On May 9, 2024, the U.S. Department of Health and Human Services (HHS) published the first full rewrite of its Section 504 regulations in nearly 50 years. The updated rule sets a hard deadline: May 11, 2026 for organizations with 15 or more employees to ensure their websites, mobile apps, patient portals, telehealth platforms, and kiosks meet WCAG 2.1 Level A and AA accessibility standards.

This is not a suggestion. It's a federal mandate that applies to every healthcare organization receiving HHS funding—hospitals, clinics, insurers, research institutions, medical schools, long-term care facilities, and more.

With just 69 days until the deadline, here's everything you need to know about HHS Section 504 digital accessibility compliance in 2026.

What Is HHS Section 504?

Section 504 of the Rehabilitation Act of 1973 prohibits discrimination on the basis of disability in any program or activity receiving federal financial assistance. The law has existed for decades, but enforcement focused primarily on physical access—wheelchair ramps, accessible parking, exam tables.

The 2024 update fundamentally changes that. For the first time, HHS has codified specific technical standards for digital accessibility across web, mobile, and kiosks. The rule took effect on July 8, 2024, and compliance deadlines begin in May 2026.

HHS deliberately aligned its standards with the Department of Justice's (DOJ) ADA Title II rule (which applies to state and local governments) to create consistency across federal accessibility enforcement.

Who Must Comply with Section 504?

Any entity receiving federal financial assistance from HHS is covered. This includes:

• Hospitals and health systems — including for-profit hospitals that accept Medicare/Medicaid
• Clinics and community health centers — rural, urban, federally qualified health centers (FQHCs)
• Health insurance companies — including private insurers offering Medicare Advantage or Medicaid managed care plans
• Medical schools and research institutions — universities with medical programs, NIH-funded research labs
• Long-term care and nursing facilities — skilled nursing facilities, assisted living accepting Medicaid
• Mental health and substance abuse treatment providers — outpatient clinics, residential treatment centers
• Home health agencies — organizations providing Medicare/Medicaid home care services
• Social service organizations — nonprofits administering HHS-funded programs (childcare, housing, nutrition)

The rule applies to digital tools developed both internally and by third parties working on behalf of your organization. If you contract with a vendor to provide appointment scheduling, billing, telehealth, or patient portal services, you are responsible for ensuring those platforms meet Section 504 standards.

Compliance Deadlines: Two Phases Based on Organization Size

HHS created a phased rollout based on employee count:

HHS reasoning: Larger organizations have more resources to dedicate to accessibility projects and can absorb implementation costs more easily. Smaller organizations get an extra year.

Important: The DOJ announced in September 2024 that it would issue a Notice of Proposed Rulemaking to "reconsider whether some of the regulatory provisions imposed by the April 24, 2024 rule could be made less costly" for its Title II ADA rule. However, no delay has been issued as of March 2026. More importantly, HHS has made no statement indicating it plans to follow suit with Section 504.

Due to the tight timeline and lack of clarity on potential delays, covered entities should proceed with full compliance efforts now.

What Digital Systems Must Be Accessible?

1. Institutional Web Content

All web content created, maintained, or operated by your organization must comply with WCAG 2.1 Level A and AA. This includes:

• Your organization's primary website (homepage, department pages, provider directories)
• Patient portals (appointment scheduling, test results, prescription refills)
• Billing and payment systems
• Health insurance enrollment and claim portals
• Intranet resources (if used by patients or beneficiaries)
• Frequently updated content (news, blog posts, COVID-19 updates)
• Online forms (registration, intake forms, consent documents)
• Multimedia content (videos with captions and audio descriptions)
• Interactive features (chatbots, symptom checkers, drug interaction tools)

Accessibility must be integrated into design, development, and ongoing maintenance. Regular testing and quality assurance processes are required to identify and remediate barriers as new content is added or existing content is modified.

2. Mobile Applications

Native mobile apps (iOS and Android) must meet the same WCAG 2.1 AA standards as web content. This includes:

• Patient-facing apps (MyChart, Epic MyChart, Cerner HealtheLife, proprietary apps)
• Telehealth apps (video visit platforms, remote monitoring apps)
• Prescription management apps
• Health tracking and wellness apps provided by insurers or health systems

Mobile accessibility testing requires checking VoiceOver (iOS) and TalkBack (Android) screen reader compatibility, touch target sizes (minimum 44×44 pixels), color contrast on mobile displays, and alternative input methods beyond touch.

