Section 504 Website Accessibility Rules for Medical Practices

A patient who uses a screen reader opens your website to book a visit. The booking button has no text label, the date picker only responds to a mouse, and the intake form announces every field as "edit text." She gives up and calls, if calling works for her. For a practice that takes Medicaid or Medicare, that dead end now has a federal standard and a date attached.

HHS's Section 504 final rule, published May 9, 2024, requires recipients of HHS financial assistance to make their web content and mobile apps conform to WCAG 2.1 Level AA. In May 2026, HHS pushed both deadlines back a year: May 11, 2027 for recipients with 15 or more employees, and May 10, 2028 for those with fewer than 15. As of October 3, 2026, those are the dates in the eCFR.

Below: who counts as a recipient (including a Medicare Part B change many summaries miss), what counts as your web content, where the exceptions stop, and what to test.

What the Section 504 rule requires of your website

The rule requires a recipient's web content and mobile apps to meet the Level A and Level AA success criteria of WCAG 2.1, the version W3C published in June 2018. That covers content you publish yourself and content a vendor provides for you under a contract or license.

The requirements sit in subpart I of 45 CFR part 84, sections 84.82 through 84.89. Section 84.84 covers web content and mobile apps a recipient provides or makes available, "directly or through contractual, licensing, or other arrangements." The rule took effect July 8, 2024; only the conformance deadlines came later.

WCAG 2.1 has 78 success criteria. Level A and Level AA account for 50 of them; the other 28 are Level AAA, which the rule does not require. A handful decide whether a patient can book or register:

• Keyboard (Level A): everything works without a mouse, including date pickers.
• Labels or Instructions (Level A): every form field says what it wants.
• Timing Adjustable (Level A): a booking flow that holds a slot on a timer must let most users turn off, adjust or extend the limit.
• Contrast (Minimum) (Level AA): text needs a contrast ratio of at least 4.5:1, or 3:1 for large text.
• Resize text (Level AA): text can be enlarged to 200 percent without losing content.
• Captions (Prerecorded) (Level A): your videos carry captions.

Three provisions soften the standard, and none is a loophole. Section 84.88 excuses fundamental alterations and undue burdens, but only by a written statement from the head of the recipient or a designee. Section 84.89 forgives a nonconformance only if it would not affect a disabled user's ability to get the same information and complete the same transactions. Section 84.87 accepts equally accessible alternatives; HHS's fact sheet gives WCAG 2.2 AA as an example.

Is your practice a recipient of HHS financial assistance?

If your practice receives money from an HHS program, directly or through another recipient such as a state Medicaid agency or a Medicaid managed care plan, it is likely a recipient. Since May 2024, HHS has also treated Medicare Part B payments as federal financial assistance, reversing its longstanding position.

Under 45 CFR 84.10, a recipient is any public or private entity or person "to which Federal financial assistance is extended directly or through another recipient," excluding "the ultimate beneficiary," which is the patient.

Medicaid is the clearest case. The 2024 rule's preamble says state Medicaid programs and the managed care plans they pay are covered, and cites a 1984 Fifth Circuit decision holding that "Medicare and Medicaid are federal financial assistance for the purpose of Section 504." A practice paid by Medicaid sits downstream of both.

Medicare Part B is the change most summaries miss. For years HHS said Part B payments alone did not make a provider a recipient. In its Section 1557 final rule of May 6, 2024, HHS gave formal notice that Part B funding is federal financial assistance for Section 504 and four other civil rights laws, and gave providers whose only federal funding was Part B until May 6, 2025 to comply. We found no Federal Register notice withdrawing that interpretation through October 3, 2026. A court vacated parts of the 1557 rule in 2025, but HHS's notice of that order says it reached only the gender-identity provisions.

The 15-employee line decides your date, not whether you are covered. A practice with 8 employees that bills Medicaid is a recipient with until May 10, 2028. HHS counts employees, not clinicians: it declined commenters' request to use a Medicare payment law's definition of practices with "fifteen or fewer professionals." Count front desk, billing and clinical staff alike.

Whether your practice is a recipient turns on how it is paid, so treat this section as general information rather than legal advice, and confirm your status and your date with counsel.

