HHS extends the Section 504 deadline: what healthcare organizations need to know
-
Written by: Naama Oren
- Last update on
- Review by: Nora Ginio
- Last review on August 4, 2026
In short:
- The HHS has extended the Section 504 WCAG 2.1 Level AA compliance deadline by one year, but the legal obligation to provide accessible digital experiences remains fully in effect. Healthcare organizations should use the extra time to build a documented, organization-wide accessibility program, audit their digital properties, evaluate vendors, and demonstrate ongoing progress—because enforcement, litigation risk, and patient expectations haven't been postponed.
Four days before the original Section 504 digital accessibility deadline was set to take effect, the HHS Office for Civil Rights (OCR) extended it by a year. For HHS-funded healthcare organizations that had been racing toward May 11, 2026, the news is significant. It is also easy to misread.
The Interim Final Rule, announced on May 7, 2026, moves the WCAG 2.1 Level AA compliance dates one year later for recipients of HHS federal financial assistance. It does not change what the rule requires, who it covers, or what OCR expects to see when it opens a review. What it does provide is breathing room — for community health centers, smaller hospitals, FQHCs, and other recipients that told HHS they would not be able to meet the original date without significant burden.
The instinct to treat the extension as relief is understandable. The accurate read is that it is an opportunity. Healthcare organizations that use the additional twelve months to build a structured, documented compliance program will be in a fundamentally stronger position than those who treat the new deadline the way many treated the old one — as something to address later.
What the Interim Final Rule actually changes
The 2024 Final Rule that updated HHS’s Section 504 regulations remains in effect. The Interim Final Rule changes one specific element of that rule: the dates by which covered recipients must conform their web content and mobile applications to WCAG 2.1 Level AA.
The new deadlines are based on organization size, just as the original ones were.
- Recipients with 15 or more employees now have until May 11, 2027 to meet the WCAG 2.1 Level AA technical standard. The original deadline was May 11, 2026.
- Recipients with fewer than 15 employees now have until May 10, 2028. The original deadline was May 11, 2027.
The one-year extension applies only to the technical conformance deadlines for web content and mobile apps. Every other provision of the 2024 Final Rule — including the underlying non-discrimination obligation that has been in effect since July 8, 2024 — remains unchanged.
OCR’s stated rationale for the extension is twofold. First, the agency received reports that a significant number of recipients — community health centers, smaller hospitals, primary care centers — would not be able to meet the original 2026 deadline. Second, the extension aligns Section 504’s timeline with the parallel rulemaking the Department of Justice is conducting for ADA Title II, creating consistency for organizations covered by both laws.
That alignment matters. Public hospitals, state-run health departments, and other entities subject to both Section 504 and Title II were facing two overlapping compliance frameworks on slightly different timetables. The Interim Final Rule resolves that mismatch.
What the Interim Final Rule does not change
This is the part that deserves the most attention:
The technical standard is still WCAG 2.1 Level AA. The rule has not been weakened, narrowed, or revisited substantively. HHS extended the runway. It did not change the destination.
The underlying Section 504 obligation has been in effect since July 8, 2024. That obligation — to ensure that programs and activities are accessible to people with disabilities, including through digital channels — is independent of the technical deadlines. A patient who cannot access a scheduling tool, complete an intake form, or use a patient portal today still has a Section 504 claim today. The extension does not change that.
Private litigation remains available. Section 504 provides individuals with a private right of action, which means patients can file federal lawsuits directly against covered organizations without going through OCR first. The extension does not suspend that right, and it does not provide immunity from litigation during the transition period.
OCR enforcement authority remains active. OCR can open a compliance review at any time — proactively or in response to a complaint — and can investigate organizations whose digital services fall short of Section 504’s non-discrimination obligation. The agency does not need to wait until May 11, 2027 to act on a complaint filed today.
The “available upon request” fallback is still not a substitute for accessible digital services. Many healthcare organizations have historically pointed to phone lines or in-person alternatives as a workaround for inaccessible portals or scheduling tools. The 2024 Final Rule made clear that this is not enough, and the extension does not revive it. The primary digital pathway must be accessible.