3. Patient Portals and Telehealth Platforms

Patient portals are explicitly covered. These systems are critical access points for receiving healthcare services, making them high-priority compliance targets.

Common accessibility barriers in patient portals:

• Inaccessible login flows — CAPTCHA without audio alternative, multi-factor authentication requiring visual codes
• Form errors without screen reader announcements — "Invalid date" errors that only appear visually
• PDF lab results that aren't tagged — screen readers can't parse unstructured PDFs
• Appointment calendars without keyboard navigation — date pickers requiring mouse interaction
• Video visit platforms without captions or keyboard controls

Telehealth platforms must provide real-time captions for video visits, keyboard-accessible video controls (mute, camera on/off), and screen reader compatibility for chat features.

4. Kiosks: The Unique Healthcare Challenge

This is where Section 504 diverges most from standard web accessibility compliance. Kiosks used for check-in, payment, wayfinding, or other services must provide equal access, convenience, and confidentiality to patients with disabilities.

Examples of healthcare kiosks covered by Section 504:

• Check-in kiosks in hospital lobbies and clinic waiting rooms
• Pharmacy prescription pickup kiosks
• Payment and billing kiosks
• Wayfinding kiosks in large medical campuses
• Visitor badge issuance kiosks
• COVID-19 symptom screening kiosks

The kiosk compliance gap: Unlike websites and apps, the United States does not have a published technical accessibility standard for kiosk hardware with testable, objective criteria. HHS suggests applying WCAG 2.1 to the kiosk software layer but provides no guidance for hardware accessibility.

This creates a compliance dilemma. How do you prove your kiosk provides "equal access" when there's no standard to test against?

EN 301 549: The Practical Interim Standard for Kiosks

In the absence of a U.S. standard, EN 301 549 (the European ICT accessibility standard) offers a credible, testable framework. This standard is already followed by many global manufacturers and includes a full set of requirements for "closed functionality" devices—systems like kiosks that don't support third-party assistive technologies.

EN 301 549 covers:

• Keyboard navigation without requiring assistive tech
• Tactile cues (Braille labels, raised buttons)
• Built-in speech output (text-to-speech for screen content)
• Adjustable volume controls
• Touch target sizes for users with limited dexterity
• High-contrast visual displays
• Headphone jacks for private audio output

Why EN 301 549 works for Section 504 compliance:

• It provides objective, pass/fail test procedures (Annex C)
• It's recognized globally and used in procurement standards
• Major kiosk manufacturers already test against it
• You can request EN 301 549 test reports in RFPs and vendor contracts
• It aligns with the European Accessibility Act (EAA), useful for international operations

Until HHS or the U.S. Access Board publishes a formal kiosk standard, EN 301 549 gives you a defensible, standards-based way to demonstrate compliance.

What If Your Kiosk Isn't Accessible Yet?

Section 504 requires that any alternative process you provide must deliver the same access, convenience, and confidentiality that other patients receive through the kiosk.

❌ NOT compliant:

• Directing a blind patient to a slower, separate line at the front desk
• Requiring someone who uses a wheelchair to disclose personal health information aloud to a receptionist
• Making patients with disabilities wait longer for check-in assistance

✅ Compliant alternative (interim solution):

• Immediate, discreet assistance at the kiosk location (not a separate desk)
• Staff trained to input information privately and accurately
• Same check-in speed as kiosk users
• Same privacy protections (e.g., not requiring patients to state their visit reason aloud in a public area)

Document your alternative procedures and train staff accordingly. This is a stop-gap measure, not a permanent solution. When accessible kiosks become available, you must transition.

