: new patient packets, consent forms, insurance documents, aftercare instructions. Untagged, scanned, or image-only PDFs are inaccessible to screen readers and are among the most commonly cited barriers.
Text must be perceivable. Color contrast of at least 4.5:1 for normal text, resizable text up to 200%, and information never conveyed by color alone.
Everything must work without a mouse. Navigation, appointment schedulers, telehealth check-in, payment flows — all operable by keyboard, with visible focus, and no keyboard traps.
Media must have alternatives. Captions on patient education videos, transcripts for audio content, meaningful alt text on informational images.
Our WCAG 2.1 AA compliance checklist walks through every criterion. Note that AdaScanPro tests against WCAG 2.2 AA — the current W3C recommendation — which is a superset of 2.1 AA, so a site doing well against 2.2 exceeds the HHS requirement.
One warning specific to this sector: accessibility overlay widgets do not satisfy this rule. The FTC's order against overlay vendor accessiBe — finalized in April 2025 with a $1 million penalty — prohibits unsubstantiated claims that automated tools make websites compliant, and industry data shows 38.5% of businesses sued over digital accessibility already had such a "solution" installed (AudioEye, 2026). The details are in our analysis of why overlay widgets fail.
The Double Exposure: HHS Rule + Private Lawsuits
For healthcare providers, the HHS rule is one of two independent exposure layers.
The second layer is the one every consumer-facing business shares: private ADA litigation, which does not wait for any federal deadline. 2025 set a record with 3,117 federal website accessibility lawsuits (+27% per Seyfarth) and more than 5,000 across all courts (UsableNet); 2026 is pacing toward roughly 6,176 (+20%, UsableNet midyear). Healthcare is a recurring target in that data — patient portals, scheduling tools, and pharmacy sites present exactly the kind of transactional barriers that support concrete injury claims. Typical outcomes run from roughly $5,000 demand-letter settlements to $5,000–$30,000 lawsuit settlements, with defense costs of $30,000+ even for defendants who win. The full picture is in our lawsuit statistics report.
The practical consequence: even if the NFB litigation, future rulemaking, or your funding mix changes how the HHS deadlines apply to you, the WCAG 2.1 AA work is not wasted. It is the same standard courts use in the lawsuits that are already being filed today.
A Practical Compliance Plan for Practices
Between now and May 2027, a realistic program for a small-to-mid-sized practice looks like this:
1. Baseline scan (this month). Run an automated accessibility scan of your website, scheduling flow, and any patient-facing tools you control. This surfaces the machine-detectable WCAG issues — alt text, labels, contrast, keyboard barriers — in minutes and gives you a prioritized inventory.
2. Inventory your vendors (this quarter). Much of a practice's digital footprint is third-party: portal vendors, telehealth platforms, scheduling widgets, payment processors. Ask each vendor for their accessibility conformance documentation (a VPAT or equivalent) and their WCAG 2.1 AA roadmap. Their gaps are your compliance problem — the rule looks at what you offer patients, not who built it.
3. Remediate in priority order (next two quarters). Fix your highest-traffic, highest-impact pages first: homepage, contact and scheduling, intake forms, active-use PDFs. Most machine-detectable issues are mechanical fixes a developer can batch.
4. Handle documents. Replace or remediate inaccessible PDFs still in active use; post new documents in accessible formats from the start.
5. Monitor continuously and document everything. Sites drift out of conformance with every content update. Ongoing scanning plus a dated record of remediation demonstrates the kind of active, good-faith program that matters to regulators — and positions you well whether the deadline stays at May 2027 or moves again.
The healthcare sector got something the rest of the private economy never had: a real deadline, printed in the Federal Register, with the standard spelled out. Use it as the forcing function it is.
Scan your website free to see where your practice stands against WCAG 2.1 AA and 2.2 AA today — and what to fix before the calendar, or a courtroom, decides for you.
Tags
Share this article