The U.S. Department of Health and Human Services (HHS) has officially extended its digital accessibility compliance deadline under 45 CFR Part 84. If your organization receives federal funding from HHS — even a single Medicare or Medicaid payment — this rule applies to you, and the clock is ticking.
This guide covers everything: what the rule requires, who it covers, the new deadlines, and what you need to do right now. We have also published a series of deep-dive posts for each affected group — use the links throughout this article to find the guidance most relevant to your organization.
What Is 45 CFR Part 84 and Why Does It Matter?
On May 9, 2024, HHS published a sweeping final rule titled Nondiscrimination on the Basis of Disability in Programs or Activities Receiving Federal Financial Assistance. The rule updates Section 504 of the Rehabilitation Act of 1973 — the first comprehensive revision to these regulations in nearly 50 years.
For the first time in the regulation’s history, the rule establishes a specific, enforceable technical standard for digital accessibility: Web Content Accessibility Guidelines (WCAG) 2.1, Level AA. This means that covered websites, patient portals, mobile apps, and other digital services must meet measurable accessibility criteria — not just a general nondiscrimination obligation.
“The previous version of HHS’s Part 84 regulation was silent on digital accessibility. That gap is now closed.”
The Updated Compliance Deadlines
On May 7, 2026, HHS’s Office for Civil Rights (OCR) issued an Interim Final Rule extending the WCAG 2.1 AA technical compliance deadlines by one year. The revised schedule is:
| Organization Size | Original Deadline | New Deadline |
|---|---|---|
| 15 or more employees | May 11, 2026 | May 11, 2027 |
| Fewer than 15 employees | May 11, 2027 | May 10, 2028 |
Critical note: The extension only applies to the WCAG 2.1 AA technical conformance deadlines. The broader nondiscrimination obligations under Section 504 have been in effect since July 8, 2024. OCR can — and does — investigate complaints and initiate reviews right now, regardless of the extended technical deadline.
Who Is Covered? The Scope of the Rule
Coverage under 45 CFR Part 84 is triggered by receiving any federal financial assistance from HHS — directly or indirectly. This is a broad net that captures most of the U.S. healthcare system. Covered entities include:
- Hospitals and health systems that accept Medicare or Medicaid
- Physicians, clinics, and private practices billing Medicare (Parts A–D) or Medicaid
- Health insurers and managed care organizations participating in Medicare Advantage or Medicaid managed care
- Federally Qualified Health Centers (FQHCs) and community health centers
- Social service and human services organizations receiving HHS grants
- State and local government health agencies
- Pharmacies participating in Medicare Part D
- Educational institutions (e.g., medical schools) receiving HHS research grants
We have published dedicated guides for each affected group. Select the one that applies to your organization:
- 🏥 Hospitals & Health Systems: HHS 45 CFR Part 84 Compliance Guide
- 🏥 Physicians, Clinics & Private Practices: HHS 45 CFR Part 84 Compliance Guide
- 🏥 Health Insurers & Managed Care Organizations: HHS 45 CFR Part 84 Compliance Guide
- 🏥 Social Services & Community Organizations: HHS 45 CFR Part 84 Compliance Guide
What Is WCAG 2.1 Level AA?
WCAG 2.1 is the international standard for web and mobile accessibility, developed by the World Wide Web Consortium (W3C). It is built on four core principles — known by the acronym POUR:
- Perceivable — Information and UI components must be presentable to users in ways they can perceive (captions, alt text, sufficient color contrast)
- Operable — All functionality must be accessible via keyboard; no time traps; no seizure-inducing content
- Understandable — Content must be readable, predictable, and include input assistance
- Robust — Content must be reliably interpreted by assistive technologies including screen readers
Level AA is the middle tier of WCAG conformance — more rigorous than Level A, and the standard referenced by most accessibility regulations worldwide. It is the specific benchmark this rule requires.
What Digital Content Must Be Accessible?
Under 45 C.F.R. § 84.84, all web content and mobile apps made available by covered entities — whether built in-house or provided by a third-party vendor — must conform to WCAG 2.1 Level AA. Practically, this includes:
- Public-facing websites and microsites
- Patient portals and EHR patient interfaces
- Online scheduling, registration, and intake forms
- Telehealth platforms
- Online billing and payment systems
- Mobile applications
- Patient education videos and multimedia content
- Self-service kiosks (hardware accessibility governed by a parallel standard)
Third-party vendor tools are your responsibility. Under § 84.84(a), a contractual relationship with a vendor does not transfer your Section 504 liability. If your EHR vendor’s patient portal is inaccessible, your organization is the responsible party. Phone hotlines are no longer an acceptable substitute for inaccessible digital services under this rule.
Five Exceptions to the Rule
Section 84.85 carves out five limited content categories that do not need to meet WCAG 2.1:
- Archived web content — Content stored for reference that is no longer actively used
- Preexisting conventional electronic documents — PDFs and Office files published before your compliance deadline, provided they are not used to apply for, access, or participate in programs
- Content posted by a third party — Content not controlled by the recipient
- Individualized, password-protected documents — Documents shared with specific individuals that are not widely distributed
- Fundamental alteration or undue burden — Where compliance would fundamentally alter the program or impose an undue burden (must be documented in writing by the head of the entity)
These exceptions are narrow. If any exempt content enters an active workflow — for example, an archived PDF that gets reused as current patient instructions — it must be remediated or replaced with an accessible version.
Your Compliance Obligations Start Now
The extension to May 2027 is an opportunity, not a reprieve. OCR can investigate complaints and open proactive reviews today, applying the broader nondiscrimination obligations of Section 504 that have been in effect since July 8, 2024. Organizations that are not yet compliant should:
- Designate a responsible employee for Section 504 digital accessibility
- Adopt grievance procedures for disability-related complaints
- Conduct a WCAG 2.1 AA audit combining automated scanning, manual expert testing, and user testing with people who rely on assistive technologies
- Prioritize high-impact patient journeys — portal login, scheduling, billing, and telehealth
- Update vendor contracts to include explicit WCAG 2.1 AA conformance language and remediation commitments
- Document a remediation plan with milestones, owners, and timelines
- Embed accessibility into ongoing workflows — design reviews, development sprints, and QA processes
Relation to the DOJ ADA Title II Rule
The HHS Section 504 rule closely mirrors the Department of Justice’s updated ADA Title II rule, which requires state and local governments and public entities to meet WCAG 2.1 Level AA. Both rules point to the same technical standard. For organizations covered by both laws — such as public hospitals or state Medicaid agencies — this alignment means a single compliance program can address obligations under both frameworks simultaneously.
Key Dates at a Glance
| Date | Milestone |
|---|---|
| May 9, 2024 | 45 CFR Part 84 final rule published in the Federal Register |
| July 8, 2024 | Rule effective date; general Section 504 nondiscrimination obligations apply |
| May 7, 2026 | HHS OCR issues Interim Final Rule extending WCAG deadlines |
| May 11, 2027 | WCAG 2.1 AA deadline — organizations with 15+ employees |
| July 8, 2027 | Accessible examination table and weight scale requirement |
| May 10, 2028 | WCAG 2.1 AA deadline — organizations with fewer than 15 employees |
Read the Full Series
This post is the hub of a five-part series covering 45 CFR Part 84 digital accessibility compliance. Read the guide for your organization type:
- Hospitals & Health Systems
- Physicians, Clinics & Private Practices
- Health Insurers & Managed Care Organizations
- Social Services & Community Organizations
This article is for informational purposes only and does not constitute legal advice. Consult qualified legal counsel regarding your organization’s specific obligations under 45 CFR Part 84.