The deadlines moved: where they stand on October 3, 2026

HHS's interim final rule, effective May 7, 2026, moved both deadlines back one year. Recipients with 15 or more employees must conform by May 11, 2027, and those with fewer than 15 by May 10, 2028. HHS says it may propose further changes, and duties under the rest of Section 504 continue.

The standard did not change in May 2026. Only the dates moved, by one year each.

The original rule set May 11, 2026 and May 10, 2027. Four days before the first date, HHS announced the extension; it was published at 91 FR 25496 and took comments until July 6, 2026. HHS cited concerns that community health centers, hospitals and primary care centers would miss the first date, and alignment with the Department of Justice, which delayed its own web rule for state and local governments on April 20, 2026.

That leaves a larger practice about 7 months and a smaller one about 19. Three details matter:

• The delay is not a pause. The interim rule says the delay "does not relieve recipients of their other obligations under Section 504," including reasonable modifications.
• More change is possible. HHS's August 2026 regulatory agenda contemplates a proposed rule to reconsider whether some provisions "could be made less burdensome." Absent that, the interim rule says HHS "fully anticipates implementing the regulation at the new deadline."
• The exceptions moved with the dates. Several exceptions turn on the date a recipient must comply, so a PDF or social post published before your new date can count as preexisting.

What counts as your web content: booking, forms, portal and kiosks

Everything a patient uses online to reach your care counts: the public website, the online scheduling page, intake and payment forms, a patient app, telehealth, and the portal's own pages. Content a vendor runs for you under contract is still yours. A check-in kiosk falls under a separate rule with no technical standard.

HHS wrote the contract language in on purpose, after commenters warned that many recipients rely on vendors to build their sites; its stated intent was to cover websites a third party operates for a recipient. If your scheduling page is a widget from your practice management vendor, it is your web content.

If a patient uses it online to reach your care, assume it counts, even when a vendor runs it.

The portal is a split case. The exception for individualized, password-protected documents covers files such as a visit summary PDF or a bill, but the preamble says the platform that delivers them must itself conform, down to link text that tells the user which document each link opens. If a blind patient needs a document from her account, you may still owe her an accessible version; HHS's example is a practice that uploads X-ray PDFs and may need a staffer with the right expertise to provide an accessible version.

Mobile apps get no carve-out. Commenters listed telehealth, appointment booking, bill payment and test results among what patients do in them, and HHS's fact sheet cites a telehealth platform that cannot add a sign language interpreter to a video call as something Section 504 reaches.

Kiosks follow section 84.83, which bars excluding people with disabilities from anything offered through a kiosk but sets no technical standard and no later date of its own. HHS's fact sheet says procedures can satisfy it, such as letting a patient who cannot use the kiosk check in at the main desk. Write that procedure down for every front desk shift.

The five exceptions, and where each one stops

Five kinds of content do not have to meet WCAG 2.1 AA: archived web content, preexisting conventional documents, third-party posts, individualized password-protected documents, and preexisting social media posts. Each is narrower than its name. A patient who asks for excepted content in an accessible format may still be owed one.

Archived web content must meet 4 conditions in 84.10: created before your compliance date, kept only for reference, research or recordkeeping, not altered after archiving, and stored in an area clearly labeled as archived. Old newsletters can qualify. A page you still update cannot.

Preexisting conventional electronic documents are PDFs, word processor files, presentations and spreadsheets posted before your compliance date, unless they are "currently used to apply for, gain access to, or participate in" your programs. A new-patient packet, a financial policy patients sign or a records request form is still in use, so it must conform or give way to an accessible web form.

Third-party content is excepted only when the third party is not posting under an arrangement with you. A patient's review qualifies. Your booking vendor's widget does not, and HHS's fact sheet says the exception does not cover a linked third-party payment processor.

Individualized, password-protected documents are conventional documents about one person, such as medical records or receipts, behind a login. The pages around them stay covered.

Preexisting social media posts are those published before your compliance date. Later posts must be accessible, starting with alt text on images and captions on videos, though the platform itself is not your responsibility.