What changed is the technical deadline. What did not change is the legal obligation, the enforcement framework, or the standard against which patient experience will be measured.
Why the extension is an opportunity, not a pause
The strongest read of the Interim Final Rule is that HHS is giving recipients more time to do the work — not telling them they can stop doing it.
OCR’s enforcement framework has never been built around achieving perfect WCAG 2.1 AA conformance on a single date. It is built around demonstrating that an organization has taken its obligation seriously: that digital accessibility is being managed as a structured, ongoing program, with documented audits, named owners, vendor oversight, and a remediation plan that reflects real progress.
That standard does not become easier to meet by waiting twelve more months. It becomes easier to meet by starting now and using the extension to build a defensible program before OCR — or a private plaintiff — has reason to look.
Healthcare organizations that have already begun the work should continue without interruption. The audits, vendor reviews, governance structures, and remediation roadmaps you have started are not just deadline preparation. They are the documentation that demonstrates good-faith compliance, and they retain their value regardless of whether the deadline is twelve months away or twenty-four.
Healthcare organizations that have not yet begun should treat the extension as their final window. The original May 2026 deadline arrived for many organizations as an emergency. The new May 2027 deadline does not need to.
Vendors are not on a different timeline
The extension applies to recipients of HHS funding. It does not change anything about the responsibility covered healthcare organizations carry for the accessibility of third-party platforms they make available to patients.
Under 45 C.F.R. § 84.84(a), covered entities are responsible for the accessibility of digital services provided through contractual, licensing, or other arrangements. That includes patient portals, online scheduling tools, telehealth platforms, bill pay systems, digital intake forms, kiosk software, and any other vendor-built environment patients interact with as part of receiving care. The contractual relationship between a healthcare organization and its vendor does not transfer Section 504 liability to the vendor. The legal responsibility runs to the entity providing the service to patients.
For healthcare organizations, this has two practical implications.
The first is that vendor accountability work should not be deprioritized because the deadline moved. Most healthcare organizations are operating with vendor contracts signed before May 2024 — contracts that almost certainly do not include explicit WCAG 2.1 Level AA conformance language, vendor-paid remediation commitments, or regression protection for future releases. Closing that contractual gap takes time. Twelve additional months is not a generous window for renegotiating an entire vendor stack.
The second is that VPATs and Accessibility Conformance Reports require renewed scrutiny, not less. A vendor-prepared VPAT documents what the vendor says about its product. It is a starting point for due diligence, not the end of it. Healthcare organizations that ask their patient-facing vendors for current, version-specific ACRs — and that follow up with questions about independent testing, known gaps, and remediation timelines — build the record OCR will want to see. Those that accept whatever documentation the vendor provides at face value are not building anything defensible.
A useful frame for vendors themselves: if your clients are HHS-funded healthcare organizations, the extension does not relieve you of pressure. It extends the pressure.
Your clients now have more time to scrutinize the accessibility of the platforms they buy from you, and procurement teams are increasingly treating WCAG 2.1 Level AA conformance as a baseline expectation rather than a competitive differentiator. Vendors that can produce current ACRs, demonstrate independent validation, and commit to remediation roadmaps will continue to win contracts. Those that cannot will increasingly find themselves replaced at renewal.
What to prioritize now
The twelve-month extension is most valuable to organizations that treat it as a structured runway rather than a postponement. A few priorities worth focusing on now.
Build or complete a digital scope inventory. A documented record of which web properties, mobile apps, patient-facing documents, and vendor platforms fall within Section 504 healthcare requirements is the foundation of every other piece of the program. OCR cannot assess your progress against a scope it does not see, and neither can you.
Conduct or refresh a WCAG 2.1 Level AA audit. An audit on file — even one that surfaces significant gaps — is evidence of engagement. No audit on file is far more damaging in an OCR review than an audit with findings and a documented remediation plan attached to it.
Engage your patient-facing vendors now. Request current ACRs. Review existing contracts for conformance language. Add WCAG 2.1 AA requirements to every new agreement and every renewal. Document the conversations. Vendor correspondence is part of your compliance record.