5. Third-Party Digital Tools and Vendors

You are responsible for the accessibility of web content and mobile apps provided or developed by third parties under contract or other arrangements. This includes:

• Appointment scheduling platforms (Zocdoc, MyChart, Epic, Cerner)
• Telehealth software (Zoom for Healthcare, Doxy.me, Teladoc platforms)
• Payment portals (Stripe, Square, healthcare-specific billing vendors)
• Prescription management systems
• Insurance eligibility verification tools
• Third-party chatbots or virtual assistants

Action required: Update vendor contracts to include accessibility requirements. Demand proof of WCAG 2.1 AA conformance through:

• VPAT (Voluntary Product Accessibility Template) — industry-standard accessibility conformance report
• Third-party accessibility audit reports — conducted by firms like Deque, Level Access, or TPGi
• Contractual accessibility SLAs — guaranteed response times for fixing accessibility issues

If a vendor cannot provide proof of accessibility, you have three options:

1. Require the vendor to remediate (set a deadline)
2. Find an accessible alternative vendor
3. Provide a conforming alternate version yourself (last resort, high cost)

What Is WCAG 2.1 Level A and AA?

WCAG (Web Content Accessibility Guidelines) is the international standard for web and mobile accessibility, developed by the World Wide Web Consortium (W3C). It defines testable success criteria organized under four core principles:

• Perceivable — Information must be presented in ways users can perceive (e.g., text alternatives for images, captions for videos)
• Operable — User interface components must be operable (e.g., keyboard navigation, sufficient time to complete tasks)
• Understandable — Information and operation must be understandable (e.g., predictable navigation, input assistance for forms)
• Robust — Content must be robust enough to work with current and future assistive technologies

WCAG has three conformance levels:

• Level A — Minimum level, addresses the most severe accessibility barriers
• Level AA — Addresses the majority of barriers, industry standard for compliance
• Level AAA — Highest level, often unachievable for all content

Section 504 requires Level A and Level AA (combined). This means your digital content must meet all 50 success criteria in WCAG 2.1 Level A and all 20 additional criteria in Level AA—70 total checkpoints.

WCAG 2.1 vs. 2.2: Should You Go Beyond the Minimum?

While Section 504 requires WCAG 2.1, WCAG 2.2 became the official standard in October 2023. It adds nine new success criteria, including:

• 2.4.11 Focus Not Obscured (Minimum) — Focused elements can't be completely hidden by other content
• 2.4.12 Focus Not Obscured (Enhanced) — Focused elements can't be obscured at all
• 2.5.7 Dragging Movements — Functions requiring dragging must have a single-pointer alternative
• 2.5.8 Target Size (Minimum) — Interactive elements must be at least 24×24 pixels
• 3.2.6 Consistent Help — Help mechanisms must appear in the same location across pages
• 3.3.7 Redundant Entry — Don't make users re-enter the same information
• 3.3.8 Accessible Authentication (Minimum) — Login flows can't rely solely on memory tests (e.g., complex passwords without paste support)

Content that meets WCAG 2.2 automatically meets 2.1 and 2.0 (backward compatible).

Why adopt WCAG 2.2 now:

• Future-proofs your systems against inevitable regulatory updates
• Saves you from a second retrofit when HHS eventually upgrades to 2.2
• Better user experience (larger touch targets, no-drag alternatives, accessible authentication)
• Stronger legal defensibility in litigation

Exceptions to Section 504 Web Accessibility Requirements

Section 504 carves out five content categories that don't have to meet WCAG 2.1. These exemptions are meant for edge-case materials that are hard to retrofit or that users rarely need:

1. Archived Web Content

Outdated content maintained solely for reference or recordkeeping, clearly labeled as "archive," and not updated.

Example: A hospital's 2015 annual report PDF preserved for historical records and labeled "Archive — 2015 Annual Report."

Not exempt: Content that is still in use for any reason other than reference or recordkeeping. If patients are directed to an archived policy document as current guidance, it must be accessible.

2. Pre-Existing Conventional Electronic Documents

Legacy PDFs, Word documents, PowerPoint slide decks, or spreadsheets posted before your compliance deadline (May 11, 2026 or May 10, 2027) and not actively used for applying for, accessing, or participating in services or programs.

Example: A research study PDF published in 2023 and available for reference but not required for any current patient service.

Not exempt: Any document actively used in workflows—intake forms, consent documents, billing statements, patient education materials, treatment plans. These must be remediated.

