Web accessibility deadlines for hospitals and clinics

Under the rule the Department of Health and Human Services (HHS) issued for Section 504 of the Rehabilitation Act, a hospital, clinic or practice that receives HHS funds, including Medicare or Medicaid payments, must make its websites and mobile apps meet Level AA of the Web Content Accessibility Guidelines (WCAG) 2.1. The date is May 11, 2027 for an organization with 15 or more employees and May 10, 2028 for one with fewer (45 CFR 84.84).

Hospitals and clinics run by a state or local government also fall under the Justice Department's rule for the Americans with Disabilities Act (ADA), with dates of April 26, 2027 or April 26, 2028, depending on the government's population and type (28 CFR 35.200). Both departments moved their dates one year later in April and May 2026, and the National Federation of the Blind, a national organization of blind people, has sued to undo that delay. This is not legal advice, so check with counsel how each rule applies to your organization.

Which rule covers your hospital or clinic?

The HHS rule covers every organization, public or private, that receives federal financial assistance from HHS (45 CFR 84.10). Medicare and Medicaid payments count: the department's 2024 Section 504 rule cites a federal appeals court ruling that "Medicare and Medicaid are federal financial assistance for the purpose of Section 504" (final rule, May 9, 2024). In another rule that month, HHS said Medicare Part B payments count as well (final rule, May 6, 2024), so in its view a physician practice that bills Part B is covered too.

Which HHS date applies depends on the number of employees. The department turned down a request to use the 2015 Medicare payment law's definition of a small practice, 15 or fewer professionals, and kept the employee count.

The Justice Department's rule under Title II of the ADA covers state and local governments, including their departments and agencies (28 CFR 35.104), and its 2024 text discusses public hospitals by name (final rule, April 24, 2024). A government with a total population of 50,000 or more has until April 26, 2027. A smaller government has until April 26, 2028, as does a special district government. The rule defines a special district government as a public entity, other than a county, municipality, township or independent school district, that state law authorizes to provide one function or a limited number of them. It must also have enough administrative and fiscal independence to count as a separate government, and no population count of its own from the Census Bureau. A hospital run as an agency of a county or city uses that government's census population.

A public hospital that also receives HHS funds has to meet both rules, HHS said in 2024, so it has to be ready by the earlier of its two dates.

What does WCAG 2.1 Level AA require?

The World Wide Web Consortium (W3C) published WCAG 2.1 on June 5, 2018 (WCAG 2.1). Its success criteria come in three levels, A, AA and AAA, and a page meets Level AA when it satisfies every Level A and Level AA criterion. Five of those criteria, in brief:

• Images and other non-text content have a text alternative that serves the same purpose (1.1.1).
• Prerecorded video with sound has captions (1.2.2).
• Text has a contrast ratio of at least 4.5:1 with its background, or 3:1 for large text (1.4.3).
• Every function works from a keyboard, except one that depends on the path of a movement rather than its end points (2.1.1).
• Forms give labels or instructions (3.3.2).

Each rule covers web content and apps that an organization provides "directly or through contractual, licensing, or other arrangements." HHS chose that wording so that no recipient could hand its obligations to a vendor. In 2024 the department gave scheduling tools and payment systems built by an outside technology company as examples: a hospital that puts one on its website has to choose one that meets the standard.

What does the HHS rule exempt?

The HHS rule lists five exceptions (45 CFR 84.85), and the Justice Department's rule has the same five (28 CFR 35.201):

• Archived web content: made before the compliance date (or a copy of paper or other physical records from before it), kept only for reference, research or record keeping, not changed since, and stored in an area marked as archived.
• PDFs, word processing files, slides and spreadsheets posted before the compliance date, unless people use them now to apply for, get or take part in your services.
• Content that others post, unless they post it under a contract or other arrangement with you.
• PDFs and other documents about one person, their property or their account that sit behind a password or other security, such as PDF medical records in a hospital's patient portal.
• Social media posts made before the compliance date.

The exception for patient documents has limits. A patient who needs one of these documents in an accessible format must still get it in time, HHS said in 2024, and the portal that delivers these documents must itself be accessible.

