Section 504 Took Effect May 11. HHS Was Right Not to Extend It.
One week ago, on May 11, 2026, the HHS Section 504 web accessibility rule took effect for most healthcare entities receiving federal funding. Three weeks before that, the Department of Justice quietly extended its parallel Title II deadline by a year. HHS did not follow suit. In our view, that was the correct call — and the contrast tells you everything about which agency is treating accessibility as a civil right and which is treating it as a policy timeline to manage.
Our editorial position
Healthcare access is not a matter of administrative convenience. Patients with disabilities have been locked out of patient portals, telehealth visits, appointment scheduling, and insurance enrollment for the entire two decades that those systems have existed. Extending the Section 504 deadline would have prolonged that exclusion for one more year — long enough, given U.S. patient demographics, that tens of thousands of people would have died before getting access to their own medical records.
HHS did not extend the rule. They were right not to. And if your hospital, health system, or Medicaid agency missed the deadline, you do not get to argue the rule was unreasonable — you get to file an OCR resolution plan and start the work you should have started in 2024.
The two-rule landscape, in one paragraph
There are two federal web accessibility rules currently in force in the United States. The DOJ Title II rule covers state and local government services; its deadlines were pushed to April 2027 and April 2028 by an Interim Final Rule on April 20, 2026. The HHS Section 504 rule covers entities receiving HHS funding; its compliance date was May 11, 2026, and HHS did not extend it. Both rules require WCAG 2.1 Level AA. Entities subject to both — most notably public hospitals and state university medical centers — must meet the earlier of the two, which is now Section 504.
Who is covered
The Section 504 rule is broader than most healthcare leaders realize. The trigger is receipt of federal financial assistance from HHS — not a particular corporate form, not a particular size, not a particular line of business. In practice:
| Entity type | Covered? | Why |
|---|---|---|
| Hospital billing Medicare/Medicaid | Yes | Medicare/Medicaid reimbursement is federal financial assistance |
| State Medicaid agency | Yes | Direct HHS funding recipient |
| FQHC / community health center | Yes | HRSA grants are HHS financial assistance |
| Public university medical center | Yes (Title II + 504) | Covered under both rules; earlier deadline controls |
| Nursing home receiving Medicaid | Yes | Medicaid reimbursement triggers coverage |
| Private cash-pay specialty clinic | Likely no | Only if it receives HHS grants or federal funding |
| Health insurance issuer on a federal exchange | Yes | ACA marketplace participation involves federal assistance |
| Pharma manufacturer (no HHS grants) | Generally no | Section 504 doesn't reach unfunded private entities |
What the rule actually requires
- WCAG 2.1 Level AA conformance on all web content and mobile applications made available to the public, to program beneficiaries, or to employees.
- Accessible self-service kiosks — registration kiosks, payment kiosks, lobby check-in tablets, telehealth kiosks.
- Accessible electronic documents — after-visit summaries, consent forms, billing statements, lab results, and clinical patient education materials distributed electronically.
- Accessible third-party tools used by the covered entity. Using an inaccessible vendor product does not shift liability away from the funded recipient — you are responsible for what you procure.
- An accessibility statement and a complaint process that allows patients to report barriers and receive timely response.
Why we're calling HHS holding firm the right move
Three reasons, in plain language:
- The harm is concrete and immediate. When a patient portal is inaccessible, a blind patient cannot view their own lab results without asking a sighted person to read them aloud. When telehealth is inaccessible, deaf patients cannot use it at all. When online appointment scheduling is inaccessible, motor-impaired patients call a phone line that is understaffed and routes to voicemail. These are not abstract failures of compliance. They are daily exclusions from healthcare.
- The rule was published in May 2024. Covered entities had a full two years of notice. Major healthcare vendor platforms — Epic, Cerner, the patient portal layers, the telehealth providers — published WCAG 2.1 AA roadmaps in 2024 and 2025. Any health system that did not start the work in that window made a choice. The deadline was not a surprise.
- Federal funding is the right enforcement tool for this category of entity. Section 504 enforcement is slower and more deliberate than Title III litigation — exactly because it can reach the funding stream. Extending the deadline would have signaled that HHS is not willing to use that tool. Holding firm signals the opposite.
If you missed the deadline: a six-step recovery plan
- Stop guessing about conformance. Run a real WCAG 2.1 AA audit on your patient portal, scheduling platform, telehealth, online bill-pay, and insurance enrollment. Use our step-by-step audit guide or paste findings into the AI Audit Helper to map them to specific success criteria.
- Triage by patient impact. Fix critical and high-severity issues on patient-facing systems first. Administrative back-end tools can wait.
- Document the corrective action plan. Put every open finding into a tracked backlog with owner, severity, deadline, and status. This is what OCR will ask for if a complaint is filed.
- Publish an honest accessibility statement. Document current conformance level, known gaps, and target resolution dates. Provide a clearly-labeled contact for accessibility complaints. Use our statement generator.
- Press your vendors. If your patient portal vendor cannot provide a current ACR / VPAT or a credible WCAG 2.1 AA conformance roadmap, escalate to your contract manager. Vendor non-conformance does not insulate you from Section 504 liability.
- Train the team that ships the website. Section 504 violations are usually shipped, not designed. Developers and content authors need to understand the basics of semantic HTML, ARIA, keyboard interaction, and accessible document authoring.
