On May 9, 2024, the Department of Health and Human Services (“HHS”) published a Final Rule (“the Rule”) updating Section 504 of the Rehabilitation Act of 1973 (“Section 504”) regulations. As part of the Rule, every facility, program, or activity with 15 or more employees and receiving HHS funding will need to comply with new digital accessibility guidelines by May 11, 2026. Those with fewer than 15 employees will need to comply by May 10, 2027.
These guidelines will apply to every digital aspect of a program, from websites to apps to check-in kiosks. The HHS requirements mirror the Department of Justice (“DOJ”) Final Rule updating its regulations for Title II of the Americans with Disabilities Act (“ADA”), which is set to go into effect for state and local governments, public schools, community colleges, and public universities on April 24, 2026 or April 26, 2027, depending on their population.
Who Is Covered?
Any entity receiving federal financial assistance from HHS (including hospitals, clinics, research institutions, medical schools, insurers, long-term care providers, and other health or social service organizations) must comply. The Rule’s digital accessibility requirements apply to digital tools developed both internally and by third parties working on behalf of the organization.
What Is Required?
The Rule mandates that covered websites and mobile apps conform to the Web Content Accessibility Guidelines (WCAG), Version 2.1, Level A and Level AA success criteria. WCAG, developed by the World Wide Web Consortium, provides a technical standard for accessibility that has 13 guidelines organized under 4 principles and with success criteria at 3 levels (A, AA, and AAA).
Institutional Web Content
The Rule requires that all institutional web content—such as the organization’s primary website, patient portals, intranet resources, and mobile applications—created, maintained, or operated by the covered entity must comply with WCAG 2.1, Level A and AA standards. This obligation extends to all digital materials used for communicating with patients, beneficiaries, or the public, including frequently updated pages, online forms, multimedia content, and interactive features. Covered entities should ensure that accessibility is integrated into the design, development, and ongoing maintenance of digital content, with regular testing and quality assurance processes in place to identify and remediate barriers as new content is added or existing content is modified.
Third Party Content and Tools
The Rule applies to web content and mobile apps provided or developed by third parties under contract or other arrangements. This includes appointment schedulers, telehealth platforms, payment portals, and other digital services. Covered entities are responsible for ensuring that these third-party platforms meet the same accessibility standards.
Kiosk Accessibility
Kiosks used for check-in, payment, wayfinding, or other services must provide equal access, convenience, and confidentiality to patients with disabilities. If kiosks are not accessible, alternative procedures, such as immediate assistance at the front desk, must deliver equivalent user experience. While there is no U.S. technical standard for kiosk hardware, HHS suggests applying WCAG 2.1 to the software layer but does not provide guidance on hardware accessibility. However, the European EN 301 549 standard offers a credible framework for hardware accessibility and may be useful for compliance and procurement purposes.
Exceptions to Digital Accessibility Requirements
The Rule provides some exceptions that apply in limited, specific circumstances. Content falling under an exception may be required to be made accessible under Section 504 if an individual makes a specific request for that content. The exemptions include:
- Archived Web Content: Outdated content maintained solely for reference or recordkeeping, clearly labeled as “archive,” and not updated. Any content that is in use for any reason other than reference or recordkeeping must be compliant.
- Pre-existing Conventional Electronic Documents: Legacy PDFs, Word documents, slide decks, or spreadsheets posted before the compliance deadline and not actively used for services or applications. This does not include any document in use to apply for, access, or participate in covered programs or activities.
- Third Party Content Not Under Entity Control: Public forum posts or files uploaded by users not under contract or arrangement with the covered entity.
- Individualized Password-Protected Documents: Secure, individualized records (e.g., lab results, account statements) delivered to a single user.
- Pre-existing Social Media Posts: Content posted to platforms like Facebook or X (formerly Twitter) before the compliance date.
Compliance Deadlines
- 15 or more employees: May 11, 2026
- Fewer than 15 employees: May 10, 2027
Enforcement and Risks of Noncompliance
Noncompliance with the Rule can result in a loss of federal funding or regulatory enforcement by HHS Office for Civil Rights, including investigations and compliance reviews. Section 504 also provides a private right of action for aggrieved individuals. Website accessibility lawsuits are already common under Title III of the ADA (which applies to accessibility of a “place of public accommodation”), with thousands filed nationally each year for the last several years. The new Rule provides a standard for compliance for entities receiving financial assistance from HHS, but it may also encourage litigants to bring claims in the health and human services industry for even minor technical barriers.
Best Practices for Compliance
- Conduct a Comprehensive Audit: Review all websites, mobile apps, and kiosk interfaces for WCAG 2.1 A and AA compliance.
- Remediate Gaps: Collaborate with IT and vendors to address identified deficiencies.
- Update Vendor Contracts: Require compliance with accessibility standards in digital deliverables operated or provided by vendors.
- Train Staff: Train employees understand accessibility standards and workflows.
- Monitor and Test Regularly: Use tools such as a screen reader for manual accessibility testing to scan for ongoing compliance.
Looking Ahead
The DOJ in September stated a plan to issue a Notice of Proposed Rulemaking to “reconsider whether some of the regulatory provisions imposed by the April 24, 2024 rule could be made less costly” regarding its Title II Rule. However, no Notice of Proposed Rulemaking has been issued. Nor has HHS made any statement indicating it plans to follow suit. Due to the tight timeline for compliance, covered entities should take appropriate steps now to update and upgrade their systems to ensure compliance.