An organization may also stop short of a change that would alter the basic nature of a program or impose undue financial and administrative burdens. Only the organization's head, or someone the head designates, may make that decision, after considering all the resources available, and must put the reasons in writing. The organization must still do whatever it can short of that change so that people with disabilities get its benefits and services to the maximum extent possible (45 CFR 84.88). HHS wrote in 2026 that it meant these defenses to apply only to "rare situations."

Why did the dates move, and could they change again?

Both departments said that many of the organizations they cover would struggle to meet the original dates. HHS said those dates were unlikely to be met by "a significant number of recipients, especially local governments and other small and medium size recipients." It cited comments that some federally qualified health centers were struggling with accessible documents and with websites that work from a keyboard alone. Because people can sue to enforce Section 504, it also worried that widespread noncompliance "would lead to a significant increase in litigation." The Justice Department added that staffing remains a challenge and that generative AI "does not yet reliably automate the remediation of inaccessible content at scale."

HHS moved its dates in an interim final rule that took effect May 7, 2026. It was published on May 11, 2026, the date the first deadline was set to arrive (interim final rule). The Justice Department had moved its own dates on April 20, 2026 (interim final rule).

Each department said it would consider proposing changes to what its rule requires during the extra year. If it does not, and nothing suggests a further delay, each wrote that it "fully anticipates implementing the regulation at the new deadline." The regulatory agendas both departments published on August 14, 2026 describe that possible proposal as a way to reconsider whether some of the 2024 provisions "could be made less burdensome," and neither gives a date for it (HHS agenda, Justice Department agenda).

The later dates have also been challenged in court. On May 21, 2026, the National Federation of the Blind sued both departments in federal court in Maryland, saying they extended the deadlines "with no advance notice or opportunity for public comment," and asked the court to "vacate, and/or set aside" both interim final rules (complaint). Those two rules are what pushed every date back a year; before them, the first dates were April 24 and May 11, 2026. Check the court's docket before you plan around the later dates.

The delay did not pause the rest of Section 504. Recipients still have "an ongoing obligation" to make the programs and activities they offer online accessible to people with disabilities, the department wrote, and the delay does not relieve them of the duty to make reasonable modifications.

What should a hospital or clinic do before the date?

In 2024, HHS said it expects recipients "will need to prepare for compliance during the two or three years before the compliance date." Six steps, in order:

1. List every website, app, patient portal and online form you provide, including the ones vendors run for you.
2. Mark what the five exceptions cover, and move retired pages into a labeled archive only if they meet all four archive conditions.
3. Test the rest against WCAG 2.1 Level AA. Automated scanners help, but the W3C's guide to evaluation tools says tools cannot check every part of accessibility automatically and that human judgment is required, so include people testing with a keyboard and a screen reader.
4. Fix first the pages and documents people use to apply for, get or take part in your services, because older documents in that use are not exempt.
5. Write WCAG 2.1 Level AA into the contracts and renewals for sites, apps and portals that vendors run for you.
6. Keep a dated record of what you tested and fixed, so that you can show any remaining gap is minor. The rule treats an organization that falls short as compliant only when it can show the gap is so small that people with disabilities can still get the same information and do the same tasks as everyone else, with substantially the same timeliness, privacy, independence and ease of use (45 CFR 84.89).

Kent Applied's research on where AI tools fit in healthcare, by kind of organization lists website accessibility as a compliance problem for health systems and community hospitals, and as one of the healthcare problems that need no patient data.

For a hospital that wants this testing every week, the Price Transparency and Accessibility Monitor tests pages and PDFs against WCAG 2.1 AA, ranks each failure by how many visitors see that page and drafts a fix, alongside its checks of the hospital's price file. It costs from $9,500 to build, plus $450 a month, and a hospital can start with a one-time audit of its price file and top web pages for $3,500. Its automated checks can't find every failure, so the testing by people in step 3 still applies.

For a practice or clinic, the Website, Reviews and Social Desk checks the site each week and lists the accessibility failures that automated checks can catch, alongside its checks of hours and listings and the review replies it drafts. It costs from $4,500 to build, plus $250 a month, or a practice can start with a one-time check of its website, listings and past review replies for $1,500. A statement that the site meets WCAG 2.1 AA still needs the testing by people in step 3. When we build a site or app, we can build it to WCAG 2.1 AA on request; we don't certify conformance.