3. Third-Party Content Not Under Entity Control

Public forum posts or files uploaded by users not under contract or arrangement with the covered entity.

Example: Patient comments on a community health forum where users upload their own files.

Not exempt: Vendor-provided platforms (appointment scheduling, telehealth) operating under contract. You are responsible for ensuring vendor tools are accessible.

4. Individualized, Password-Protected Documents

Secure, individualized records delivered to a single user, such as lab results, account statements, or benefit letters in a patient portal.

Important caveat: While you don't have to make every individualized document accessible proactively, you must provide it in an accessible format upon request. If a blind patient requests their lab results in an accessible format, you must deliver it (e.g., as accessible HTML or properly tagged PDF).

5. Pre-Existing Social Media Posts

Content posted to platforms like Facebook, X (formerly Twitter), LinkedIn, or Instagram before your compliance deadline is exempt.

Not exempt: New posts made after your deadline. If you post an image on May 12, 2026, it must include alt text. If you post a video, it must have captions.

Critical Reminder About Exceptions

These are legal exemptions, not best practices. If an exempt item becomes part of an active workflow—say, an archived PDF is revived for use as current patient instructions—you must bring it up to WCAG 2.1 AA or provide a conforming alternate version.

Enforcement and Penalties for Section 504 Violations

Section 504 violations carry both administrative and legal consequences.

HHS Office for Civil Rights (OCR) Enforcement

OCR investigates Section 504 complaints and can initiate compliance reviews without waiting for a complaint to be filed.

Enforcement actions include:

• Voluntary compliance agreements — OCR works with organizations to develop remediation plans
• Corrective action plans with deadlines — Mandatory fixes with OCR oversight
• Loss of federal funding — HHS can terminate funding for noncompliant organizations
• Referral to the Department of Justice — For willful noncompliance or refusal to cooperate

You can file a complaint online at the OCR Complaint Portal.

Private Right of Action: Lawsuits Are Coming

Section 504 provides a private right of action, allowing individuals to sue directly without first filing an OCR complaint.

Website accessibility lawsuits are already common under Title III of the ADA (which applies to "places of public accommodation"). According to Seyfarth Shaw's 2025 annual report, 8,667 federal ADA website lawsuits were filed in 2025, with healthcare organizations representing a significant portion.

The new Section 504 rule provides a clear standard for compliance, which may reduce some uncertainty—but it also gives plaintiffs' attorneys a codified technical standard to test against. Expect a surge in healthcare accessibility litigation after the May 2026 deadline, particularly targeting:

• Patient portals with inaccessible login flows
• Appointment scheduling systems without keyboard navigation
• Telehealth platforms without captions
• Kiosks without accessible alternatives
• PDF lab results and billing statements that aren't tagged

Settlements in ADA website cases typically range from $3,000 to $75,000 for small to mid-sized organizations, with attorney's fees on top. For health systems operating in multiple states, class-action lawsuits could reach millions.

How to Comply with Section 504 by May 2026: Step-by-Step Roadmap

Step 1: Conduct a Comprehensive Accessibility Audit

You cannot fix what you don't know is broken. Start with a full inventory and audit of all patient-facing digital assets:

• Public website (homepage, department pages, provider directories, contact forms)
• Patient portals (Epic MyChart, Cerner, proprietary systems)
• Mobile apps (iOS and Android)
• Telehealth platforms
• Billing and payment systems
• Appointment scheduling tools
• Kiosks (check-in, payment, wayfinding)
• PDF documents actively used in workflows (consent forms, billing statements, patient education materials)

Audit methods:

• Automated scanning — Use tools like RatedWithAI free accessibility scanner, axe DevTools, WAVE, or Lighthouse to identify technical violations
• Manual testing — Test with keyboard navigation only (no mouse), screen readers (NVDA, JAWS, VoiceOver), and mobile screen readers (TalkBack, VoiceOver iOS)
• User testing with people with disabilities — The most reliable validation method
• Third-party professional audit — Hire firms like Deque, Level Access, or TPGi for comprehensive WCAG 2.1 AA audits

Prioritize high-traffic, high-risk areas first: patient portals, appointment scheduling, billing, and emergency/COVID-19 information.

