The new HHS Section 504 web rule requires recipients of federal financial assistance from the Department of Health and Human Services to make their websites and mobile apps conform to WCAG 2.1 Level AA. The rule was published in May 2024 and sets specific deadlines based on the size of the recipient. Covered entities include hospitals, health systems, state Medicaid agencies, social services programs, and any other organization receiving HHS funding. The rule applies to web content and mobile applications used to provide programs, services, or activities. Conformance is measured against the technical standard, with limited exceptions for archived content, preexisting documents, and third party content.
| Element | Requirement |
|---|---|
| Technical standard | WCAG 2.1 Level AA |
| Who it covers | HHS funding recipients including health systems, hospitals, Medicaid agencies, and social services programs |
| What it covers | Websites and mobile apps used to deliver programs, services, or activities |
| Compliance deadline | Two years from May 9, 2024 for large recipients; three years for smaller recipients |
| Exceptions | Archived web content, preexisting electronic documents, certain third party content, and individualized password protected documents |
Who Has to Comply
The rule applies to any entity that receives federal financial assistance from HHS. That covers a wide range of organizations: hospitals, federally qualified health centers, state and local health departments, Medicaid and CHIP programs, nursing homes participating in Medicare or Medicaid, social services agencies, mental health programs, and research institutions receiving HHS grants.
If your organization accepts HHS funding in any form, the rule likely applies to you. The reach is broad by design. Section 504 has long prohibited disability discrimination by federal funding recipients, and this rule clarifies what that means for digital content.
What Standard Does the Rule Set?
The rule adopts WCAG 2.1 Level AA as the technical standard. This aligns HHS with the Department of Justice’s ADA Title II rule, which uses the same standard for state and local governments. Many recipients are subject to both rules, so the alignment reduces conflict.
WCAG 2.1 AA covers the success criteria most associated with real user impact: text alternatives, keyboard operability, color contrast, form labels, focus visibility, and predictable behavior. A site that meets 2.1 AA gives people who use screen readers, magnification, alternative input devices, and other assistive technology a workable experience.
What Counts as Covered Content
The rule covers web content and mobile apps that a recipient uses to provide its programs, services, or activities. That includes appointment scheduling tools, patient portals, benefits enrollment forms, provider directories, health education content, telehealth interfaces, and the general informational pages that support those functions.
Mobile apps are explicitly in scope. A hospital app for managing care, a Medicaid app for checking benefits, or a public health app for tracking immunizations all fall under the rule.
What Are the Deadlines?
Compliance dates depend on recipient size. Recipients with 15 or more employees must comply within two years of the rule’s effective date, which puts the deadline in May 2026. Smaller recipients have three years, with a May 2027 deadline.
State and local government recipients that are also covered by ADA Title II must follow the earlier of the two deadlines that apply to them. For most, the ADA Title II dates govern: April 2026 for jurisdictions with 50,000 or more residents, April 2027 for smaller ones.
What Are the Exceptions?
The rule recognizes a limited set of content that does not have to meet WCAG 2.1 AA, though it still has to be made accessible on request. The exceptions include archived web content that meets specific criteria, preexisting conventional electronic documents that are not currently being used for an active program or service, password protected content created for a specific individual, third party content posted by users, and third party content linked from the recipient’s site that the recipient does not directly control.
These exceptions are narrower than they sound. Anything actively used to deliver a program or service has to conform, regardless of when it was created.
How to Approach the Work
The starting point for any recipient is a thorough accessibility audit on what an audit covers against the WCAG 2.1 AA standard. A comprehensive audit identifies the issues that need to be addressed and provides the documentation needed to plan remediation. Automated scans only flag approximately 25% of issues, so they cannot substitute for a full audit.
After the audit, recipients move into the remediation phase to fix identified issues. Issues are prioritized by user impact and legal risk, then fixed in development cycles. Validation confirms that the fixes worked. Larger digital portfolios benefit from a platform built to track accessibility work across teams so progress stays visible and reportable.
Training is the other half of the picture. Internal teams that produce web content and build mobile features need accessibility training tied to the WCAG standard so new issues don’t replace the ones being fixed.
What Documentation Will Recipients Need?
The rule does not mandate a specific form of documentation, but recipients should be prepared to demonstrate conformance. That typically includes an audit report identifying issues against WCAG 2.1 AA, a remediation log showing fixes and validations, a digital accessibility policy, and an accessibility statement on the website.
For health systems and other recipients that also procure software from vendors, an Accessibility Conformance Report (ACR) from each vendor helps document the conformance posture of third party tools used in delivering services.
How Real AI Fits the Picture
Accessible.org Labs is actively researching how AI can make auditing and remediation workflows more efficient for the people doing the work. Practical AI applications, the kind grounded in actual evaluation data, can support skilled practitioners by speeding up issue triage, prioritization, and documentation. AI cannot determine WCAG conformance on its own, and any vendor claiming otherwise is overstating what the technology can do.
Frequently Asked Questions
Does the new HHS Section 504 web rule apply to my private medical practice?
If your practice receives HHS funding, including Medicare or Medicaid reimbursements that meet the definition of federal financial assistance, the rule applies. Many private practices fall under the rule for this reason. Confirm with legal counsel based on your specific funding sources.
Is WCAG 2.1 AA the same standard as WCAG 2.2 AA?
Not quite. WCAG 2.2 AA builds on 2.1 AA with additional success criteria covering things like focus appearance and dragging movements. The HHS rule requires 2.1 AA conformance, so meeting 2.1 AA satisfies the rule. Some recipients choose to evaluate against 2.2 AA to stay ahead of future regulatory shifts and to align with vendor expectations.
What happens if a recipient misses the deadline?
HHS can investigate complaints, conduct compliance reviews, and pursue enforcement actions including the loss of federal financial assistance. Private litigation under Section 504 is also possible. The practical risk is significant given how much HHS funding flows through covered organizations.
Do mobile apps require a separate audit from the website?
Yes. Mobile apps and websites are distinct digital assets with different code, different interaction patterns, and different success criteria considerations. Each one needs its own evaluation against WCAG 2.1 AA.
The deadline horizon is short, and the scope of covered content is wide. Recipients that start the audit and remediation work now have time to address issues methodically. Those that wait will be making tradeoffs under pressure.
Contact Accessible.org to discuss your HHS Section 504 web compliance plan.
