Document accessibility for healthcare providers

If your organization receives funding from the Department of Health and Human Services (HHS), the updated Section 504 rule requires your website, apps and the documents you post to meet WCAG 2.1 Level AA. Patient forms and notices are near the top of the list. We plan to offer a version of Includoc that can safely handle documents with patient information. Until it's ready, we don't process protected health information (PHI), and we'd rather tell you that plainly now than have you find out later.

This page is for organizations that receive HHS funding, such as hospitals and health systems, community health centers, clinics, behavioral health providers and Medicaid providers. It's written for the people who usually own the work: practice managers, compliance and privacy officers, marketing and web teams, and patient experience staff.

Your deadline

Under the HHS Section 504 rule, your web content, mobile apps and posted documents must meet WCAG 2.1 Level AA by:

• May 2027 if your organization has 15 or more employees
• May 2028 if it has fewer than 15 employees

HHS moved both dates back a year in May 2026. A few other points:

• Public hospitals and health departments are also public entities under ADA Title II, which has its own dates in April 2027 and April 2028. Both rules can apply to you.
• Kiosks, such as self-service check-in and payment stations, are covered by a separate section that has no delayed compliance date.
• Vendor platforms count. Patient portals, scheduling and bill-pay tools you offer through a vendor are part of your obligation.

Our Section 504 guide explains the rule, its five exceptions and a plan, and the deadline finder confirms your date.

What we can help with today

Many of the documents the rule covers contain no patient information at all. You can check these with Includoc now:

• Blank intake, registration and consent forms
• Notices of privacy practices, patient rights statements and nondiscrimination notices
• Financial assistance policies and blank applications
• Patient education handouts, service brochures and directions
• Annual reports, community health needs assessments and board documents

Healthcare organizations confirm a short no-PHI notice before uploading. If a document has a patient's details in it, such as a completed form, a visit summary, a lab result or a bill, don't upload it.

For these public documents, Includoc works the same way it does for everyone: a free check in plain English, AI fixes with a review screen, an optional human-verified tier for important forms, and a conformance report for your records. Fixing and human verification open in early 2027.

Where to start

With a deadline in 2027 or 2028, the order matters more than the speed. A practical sequence for public, non-PHI documents:

1. Forms patients use to get care. New-patient packets, registration, consent and financial assistance applications. The exception for older documents never covers forms that are still in use, whenever they were posted.
2. Notices you're required to post. Privacy practices, patient rights and nondiscrimination notices are often long, text-heavy PDFs that are quick to fix.
3. Instructions and patient education. Preparation instructions, directions and handouts help people arrive ready for their visit.
4. Everything else. Annual reports, community health needs assessments, board documents and older materials, some of which may qualify for an exception.

Two habits make the backlog shrink faster. Fix your Word templates, so every new form starts out accessible. And ask the vendors behind your patient portal, scheduling and telehealth tools for an Accessibility Conformance Report, then write WCAG 2.1 AA into their contracts.

What a PHI-ready Includoc will take

Handling PHI responsibly is more than a checkbox. Before we accept a single document with patient information, we need:

1. A BAA with every provider that would touch PHI. That includes storage, processing, database, hosting and AI providers. Our current AI routing service may not offer a BAA, so the PHI path may use a direct, BAA-covered AI provider instead.
2. A processing path built for it. That may mean a separate, BAA-covered path for healthcare documents, with its own controls.
3. Then, a BAA with you. Only when the whole chain is in place will we sign BAAs with customers.

We won't announce a date until it's ready. Waitlist members will hear first, with details on how it works and what it costs.

Why we're waiting

We'd rather wait than take a shortcut with patient data. Our current safeguards are strong for public documents: storage in the United States, encryption, short retention, isolated processing and no AI training on your files. You can read about them on our trust page. But PHI carries legal duties under HIPAA that need contracts with every provider in the chain, and those take time to put in place properly.

Plans and paperwork

The same plans apply to public, non-PHI documents:

• Pay as you go: $1.50/page, with your first 10 pages free
• Pro: $99/mo for a communications or compliance team, with 20% off for nonprofits
• Organization plans: from $3,600/yr for a full website inventory, monitoring and progress reports

Quotes, W-9, certificate of insurance, security overview and our data processing addendum are available on request. Invoices can carry your purchase order number with net-30 terms. Request documents or a quote.

Join the waitlist

Use the form on this page to join the healthcare waitlist. We'll use your email to tell you about the healthcare option. Other updates are opt-in.

In the meantime:

• Read the Section 504 guide.
• Check a public document free. Please make sure it contains no patient information.
• Book a 20-minute walkthrough to talk through your documents.