Step 2: Develop a Remediation Plan

Organize your audit findings by severity and impact:

• Critical (fix immediately) — Barriers that completely block access (e.g., login forms without keyboard navigation, CAPTCHA without audio alternative)
• High — Significant barriers affecting core functions (e.g., appointment calendar without screen reader labels)
• Medium — Moderate barriers with workarounds (e.g., color contrast issues, missing alt text on decorative images)
• Low — Minor issues with limited impact

Create a timeline with milestones. For a May 11, 2026 deadline, consider:

• March 2026 — Complete audit, develop remediation plan, update vendor contracts
• April 2026 — Remediate critical and high-priority issues, train staff, implement monitoring
• May 1-10, 2026 — Final QA testing, document compliance, prepare for deadline

Step 3: Update Vendor Contracts and RFPs

For every third-party digital tool, add accessibility requirements to contracts:

• Vendor must provide current VPAT (Voluntary Product Accessibility Template) showing WCAG 2.1 AA conformance
• Vendor must remediate accessibility issues within [30/60/90] days of identification
• Vendor must notify you of accessibility-related updates or changes
• Include right to terminate contract if vendor fails to maintain accessibility

For new procurement (kiosks, EHR systems, telehealth platforms), require:

• WCAG 2.1 AA conformance (or WCAG 2.2 AA for future-proofing)
• EN 301 549 conformance for kiosk hardware
• Demonstration of accessibility features during vendor demos
• Accessibility SLAs in contracts

Step 4: Embed Accessibility into Your Entire Ecosystem

Accessibility can't be a one-time project. It must be integrated into every stage of content creation and technology deployment:

• Design phase — Use accessible color palettes (4.5:1 contrast for text), design with keyboard navigation in mind
• Development phase — Test with screen readers during development, not after launch
• Content authoring — Train content creators to write alt text for images, add captions to videos, use proper heading structure
• QA testing — Include accessibility testing in every release cycle
• Procurement — Require accessibility conformance in all software and hardware purchases

Step 5: Train Staff

Everyone who creates, publishes, or manages digital content needs accessibility training:

• Web developers and designers — WCAG 2.1 technical standards, ARIA best practices, semantic HTML
• Content creators (marketing, patient education) — How to write alt text, create accessible PDFs, add captions to videos
• Procurement and vendor management — How to evaluate vendor VPATs, what to include in accessibility SLAs
• Front desk and patient services staff — How to provide equivalent kiosk assistance with privacy and efficiency

Step 6: Monitor and Test Regularly

Accessibility is not "set it and forget it." Websites change constantly—new content, new features, vendor updates. Implement continuous monitoring:

• Automated scanning — Weekly or monthly scans of all pages with RatedWithAI scanner or similar tools
• Manual testing — Quarterly keyboard-only and screen reader testing
• User feedback — Provide a clear accessibility feedback mechanism on your website
• Vendor updates — Require vendors to notify you of updates that could affect accessibility

Step 7: Document Everything

If you face an OCR investigation or lawsuit, documentation is your best defense:

• Audit reports showing your baseline and progress
• Remediation plans with timelines
• Vendor contracts with accessibility requirements
• Training records
• QA testing results
• Accessibility policy and governance structure

This documentation demonstrates good-faith compliance efforts, which can mitigate penalties even if you haven't achieved 100% conformance by the deadline.

Can You Claim "Undue Burden"?

Section 504 allows covered entities to claim that accessibility compliance would impose an "undue burden"—meaning it would require significant difficulty or expense relative to the organization's size and resources.

This is an extremely high bar. HHS regulations make clear that:

• Undue burden is determined on a case-by-case basis
• It considers the organization's overall financial resources, not just the cost of the specific project
• You must document why the burden is undue with financial analysis
• You still must take some action to provide access, even if you can't achieve full compliance

Given that automated accessibility fixes (adding alt text, improving color contrast, adding ARIA labels) are low-cost and that many accessibility issues can be prevented through proper design, undue burden claims are rarely successful except for extremely small organizations or very specific technical barriers.

Better strategy: Focus on phased compliance rather than claiming undue burden. Document your progress and prioritize high-impact fixes.

Section 504 vs. ADA Title II: How Do They Differ?