Where we stand
The contrast between the DOJ Title II extension and HHS holding the Section 504 line is the most consequential accessibility policy moment of 2026. One agency decided that institutional pushback was sufficient reason to defer civil rights enforcement by a year. The other agency decided that patients with disabilities cannot wait another year for access to their own healthcare. We are unambiguously on HHS's side of that contrast, and we will say so in every audit we publish, every report we deliver, and every statement we draft.
If you are running a covered healthcare entity and you did the work on time: thank you. Your patients noticed, even if the policy headlines did not.
If you did not: file the OCR resolution paperwork honestly, start the audit this week, and treat the next ninety days as the most important accessibility sprint your organization will run this decade.
Start your Section 504 recovery audit
The deadline already passed. The standard is WCAG 2.1 AA. Run the audit and document the plan.
Frequently asked questions
What is the HHS Section 504 web accessibility rule?
It's a final rule published by the U.S. Department of Health and Human Services under Section 504 of the Rehabilitation Act of 1973. The rule requires recipients of HHS federal financial assistance to make their web content, mobile applications, and kiosks conform to WCAG 2.1 Level AA. It is the first federal rule to set a specific technical standard for web accessibility on healthcare-adjacent entities, and it carries the full force of Section 504 — meaning loss of federal funding is on the table for non-compliance.
When did the Section 504 web rule take effect?
The compliance date for most covered entities was May 11, 2026. Smaller entities and certain narrow categories have phased timelines that extend further out, but the May 11, 2026 date applies to the majority of recipients — including most hospitals, state Medicaid agencies, large clinics, and HHS grantees. Unlike the DOJ's parallel Title II rule for state and local governments, the Section 504 deadline was not extended by HHS.
Who is actually covered by the rule?
Any entity that receives federal financial assistance from HHS is covered. That includes: state Medicaid agencies and their contracted plans, hospitals participating in Medicare and Medicaid (which is effectively every hospital), community health centers (FQHCs), state and local public health departments funded by CDC or HRSA, university hospitals and academic medical centers, federally funded research institutions, social services agencies receiving HHS grants, and most nursing homes and home-health providers. The trigger is HHS funding, not entity type — a private hospital that bills Medicare is covered the same as a public one.
Was the Section 504 deadline extended like the DOJ Title II deadline?
No. The DOJ extended its Title II web rule by one year on April 20, 2026 — pushing those deadlines to April 2027 and 2028. HHS did not follow suit. The Section 504 web accessibility deadline of May 11, 2026 stood. In our editorial view, HHS made the right call. Healthcare access is not a matter of administrative convenience — patients with disabilities have been excluded from telehealth, patient portals, appointment scheduling, and insurance enrollment for years. Extending the deadline would have prolonged real harm.
What technical standard does Section 504 require?
WCAG 2.1 Level AA, the same standard as the DOJ Title II rule. Conformance is required for web content, mobile applications, and self-service kiosks made available to the public, to beneficiaries of HHS-funded programs, or to employees of covered entities. The rule does not yet require WCAG 2.2, but the gap between the regulatory floor (2.1) and the industry standard (2.2) is widening — auditing against 2.2 is the prudent move.
What if my organization missed the May 11, 2026 deadline?
First, do not panic and do not stop. Section 504 enforcement typically begins with an HHS Office for Civil Rights complaint, an OCR-led investigation, and an opportunity for voluntary resolution before any funding action. The standard remedy is a corrective action plan with milestones — not immediate defunding. What OCR looks for is good-faith effort, documented progress, and a credible remediation roadmap. Run a complete audit immediately, prioritize the highest-impact patient-facing properties (patient portal, appointment scheduling, telehealth, eligibility and enrollment), publish an honest accessibility statement, and assign owners with deadlines for every open finding.
What are the penalties for non-compliance?
Section 504 is enforced through HHS funding — the ultimate sanction is suspension or termination of federal financial assistance, which for most hospitals and Medicaid agencies would be existential. In practice, OCR pursues voluntary compliance through resolution agreements with documented corrective action plans before invoking funding penalties. Private plaintiffs can also bring Section 504 actions in federal court seeking injunctive relief and damages. Parallel ADA Title III lawsuits — which are filed at a rate exceeding 3,000 per year in federal court alone — can also reach the same web properties under separate authority.
How is Section 504 different from ADA Title II and Title III?
Section 504 covers entities receiving federal financial assistance — primarily healthcare. ADA Title II covers state and local government services regardless of funding source. ADA Title III covers private businesses considered places of public accommodation. A given organization can be covered by more than one: a public hospital is typically covered by both Title II (because it's a state entity) and Section 504 (because it bills Medicare). When that happens, the strictest and earliest deadline controls — which, after the April 2026 Title II extension, is Section 504.
What should healthcare organizations do this month?
Six concrete actions: (1) Audit your patient portal, telehealth platform, appointment scheduling, and online bill-pay against WCAG 2.1 AA — these are the most-complained-about properties. (2) Verify that PDF clinical documents (after-visit summaries, consent forms, lab results) are tagged and screen-reader accessible. (3) Confirm mobile apps for patient access conform to WCAG 2.1 AA on iOS and Android. (4) Publish an updated accessibility statement that honestly describes your conformance status and remediation roadmap. (5) Document training for clinical and IT staff on accessibility obligations. (6) Establish a process to receive and respond to accessibility complaints from patients — OCR specifically looks for this.