HHS Section 504 web accessibility rule: what healthcare providers need to know

Section 504 of the Rehabilitation Act of 1973 bars discrimination on the basis of disability in programs that receive federal funding. In May 2024, the Department of Health and Human Services (HHS) updated its Section 504 rule with specific requirements for web content, mobile apps and kiosks. Organizations that receive HHS funding, including many hospitals, health centers and clinics, must make their websites, apps and the documents they post meet WCAG 2.1 Level AA. The date is May 2027 if you have 15 or more employees, or May 2028 if you have fewer than 15.

The short version

• Who: organizations that receive federal financial assistance from HHS, such as many hospitals, health systems, health centers, clinics and Medicaid providers.
• What: web content and mobile apps must meet WCAG 2.1 Level AA. Web content includes PDFs, Word files, presentations and spreadsheets. A separate section covers kiosks.
• When: May 2027 with 15 or more employees. May 2028 with fewer than 15.
• Exceptions: five, matching the ADA Title II rule for state and local governments.

Who the rule covers

The rule applies to "recipients": organizations that receive federal financial assistance from HHS, either directly or through another recipient, such as a state Medicaid agency. It covers web content and mobile apps you provide directly or through contractual, licensing or other arrangements. Patient portals, online scheduling, bill pay and telehealth platforms supplied by vendors are part of your obligation when you offer them to patients.

Covered by both rules? A public hospital, a county health department or a state Medicaid agency is a public entity under ADA Title II and may also receive HHS funding. In that case, both rules can apply, each with its own date. The deadline finder handles this case, and our ADA Title II guide covers the other rule.

Deadlines

Your date depends on how many employees your organization has:

• 15 or more employees: May 2027
• Fewer than 15 employees: May 2028

HHS's 2024 rule originally set May 2026 and May 2027. An interim final rule from the HHS Office for Civil Rights, published in May 2026, moved both dates back a year, in step with the Department of Justice's extension of the Title II rule. Only the dates changed. HHS said it may propose changes to the rule's requirements during the extension. If it doesn't, it says it fully expects to implement the rule on the new dates.

What the rule covers

Web content and mobile apps

The standard is WCAG 2.1 Level AA, the same standard the ADA Title II rule uses. It applies to your public website, patient portal, online forms and mobile apps. As in the Title II rule, web content includes conventional electronic documents: PDF, word processing, presentation and spreadsheet files.

In plain terms, an accessible document has real structure (headings, lists and tables tagged so assistive technology can find them), a logical reading order, alt text for meaningful images, labeled form fields that work with a keyboard, enough color contrast, and a title and language set in the file. Our Title II guide explains each requirement.

Kiosks

A separate section covers kiosks, such as self-service check-in and payment stations. It says people with disabilities can't be excluded from services you provide through kiosks. It doesn't set a technical standard like WCAG, and unlike the web and app requirements, it has no delayed compliance date.

Exceptions

The HHS rule has the same five exceptions as the ADA Title II rule:

1. 1. Archived web content

   Content created before your compliance date, kept only for reference, research or recordkeeping, stored in an area clearly marked as an archive, and not changed since it was archived.

   Example:

   Board minutes from 2015 kept in an 'Archive' section and never edited.

   Watch out:

   Anything you update or move back into regular use loses the exception.

2. 2. Preexisting documents

   PDFs, word-processing files, presentations and spreadsheets posted before your compliance date, unless they are currently used to apply for, access or take part in your services, programs or activities.

   Example:

   A 2019 parks master plan PDF that no one needs to use to get a service.

   Watch out:

   Forms, applications and documents people currently need do not qualify, no matter when they were posted.

3. 3. Content posted by third parties

   Content posted by members of the public or other third parties who aren't acting for you, such as comments on a public forum.

   Example:

   A resident's comment on a city discussion page.

   Watch out:

   Content a vendor or contractor posts for you is still your responsibility.

4. 4. Individualized, secured documents

   Password-protected or otherwise secured documents about a specific person, property or account, such as a utility bill or a medical record.

   Example:

   One resident's water bill in an online account.

   Watch out:

   You still have to provide an accessible version promptly when someone with a disability needs it.

5. 5. Preexisting social media posts

   Social media posts you published before your compliance date.

   Example:

   A 2023 post announcing a road closure.

   Watch out:

   Posts made after the compliance date must be accessible.

For healthcare, two of them deserve a closer look:

• Preexisting documents lose the exception when people currently use them to apply for, access or take part in your programs. New-patient packets, consent forms, financial assistance applications and similar documents need to be accessible, whenever they were posted.
• Individualized, secured documents must be both about a specific person and password-protected or otherwise secured. A patient's own visit summary or bill inside a secured portal may qualify. When a patient with a disability needs an accessible version, you still have to provide one promptly.

Your existing duties don't change either. Section 504 already requires effective communication with people with disabilities, whatever the format.

How documents fit

Healthcare organizations post a lot of documents. Common examples:

• New-patient packets, intake forms and consent forms posted for download
• Notices of privacy practices, patient rights statements and nondiscrimination notices
• Financial assistance policies and applications
• Patient education handouts and service brochures
• Community health needs assessments, annual reports and board documents

Most of these are public documents. Blank forms, notices and brochures don't contain patient information. Completed forms, visit summaries, lab results and bills do, and they need different handling (see below).

Start with the documents people use to get care: forms, applications and instructions. The preexisting-documents exception never covers them while they're in use.

Patient information and Includoc

Includoc doesn't yet process documents that contain protected health information (PHI), and our terms don't allow uploading it.

Why. Handling PHI safely means signing a business associate agreement (BAA) with you, and having BAAs in place with every service provider that would touch the data, including the AI provider. We won't offer that until the whole chain is in place.

What you can do today. Check public documents that contain no patient information, such as blank forms, brochures, notices and the PDFs on your website. Healthcare organizations confirm a short no-PHI notice before uploading.

What's next. We plan to offer a PHI-ready option. Join the healthcare waitlist and we'll let you know when it's available. We won't announce a date until it's ready.

A plan for your organization

Sources

• Federal Register, May 11, 2026: HHS interim final rule extending the Section 504 web and mobile compliance dates (opens another website)
• American Hospital Association, May 7, 2026: HHS extends Section 504 web and app deadlines (opens another website)
• eCFR: 45 CFR part 84, subpart I, Web, Mobile, and Kiosk Accessibility (opens another website)
• W3C: Web Content Accessibility Guidelines (WCAG) 2.1, Recommendation of June 5, 2018 (opens another website)