The HHS Section 504 web rule requires recipients of federal financial assistance from the Department of Health and Human Services to make their websites and mobile apps conform to WCAG 2.1 Level AA. The rule went into effect with compliance dates based on recipient size: larger recipients have a shorter window, smaller recipients have longer. It applies to hospitals, clinics, state health agencies, universities running health programs, and many nonprofits receiving HHS funding. The rule covers public-facing web content and mobile apps used to deliver programs or activities, with limited exceptions for archived material and certain third-party content.
| Element | What It Means |
|---|---|
| Standard | WCAG 2.1 Level AA |
| Who It Covers | Recipients of HHS federal financial assistance |
| Scope | Web content and mobile apps used in programs or activities |
| Compliance Dates | Tiered by recipient size, generally 2026 and 2027 |
| Exceptions | Archived content, preexisting documents, certain third-party content |
| First Step | Inventory digital assets, then conduct a WCAG 2.1 AA evaluation |
1. Who does the HHS Section 504 web rule cover?
The rule covers any entity that receives federal financial assistance from HHS. That includes hospitals and health systems, state and local public health agencies, federally qualified health centers, universities with HHS-funded research or health programs, and nonprofits operating HHS-funded programs.
If an organization accepts Medicare or Medicaid reimbursements, HHS grants, or similar funding streams, the rule almost certainly applies.
2. What standard does the rule require?
WCAG 2.1 Level AA. This is the same standard adopted by the ADA Title II web rule and is now the dominant WCAG benchmark across federal accessibility regulations in the United States.
3. What digital content does the rule apply to?
Web content and mobile apps that a covered entity provides or makes available as part of its programs or activities. Patient portals, appointment scheduling tools, online forms, public health information pages, and program enrollment systems all fall inside scope.
Internal staff systems may or may not be covered depending on how they connect to programs and services. When in doubt, treat the asset as in scope.
4. What are the compliance deadlines?
Compliance dates are tiered. Larger recipients (those with 15 or more employees, generally) face the earlier deadline. Smaller recipients receive an additional year. Clients should confirm their classification and the exact date that applies to their organization, then build the project plan backward from that date.
5. Are there any exceptions?
Yes, and they mirror the ADA Title II exceptions. Archived web content, preexisting conventional electronic documents, content posted by third parties not under the recipient’s control, individualized password-protected documents, and preexisting social media posts fall under defined exceptions.
Each exception has specific conditions. Most active, public-facing content does not qualify.
6. How is this different from the ADA Title II web rule?
The structure is nearly identical. Title II applies to state and local governments. The HHS Section 504 rule applies to recipients of HHS funding. Many organizations fall under both. The standard, exceptions, and general framework align closely, which means one accessibility program can address both obligations.
7. What happens if a covered entity does not comply?
HHS can investigate complaints, withhold federal funding, and refer matters for further action. Private lawsuits under Section 504 are also a real risk. The financial exposure for noncompliance, especially loss of federal funding, often exceeds the cost of a proper accessibility program by a wide margin.
8. Where should an organization start?
Take inventory of every digital asset that touches a program or activity. From there, conduct a WCAG 2.1 AA evaluation on the highest-priority assets, typically the main website, the patient or member portal, and any mobile app. The evaluation report identifies the issues that need remediation and gives the team a concrete work plan.
9. Can scans confirm conformance?
No. Automated scans only flag approximately 25% of issues. A manual evaluation conducted by trained auditors is the only way to determine WCAG conformance. Scans have a role in ongoing monitoring after remediation, but they cannot substitute for the evaluation itself.
10. What documentation should be kept?
Evaluation reports, remediation logs, validation results, accessibility policies, and a public accessibility statement. If an investigation or complaint arrives, documentation is the difference between a quick resolution and a drawn-out matter. A clear remediation record tied to evaluation findings shows the organization acted in good faith.
FAQ
Do I need an accessibility statement to comply with Section 504?
The rule does not strictly require one, but publishing an accessibility statement is a standard practice that signals commitment, provides a contact path for users, and supports the broader documentation record.
How long does a WCAG 2.1 AA evaluation take for a hospital website?
Turnaround varies by scope. A focused evaluation on a representative sample of pages can be completed in two to four weeks. Larger systems with portals and mobile apps take longer, and the evaluation plan should reflect that scope.
Does the rule apply to PDFs and patient forms?
Yes, when those documents are part of a program or activity and posted publicly. Preexisting conventional electronic documents have a narrow exception, but new and updated documents must meet the standard.
The HHS Section 504 web rule is enforceable, the standard is set, and the work is the work. Inventory, evaluate, remediate, validate, document.
Contact Kris for help mapping a Section 504 web compliance plan: Contact Kris.