Assign cross-functional ownership. Digital accessibility in healthcare spans IT, compliance, procurement, and clinical operations. A named responsible employee — required for organizations with 15 or more employees — is the rule’s minimum bar. A coordinated cross-functional structure is what makes the program actually function.
Submit comments if your organization still faces significant burdens. The Interim Final Rule is open for public comment through July 6, 2026. Organizations with substantive concerns about the rule’s structure, scope, or implementation have a documented channel to raise them.
How to use the next twelve months
A defensible Section 504 program is not built from a single tool. accessiBe is an accessibility platform combining the best in AI automation, developer tools, and human expertise — the three capabilities the work actually requires, mapped to the three layers of risk healthcare organizations need to cover.
For the public-facing sites your team manages, you need continuous coverage that keeps pace with how often content actually changes — new service pages, updated provider directories, seasonal patient communications. accessWidget addresses that layer through an accessibility interface paired with AI-powered background remediation, helping advance healthcare website accessibility as content evolves.
For the portals, applications, and custom systems your developers maintain, you need visibility at the code level — not just a surface scan. accessFlow gives technical teams structured insight into accessibility status across complex digital environments and supports auditing, monitoring, and remediation workflows where engineering judgment is required.
For the patient-facing documents, vendor evaluations, and audit records OCR will want to see, you need human expertise. accessiBe’s professional services team conducts manual accessibility testing against WCAG 2.1 Level AA, produces Accessibility Conformance Reports for your own digital properties, and remediates complex PDFs and instructional materials where automation is not the right answer.
The extension gives you the time. A structured program — AI automation, developer tools, and human expertise working together — gives you the defense.
The bottom line
The deadline moved. The obligation did not.
The Interim Final Rule gives HHS-funded healthcare organizations more time to meet WCAG 2.1 Level AA — time that smaller recipients in particular have asked for and clearly needed. What it does not do is reduce the legal standard, suspend OCR’s enforcement authority, or pause the private right of action that patients have always had under Section 504.
The organizations that will be in the strongest position twelve months from now are the ones that use the extension to do what they were already supposed to be doing: inventory their digital environment, audit it against WCAG 2.1 AA, hold their vendors to the same standard, document the work, and build accessibility into how they operate rather than treating it as a project with an end date.
If your organization is preparing for the new Section 504 deadlines, our accessibility specialists can help you assess where you stand today and identify practical next steps. Book a call.
Frequently asked questions
Does the Section 504 deadline extension mean healthcare organizations can pause their accessibility efforts?
No. The extension gives covered healthcare organizations additional time to meet the WCAG 2.1 Level AA technical standard, but it does not remove the underlying obligation to provide accessible digital services. Organizations should use the extra time to build and document a structured accessibility program rather than delaying compliance efforts.
Who does the Section 504 deadline extension apply to?
The extension applies to healthcare organizations and other entities that receive federal financial assistance from the U.S. Department of Health and Human Services (HHS). This includes many hospitals, health systems, community health centers, physician practices, behavioral health providers, and other HHS-funded organizations.
What are the new Section 504 compliance deadlines?
Organizations with 15 or more employees must comply with the WCAG 2.1 Level AA requirements by May 11, 2027. Organizations with fewer than 15 employees have until May 10, 2028.
Did the accessibility requirements change?
No. The Interim Final Rule only extends the compliance dates. It does not change who is covered, the accessibility standard (WCAG 2.1 Level AA), or the underlying requirements established in the 2024 Final Rule.
What should healthcare organizations do during the extension period?
Organizations should inventory their digital assets, prioritize patient-facing services, conduct accessibility audits, remediate issues, document progress, and establish governance for ongoing accessibility. The additional time is intended to support implementation—not delay it.
Does the extension affect ADA or other accessibility requirements?
No. The extension only changes the Section 504 technical compliance deadlines for covered HHS-funded organizations. Other federal, state, or industry accessibility obligations may still apply depending on your organization and the services you provide.
