The rule, in plain terms
In 2024 the U.S. Department of Health and Human Services set a technical standard for the websites and mobile apps of health care providers that receive federal funds. This page explains what it asks of a medical practice. It is a summary, not legal advice.
At a glance
Last reviewed November 11, 2026.
- The rule
- Section 504 of the Rehabilitation Act, as HHS amended its regulations on May 9, 2024. The web requirements are in 45 CFR 84.84 and 84.85.
- Who it reaches
- Every program or activity that receives federal financial assistance from HHS. For a medical practice that usually means Medicare and Medicaid.
- The standard
- The Web Content Accessibility Guidelines (WCAG) 2.1 at Level AA
- The dates
- May 11, 2027 for practices with 15 or more employees. May 10, 2028 for practices with fewer than 15.
- Who enforces it
- The HHS Office for Civil Rights
Who is covered
The rule follows the money. If a practice receives federal financial assistance from HHS, the rule applies to it.
Medicaid payments have long counted. In 2024 HHS also changed its position on Medicare Part B, the part that pays for physician services, and now treats those payments as federal financial assistance for the civil rights laws it enforces. That change brought many physician practices under these rules for the first time.
The rule does not exempt small practices. It gives a practice with fewer than 15 employees one more year. If your practice bills Medicare or Medicaid, the safe working assumption is that the rule reaches you. Your attorney can confirm that, and can tell you how part-time and contract staff count toward 15.
What has to meet the standard
The rule covers web content and mobile apps a practice provides or makes available, directly or through a vendor.
- The pages of your website
- Online forms: appointment requests, contact forms, registration
- PDFs and other documents posted on the site, with the exceptions below
- Video and audio
- Tools a vendor runs for you: the patient portal, online scheduling, bill pay, telehealth
- Mobile apps, if the practice offers one
The standard: WCAG 2.1 Level AA
WCAG is published by the World Wide Web Consortium, the body that maintains web standards. Version 2.1 dates from June 2018. Level AA is a set of 50 testable requirements, built on four ideas.
Perceivable
Every patient can take in the content. Images have text descriptions, video has captions and text stands out from its background.
Operable
Every patient can work the controls. Everything a mouse can do, a keyboard can do, and nothing times out without warning.
Understandable
Pages behave predictably. Forms say what they want and explain errors in words.
Robust
The code is sound enough for screen readers and other assistive technology to read it correctly.
The dates, and how they moved
-
May 9, 2024
The rule is published
HHS sets WCAG 2.1 Level AA as the standard, with two years to comply for larger recipients and three for smaller ones.
-
May 7, 2026
HHS extends both dates by one year
Days before the first deadline, an interim final rule moves it from May 11, 2026 to May 11, 2027, and the second from May 10, 2027 to May 10, 2028.
-
May 11, 2027
Practices with 15 or more employees
Websites, forms, documents and apps must meet the standard from this date.
-
May 10, 2028
Practices with fewer than 15 employees
The same requirements, one year later.
The extension moved the date for meeting the technical standard and nothing else. It was issued as an interim final rule with a request for comments, so the dates could move again. We review this page whenever HHS acts.
The five exceptions
The rule does not require everything ever posted to be repaired. Five kinds of content are excepted. They are narrower than they first sound.
| Exception | What it covers | Where it stops |
|---|---|---|
| Archived web content | Old material kept only for reference, research or recordkeeping, held in a clearly marked archive area. | Content that is still in use, or that gets edited after it is archived. |
| Preexisting documents | PDFs, word processing, presentation and spreadsheet files that were on the site before your compliance date. | Any document currently used to apply for, gain access to or take part in your services. Intake and consent forms are the usual examples. |
| Content posted by a third party | Something a member of the public posts, such as a comment. | Anything a vendor posts or runs for you under a contract or other arrangement. |
| Individualized, secured documents | A password-protected document about one person, their property or their account, such as a statement in the portal. | Documents sent to everyone, such as a general notice. |
| Preexisting social media posts | Posts the practice made before its compliance date. | Posts made on or after that date. |
An exception removes the duty to bring that item up to the standard in advance. It does not remove the duty to help a patient who asks: a practice may still have to provide the content in a form that patient can use.
Four more things worth knowing
A separate “accessible version” is not the answer
The rule tightly restricts the use of an alternate version of a page in place of fixing the page itself.
Perfection is not the test
The rule allows for a minor lapse that has only a minimal effect on a person's access. It is a narrow allowance, not a reason to skip testing.
What a missed date can mean
The HHS Office for Civil Rights enforces Section 504 and investigates complaints. Law firms that advise providers note that the remedies can reach as far as the loss of federal funding.
There is a second law
A private medical office is also a place of public accommodation under Title III of the Americans with Disabilities Act. Patients have brought website claims under that law, which has no dates attached.
What a practice can do now
-
Confirm your date
Count employees across the whole practice and ask your attorney which date applies.
-
Find out where you stand
A free Snapshot shows what an automated check finds on your site today.
-
List your forms and vendors
Forms patients must complete and tools a vendor runs are where the exceptions do not help.
-
Plan the work
A single-location site takes us 21 days. Leave room before your date for your vendors to answer.
Sources
The primary documents this page summarizes.