The new Department of Health and Human Services (HHS) web rule requires WCAG 2.1 AA conformance for your websites, web content, and mobile apps. Here’s how an accessibility audit and, potentially, a VPAT/ACR, can help you with Section compliance.
| Key Point | What It Means for You |
|---|---|
| Required Standard | WCAG 2.1 AA conformance for websites, web content, and mobile apps |
| Deadline (15+ Employees) | May 11, 2026 |
| Deadline (Fewer Than 15) | May 10, 2027 |
| What an Audit Does | Identifies all accessibility issues through manual evaluation against every WCAG 2.1 AA success criterion |
| What a VPAT/ACR Does | Documents the conformance status of your digital asset in a standardized format for procurement and compliance records |
| Content Exceptions | Archived web content, preexisting documents (with conditions), third-party content, secured individualized documents, and preexisting social media posts |
What Does the New HHS Web Rule Require?
The Department of Health and Human Services (HHS) issued a final rule updating Section 504 to include specific digital accessibility requirements. The rule applies to any entity receiving federal financial assistance from HHS. This includes hospitals, nursing homes, health care providers in Medicaid and CHIP programs, Medicare participants across Parts A through D, human and social service agencies, and insurers participating in the Marketplaces.
For digital accessibility, the requirement is clear: WCAG 2.1 AA conformance for websites, web content (including documents), and mobile apps. These requirements mirror the ADA Title II web accessibility requirements, which also adopted WCAG 2.1 AA as the technical standard.
Organizations with 15 or more employees must conform by May 11, 2026. Those with fewer than 15 employees have until May 10, 2027.
There are five content exceptions: archived web content, preexisting conventional electronic documents (unless currently used for program access), third-party content, individualized password-protected documents, and preexisting social media posts. Even with these exceptions, the scope of what must conform is broad.
Why Is an Audit Needed for Section 504 Compliance?
An audit is the only way to identify all WCAG 2.1 AA issues on your website or mobile app. Automated scans can only flag a fraction of WCAG success criteria. Many requirements need human judgment, including evaluations of screen reader experience, keyboard navigation, meaningful alternative text, and proper content structure.
A manual audit means a technical accessibility expert is systematically evaluating your digital asset against every applicable WCAG success criterion using multiple methodologies: screen reader testing with NVDA, JAWS, or VoiceOver, keyboard-only navigation, visual inspection, code inspection, browser zoom testing, and color contrast analysis. An automated scan like AXE or WAVE is used only as a secondary check to ensure nothing is missed.
Accessible.org audits are always 100% fully manually conducted. We never copy and paste scan results into audit reports. Every issue in the report is identified and verified by a human auditor.
This distinction matters because Section 504 requires actual WCAG 2.1 AA conformance. An automated scan cannot tell you whether your digital asset conforms. Only a manual audit can.
What Is a VPAT and Do You Need a VPAT/ACR?
Unless required by a procurement officer, you do not need an Accessibility Conformance Report or ACR. A VPAT (Voluntary Product Accessibility Template) is the document you fill in to produce an ACR (Accessibility Conformance Report). The ACR documents the conformance status of your ICT product or service against WCAG 2.1 AA, criterion by criterion.
A VPAT is essential if your organization provides products or services that other entities procure, especially in government contexts. Even if procurement is not your primary concern, an ACR serves as formal documentation of your accessibility status for compliance records.
An audit must be completed before a VPAT can be accurately filled in. Without a thorough manual evaluation, the conformance ratings in the ACR would be unreliable. The audit identifies every instance of non-conformance, and the ACR then documents that status for each success criterion.
What Happens After the Audit?
Once your audit report is delivered, remediation begins. The report details every issue found, including its location, the applicable WCAG success criterion, recommendations for fixing, and visual documentation. Your development team uses this information to make fixes.
Tracking remediation progress is where many organizations lose efficiency. With dozens or even hundreds of issues across multiple digital assets, keeping track of what has been fixed, what still needs work, and what has been validated requires a structured approach.
Accessibility Tracker is a project management platform designed specifically for this workflow. You upload your audit report, assign issues to team members, and track each issue through predefined status labels: Not Started, In Progress, Completed, On Hold, Needs Work, Validated, or Discarded. Your auditor can also validate fixes directly in the platform, which eliminates the back-and-forth of email threads and spreadsheet updates.
After remediation and validation, your organization can receive documentation such as a VPAT/ACR, a conformance statement, or certification. The Accessibility Tracker tracks your progress toward that goal throughout the entire project.
How Should You Plan Your Section 504 Accessibility Project?
Start by determining which digital assets fall under the rule. This includes your website, any web applications, published documents, and mobile apps. Define the scope of pages and screens that need to be evaluated.
Next, engage an audit provider who conducts fully manual audits against WCAG 2.1 AA. The audit will give you a complete picture of where you stand. From there, your team remediates the issues and an auditor validates the fixes.
If your organization also needs to demonstrate conformance under the ADA or the European Accessibility Act (EAA), the same audit and VPAT process applies. WCAG 2.1 AA is the common standard across these regulations, so one thorough audit and a well-documented ACR can serve multiple compliance needs.
The deadlines are firm. If your organization has 15 or more employees, you have until May 2026. Planning your audit now gives your team adequate time to complete the full cycle of evaluation, remediation, and validation.
FAQ
Does the new HHS rule apply to all healthcare organizations?
No. It applies specifically to entities receiving federal financial assistance from HHS. This includes Medicaid and CHIP providers, Medicare participants, human and social service agencies, and marketplace insurers receiving premium tax credits. Private practices that do not receive HHS funding are not covered under Section 504.
Can an automated scan function as an audit?
No. Automated scans can only detect a limited portion of WCAG 2.1 AA success criteria. The rule requires full conformance, which can only be verified through a manual audit. Scans are useful as a secondary check within the audit process, but they cannot serve as the evaluation itself.
What is the difference between a VPAT and certification?
A VPAT/ACR documents the current conformance status of a digital asset, including areas of non-conformance. It does not require full conformance. Certification, on the other hand, is issued only when a digital asset fully conforms with the technical standard across the entire defined scope. Both require a manual audit as their foundation.
What if we cannot meet full WCAG 2.1 AA conformance by the deadline?
The rule includes a provision for noncompliance that has a minimal impact on access. If you can demonstrate that any remaining non-conformance does not affect the ability of individuals with disabilities to access the same information, engage in the same interactions, and conduct the same transactions, you may still be deemed in compliance. However, this is a narrow exception and should not be relied upon as a primary strategy.
How long does the full audit-to-conformance process take?
The audit itself typically takes one to two weeks. The full process from audit through remediation and validation usually takes four to eight weeks, depending on the scope and how quickly your team implements fixes.
Services
If you’re ready to start your accessibility audit, we’re happy to help and can provide a quote within 24 hours. Just send us a message and we’ll be with you right away.
Related Posts
- Section 504: Who Does New HHS Web Accessibility Rule Apply to?
- 2024 Regulatory Updates Mean Thousands of Digital Accessibility Jobs
- New HHS Rule Summary: Web and Mobile App Accessibility (WCAG 2.1 AA) Required
- Health and Human Services Issues New Anti-Discrimination Rule, Requires WCAG 2.1 AA for Digital
