HHS Section 504 Final Rule: What the May 2026 Digital Accessibility Deadline Means for Healthcare Organizations

The first compliance deadline under the HHS Section 504 Final Rule is May 11, 2026, less than one month away for organizations with 15 or more employees.

If your organization receives any federal financial assistance from HHS and has not yet begun accessibility work, you are already behind.

What Is the HHS Section 504 Final Rule?

On May 9, 2024, the U.S. Department of Health and Human Services (HHS) published a Final Rule through the Federal Register that updated the regulations implementing Section 504 of the Rehabilitation Act of 1973. The rule took effect on July 8, 2024, and for the first time established clear, enforceable digital accessibility standards for every organization that receives federal financial assistance from HHS.

Section 504 has prohibited disability-based discrimination in federally funded programs since 1973, but until this Final Rule, it lacked specific technical standards for digital content. The updated rule closes that gap by requiring covered organizations to conform their websites, mobile applications, and kiosk-based services to the Web Content Accessibility Guidelines (WCAG), Version 2.1, Level A and Level AA.

This is a landmark shift for the healthcare industry. As HHS noted in its rulemaking, many healthcare services are now delivered through digital channels, and many of these tools contain barriers that prevent people with disabilities from accessing care on equal terms.

Who Is Covered?

The scope of this rule is broad. It applies to any entity that receives federal financial assistance from HHS, whether directly or indirectly. Because HHS administers more than 100 programs through which federal funding flows, the range of covered organizations is extensive.

Covered Organizations Include

• Hospitals and health systems
• Physician practices and clinics
• Community health centers
• Health insurers and Medicare Advantage organizations
• Medicaid managed care plans
• Long-term care providers and nursing facilities
• Behavioral health providers
• Clinical research institutions and medical schools
• Pharmaceutical and biotech firms receiving federal research funding
• State and local human and social service agencies
• Digital health companies whose products are used in HHS-funded programs

One critical point: The threshold of 15 employees determines your compliance deadline, not whether you are covered. A small clinic with eight employees that accepts Medicaid is subject to this rule. It simply has until May 2027 rather than May 2026. A single Medicare or Medicaid payment can be enough to trigger coverage.

IMPORTANT DISTINCTION

Federal procurement contracts and contracts of insurance or guaranty are not considered federal financial assistance and are not covered under this rule. However, the definition of federal financial assistance under Section 504 is broad and includes grants, loans, subsidies, and many other forms of assistance.

What Are the Digital Accessibility Requirements?

The rule mandates that covered entities make their digital properties conform to WCAG 2.1, Level A and Level AA success criteria.

Organizations may also conform to newer versions of WCAG (such as WCAG 2.2) or use different methods, provided the result is substantially equivalent or greater accessibility than WCAG 2.1 Level AA.

Websites and Institutional Web Content

All institutional web content must be accessible. This includes the organization’s primary website, patient portals, intranet resources used by program beneficiaries, mobile applications, online forms, multimedia content, interactive features, and any regularly updated content used for communicating with patients or the public.

Accessibility must be integrated into the design, development, and ongoing maintenance of digital content, not applied as a one-time fix.

Third-Party Content and Tools

The rule explicitly extends to web content and mobile apps that are provided or developed by third parties under contract or other arrangements.

This includes appointment schedulers, telehealth platforms, payment portals, electronic health record access portals, and any other digital service operated on behalf of the covered entity.

If a vendor’s platform is used by patients or beneficiaries to access your programs, your organization is responsible for ensuring that platform meets the accessibility standard.

Vendor Contracts Matter

Covered entities should review and update vendor contracts to require WCAG 2.1 AA conformance. Procurement processes should also include accessibility conformance documentation as a standard deliverable. If a vendor cannot demonstrate compliance, that represents a risk your organization inherits.

Kiosk Accessibility

Kiosks used for check-in, payment, wayfinding, or other patient-facing services must provide people with disabilities equal access, convenience, and confidentiality.

While there is no formal U.S. technical standard for kiosk hardware, HHS recommends applying WCAG 2.1 to the software layer. If a kiosk is not accessible, the organization must provide alternative procedures, but those alternatives must deliver the same level of access, convenience, and privacy that the kiosk provides to others.

For organizations looking for a comprehensive hardware accessibility framework, the European EN 301 549 standard provides a credible set of requirements for kiosk hardware and can be useful for compliance planning and procurement specifications.

Compliance Deadlines at a Glance

It is important to understand that the May 2026 deadline marks when WCAG 2.1 AA becomes the specific technical benchmark that the HHS Office for Civil Rights (OCR) will apply in enforcement. It does not mark the beginning of OCR enforcement itself.

Section 504 obligations have been enforceable since the rule took effect on July 8, 2024. OCR can investigate proactively, without a complaint being filed.

Exceptions to the Digital Accessibility Requirements

The rule provides a limited set of exceptions. Importantly, even content that falls under an exception may still need to be made accessible if someone with a disability makes a specific request for it under existing Section 504 obligations.