For excepted items, HHS's fact sheet says a specific request from a person with a disability can still trigger your existing duties, including reasonable modifications under 84.68(b)(7) and effective communication under 84.77. Publish an accessibility contact so those requests reach someone.

How Section 504 sits next to ADA Title II and Title III

Section 504 reaches practices that receive HHS assistance. ADA Title II's web rule reaches state and local government entities, such as a county clinic, on its own dates. Private practices are public accommodations under Title III, which has no web regulation, yet DOJ says the ADA applies to websites and patients can sue.

A county-run clinic can fall under both of the first two rows. Most independent practices land in the third row as well as the first. DOJ's 2022 web guidance lists medical offices among businesses open to the public, says the ADA covers what they offer on the web, and notes DOJ "does not have a regulation setting out detailed standards." A private practice outside Section 504 still has the duty, just no date, and private lawsuits over inaccessible websites remain a risk under Title III. WCAG 2.1 AA is one testable target for both laws.

How to test and fix the pages patients use

Start with the path a patient takes to become one: find a location, book, complete intake and pay. Test those pages with a keyboard and a screen reader, run an automated checker, clear the common failures early, and write WCAG 2.1 AA into every web and booking vendor contract.

WebAIM's 2026 Million report tested the home pages of the top 1,000,000 websites in February 2026 and found detectable WCAG failures on 95.9% of them, averaging 56.1 errors per page. Six error types made up 96% of the total, led by low-contrast text on 83.9% of pages, missing image alt text on 53.1% and missing form labels on just over half. These are general websites, not practices, and automated tools catch only part of WCAG, so treat the numbers as a map of where to look.

WebAIM figures describe general websites, not practices. Read them as a map of where to test.

A practical order of work:

1. List the tasks. Finding a location, booking, intake, paying a bill, the portal login. A flow fails at its worst page.
2. Use only a keyboard. Tab through each flow. Focus should stay visible (Level AA) and every control, including the date picker, should be reachable.
3. Use a screen reader. VoiceOver ships with Macs and iPhones, and NVDA is free for Windows. Listen for unlabeled buttons and fields.
4. Run an automated checker, then check by hand. A checker cannot judge whether alt text or an error message makes sense.
5. Replace the documents still in use. Turn required PDF forms into accessible web forms or tagged PDFs.
6. Publish an accessibility contact, as DOJ's guidance recommends.

Field note

Before your compliance date

• Someone has booked a visit on your site using only a keyboard.
• A screen reader user has completed your intake form from start to finish.
• Every web, booking and portal contract names WCAG 2.1 Level AA.
• Your site lists a contact for accessibility problems, and someone reads it.

Where the phone fits, and what to do this quarter

A phone line does not replace an accessible website: HHS said even a line staffed 24 hours a day cannot realistically provide equal opportunity in its place. The phone still matters as a second path, with duties of its own. Settle your status, date and owner this quarter, then test the booking flow.

HHS's reasoning is practical: a website lets people get information or request a service within minutes, often independently, while a phone line adds steps and waits and may not work at all for someone who is deafblind. That was written about staffed lines, and it would apply just as well to an answering service or an AI receptionist. The phone is a path for patients who prefer it, not a substitute for an accessible booking page.

The phone has its own rules in the same part. Section 84.77 requires communication with patients and companions who have disabilities to be as effective as with everyone else. Section 84.78 says an automated-attendant system, including voice mail and interactive voice response, must work in real time with TTY and relay users, and relay calls must be answered like any other call. How an AI receptionist should handle relay calls and older callers covers that side. For patients with limited English, see what Section 1557 language access asks of a practice.

This quarter, make 4 decisions: whether you are a recipient and which date applies, who owns web accessibility, which pages, forms, apps and documents patients use (vendor-run ones included), and when the booking flow gets its keyboard and screen reader test.

Find your rule and your date first. Then test the flows patients use to book, register and pay.

Any HHS funding, Medicaid or Medicare Part B included, puts you under Section 504 and its date; everyone else still has Title III. For where an automated line should stop and hand a call to staff, see what an AI receptionist does and where it hands off, and our FAQ covers how patient data is handled, what setup involves and who it is not a fit for.