Both Section 504 and ADA Title II now require WCAG 2.1 Level A and AA for digital content. The key differences:

Some organizations are covered by both rules—for example, a public hospital (state or local government entity) that also receives HHS funding. In these cases, you must comply with the earlier deadline and the stricter requirements.

Why Start Now: 69 Days Is Not Enough Time

Many healthcare organizations underestimate the scope of Section 504 compliance. Here's why 69 days is a dangerously tight timeline:

Auditing Takes Time

A comprehensive WCAG 2.1 audit of a mid-sized hospital website (500+ pages, patient portal, mobile app) typically requires 2-4 weeks for a professional firm. DIY audits take even longer.

Vendor Remediation Is Outside Your Control

If your patient portal vendor (Epic, Cerner, Athenahealth) has accessibility issues, you can't fix them yourself. You can only request fixes. Vendor response times vary from weeks to months.

PDF Remediation Is Labor-Intensive

Hospitals generate thousands of PDFs—consent forms, billing statements, patient education materials, lab reports. Properly tagging a complex multi-page PDF for screen reader accessibility can take 30-60 minutes per document for a trained specialist.

Kiosk Hardware Can't Be Upgraded Overnight

If your check-in kiosks don't have tactile buttons, headphone jacks, or speech output, you may need to purchase new hardware. Procurement, installation, and staff training take months.

Staff Training Requires Planning

Training hundreds of employees (developers, designers, content creators, front desk staff) on accessibility best practices doesn't happen in a week.

Organizations that started in late 2024 or early 2025 are in a strong position. Those starting now face a sprint. Those waiting until April 2026 will almost certainly miss the deadline.

What Happens After May 11, 2026?

The deadline is not the finish line. It's the start of ongoing compliance:

• OCR complaint investigations begin — Patients who encounter accessibility barriers can file complaints immediately
• Plaintiff attorneys test for violations — Expect accessibility firms to audit healthcare websites systematically
• Vendor updates may break accessibility — Continuous monitoring is essential
• New content must be accessible from day one — Every new page, video, PDF, app update

Think of May 11, 2026 as the start of a new operational standard, not a one-time project.

Free Tools to Get Started

You don't need to hire a $50,000 consulting firm to start. Free tools can identify 30-40% of accessibility issues:

• RatedWithAI Free Accessibility Scanner — Instant WCAG 2.1 analysis with prioritized fixes
• axe DevTools — Browser extension for developers (Chrome, Firefox, Edge)
• WAVE by WebAIM — Visual accessibility testing
• NVDA Screen Reader — Free Windows screen reader for manual testing
• Built-in screen readers — VoiceOver (macOS/iOS), TalkBack (Android), Narrator (Windows)

Start with automated scanning to find low-hanging fruit (missing alt text, color contrast issues, missing form labels). Then move to manual testing for complex interactions (keyboard navigation, screen reader announcements, form validation).

The Bottom Line

The HHS Section 504 digital accessibility deadline is 69 days away. For healthcare organizations with 15 or more employees receiving federal funding, May 11, 2026 is a hard deadline with real enforcement consequences—loss of funding, OCR investigations, and lawsuits.

This is not a technical compliance checkbox. It's a fundamental shift in how healthcare organizations deliver digital services. Patients with disabilities must have equal access to appointment scheduling, patient portals, telehealth, billing systems, and kiosks.

The organizations that will succeed are those that:

• Start now with comprehensive audits
• Prioritize high-impact, high-traffic systems
• Embed accessibility into procurement, development, and content workflows
• Train staff across all departments
• Monitor and test continuously
• Document everything

If you haven't started yet, the time is now.

Additional Resources

• HHS Section 504 Overview — Official HHS Office for Civil Rights page
• Section 504 Final Rule (Federal Register) — Full regulatory text
• WCAG 2.1 Guidelines — Official W3C technical standard
• EN 301 549 Standard (PDF) — European ICT accessibility standard for kiosks
• OCR Complaint Portal — File a Section 504 complaint with HHS
• Section 508 Compliance Guide — Federal government accessibility requirements
• ADA Title II April 2026 Deadline — State and local government accessibility requirements
• VPAT Guide — How to read and request accessibility conformance reports