1. Archived Web Content: Outdated content maintained solely for reference or recordkeeping, clearly labeled as an archive, and not updated or actively used. Content that remains in use for any reason beyond archival reference must be compliant.
2. Pre-existing Conventional Electronic Documents: Legacy PDFs, Word documents, slide decks, or spreadsheets posted before the compliance deadline. However, this exception does not cover any documents that are currently used to apply for, gain access to, or participate in covered programs or activities.
3. Third-Party Content Not Under Entity Control: Public forum posts or files uploaded by users who are not under contract or arrangement with the covered entity.
4. Individualized Password-Protected Documents: Secure, individualized records such as lab results or account statements delivered to a single user. Broadly applicable or public-facing content does not qualify for this exception.
5. Pre-existing Social Media Posts: Content posted to social media platforms before the applicable compliance date. Going forward from the compliance date, new social media posts must be accessible (though the covered entity is not responsible for the accessibility of the social media platform itself).

While these exceptions may appear broad at first reading, their scope is deliberately limited. For example, older web content that is still widely used for purposes other than reference must be made accessible.

Similarly, electronic documents that are still actively part of a service or application process must comply. Organizations should not rely on these exceptions as a blanket shield.

Enforcement and the Risks of Noncompliance

Noncompliance with the rule can lead to serious consequences. The HHS Office for Civil Rights has several enforcement tools available: it can investigate individual complaints, conduct compliance reviews without any complaint being filed, and refer matters to the U.S. Department of Justice for further legal action.

The most direct risk is the potential loss of federal funding. For healthcare organizations that depend on Medicare, Medicaid, or other HHS-administered programs, this represents an existential threat.

Section 504 also provides a private right of action, meaning people who have experienced discrimination can bring lawsuits directly against covered entities. The new HHS rule provides a clear, enforceable standard that is likely to encourage additional litigation in the healthcare sector, potentially even for relatively minor technical barriers.

“HHS deliberately aligned its digital accessibility standards with the DOJ’s ADA Title II rule. The message is clear: digital accessibility is no longer a nice-to-have. It is a requirement, it is expected, and it is fundamental to equitable care.” — Deque Systems, Section 504 compliance analysis

How This Connects to the DOJ ADA Title II Rule

The HHS Section 504 Final Rule is closely aligned with the Department of Justice’s own Final Rule updating ADA Title II regulations, which imposes similar WCAG 2.1 AA requirements on state and local governments, public schools, community colleges, and public universities.

The DOJ rule has compliance deadlines of April 24, 2026 (for entities serving populations of 50,000 or more) and April 26, 2027 (for smaller entities).

Together, these two rules represent a coordinated federal effort to establish WCAG 2.1 AA as the recognized digital accessibility standard across public and publicly funded services. For organizations that fall under both rules, the earliest applicable deadline governs.

It is worth noting that the DOJ indicated in September 2025 that it planned to issue a Notice of Proposed Rulemaking to reconsider whether certain provisions of its Title II rule could be made less costly.

However, no such notice has been issued to date, and HHS has made no corresponding statement about revising its own rule. Organizations should not delay compliance in anticipation of potential regulatory changes that have not materialized.

Steps You Should Take Now

With the first major compliance deadline less than a month away, the time for planning has passed. Organizations that have not yet started need to prioritize immediate action. Those already in progress should validate their efforts against the specific requirements of the rule.

1. Conduct a comprehensive accessibility audit. Review all websites, patient portals, mobile apps, and kiosk interfaces for conformance with WCAG 2.1 Level A and AA. Automated scanning tools can identify many common issues, but a full assessment requires manual testing by qualified reviewers and, where possible, testing with users who rely on assistive technologies.
2. Remediate identified barriers. Work with your IT team and development vendors to address deficiencies. Prioritize issues that have the greatest impact on patient access, such as inaccessible appointment scheduling, patient portal login flows, and telehealth platforms.
3. Review and update vendor contracts. Require WCAG 2.1 AA conformance in all digital deliverables provided or operated by third-party vendors. Request accessibility conformance documentation as part of your procurement and renewal processes.
4. Designate a responsible employee and adopt grievance procedures. The rule requires covered entities to have a designated employee for Section 504 compliance and established procedures for handling disability-related grievances.
5. Train your staff. Ensure that content creators, developers, designers, and program administrators understand WCAG standards and how to maintain accessible digital content as part of their everyday workflows.
6. Monitor and test regularly. Accessibility is not a one-time project. Every new piece of content, every platform update, and every vendor change must be evaluated for conformance. Build accessibility testing into your quality assurance and content publishing workflows.
7. Document your compliance posture. Maintain records of your audits, remediation efforts, vendor conformance documentation, and staff training. If your organization ever needs to demonstrate good-faith compliance or claim undue burden, documentation is essential.

Tools for Assessing Your Compliance

A strong compliance program combines automated scanning with manual expert review. Automated tools are valuable for identifying many common WCAG violations quickly and at scale, but manual testing is essential for identifying the remaining issues.

Here are some approaches and tools to consider:

• Automated scanning: Tools like AccessibilityChecker.org can scan your website for common WCAG 2.1 A and AA violations and provide actionable remediation guidance for each issue found.
• Manual testing: Keyboard-only navigation testing, screen reader testing with tools like NVDA, JAWS, or VoiceOver, and zoom/reflow testing at 200% browser magnification and 320px viewport width.
• User testing: Testing with real users who rely on assistive technologies provides the most reliable validation of your digital accessibility.
• Accessibility statements: AccessibilityChecker.org’s free Accessibility Statement Generator can help you publish a public accessibility statement, an important signal of accountability and a resource for users who need to report barriers.