The HHS Section 504 web rule requires recipients of HHS federal financial assistance to make web content and mobile apps conform to WCAG 2.1 AA. The rule includes five specific exceptions for content that does not have to meet the standard. Those exceptions cover archived web content, preexisting conventional electronic documents, content posted by a third party, individualized password-protected documents, and preexisting social media posts. Each exception is narrow. Content that falls outside the exception language must conform.
| Exception | What It Covers |
|---|---|
| Archived Web Content | Content kept only for reference, research, or recordkeeping that is not altered and is clearly labeled as archived. |
| Preexisting Conventional Electronic Documents | PDFs, Word, PowerPoint, Excel, and similar files posted before the compliance date, unless used to apply for or access services. |
| Third-Party Content | Content posted by a third party that is not posted by, or on behalf of, the recipient. |
| Individualized Password-Protected Documents | Conventional electronic documents about a specific person, their property, or their account, behind a login. |
| Preexisting Social Media Posts | Social media content posted by the recipient before the compliance date. |
What the HHS Section 504 Web Rule Requires
The rule, published by the Department of Health and Human Services, applies Section 504 of the Rehabilitation Act to web content and mobile apps used by recipients of HHS federal financial assistance. The technical standard is WCAG 2.1 Level AA.
The structure mirrors the Department of Justice ADA Title II web rule. Same standard. Same general framing. The exception categories are nearly identical in scope and language.
If content is covered by one of the five exceptions, it does not have to meet WCAG 2.1 AA. Everything else does.
Exception 1: Archived Web Content
Archived web content is material a recipient keeps only for reference, research, or recordkeeping. To qualify, the content must meet four conditions. It was created before the compliance date or reflects information from before that date. It is kept only for reference, research, or recordkeeping. It is stored in a special area for archived content. And it has not been changed since being archived.
If the recipient updates or reuses the content, the exception no longer applies. Old training material moved to a clearly labeled archive section can qualify. A historical report someone still actively edits cannot.
Exception 2: Preexisting Conventional Electronic Documents
This exception covers conventional electronic documents posted before the compliance date. The category includes PDFs, word processing files, presentation files, and spreadsheets.
There is a critical carveout. If the document is currently used to apply for, gain access to, or participate in a recipient’s programs, services, or activities, the exception does not apply. A 2019 PDF brochure about a defunct grant program may qualify. An intake form a person still needs to fill out to access services does not.
Exception 3: Third-Party Content
Content posted by a third party qualifies for the exception if it is not posted due to contractual, licensing, or other arrangements with the recipient. User comments on a public hospital blog are an example. A vendor portal the recipient pays for and directs users to is not, because the recipient is responsible for the arrangement that put the content there.
The determination is who is responsible for posting. If the recipient pays a vendor, contracts with a platform, or directs users to use the tool, that content is not third-party for the purpose of this exception.
Exception 4: Individualized Password-Protected Conventional Electronic Documents
This exception applies to conventional electronic documents that are about a specific individual, their property, or their account, and are password-protected. A billing statement in a patient portal. A personalized benefits letter behind a login. An account-specific tax document.
The exception is narrow on purpose. It does not cover general documents available to anyone logged in. The document must be individualized to a specific person, their property, or their account.
Exception 5: Preexisting Social Media Posts
Social media posts created by the recipient before the compliance date are exempt. Anything posted on or after the compliance date must conform to WCAG 2.1 AA. Captions on videos, alt text on images, color contrast in graphics, all of it applies going forward.
The exception is one-directional. Old posts are covered. New posts are not.
How Do These Exceptions Compare to the ADA Title II Rule?
The five HHS Section 504 exceptions track closely with the five exceptions in the DOJ ADA Title II web rule. The categories are the same. The language is similar. Recipients that fall under both rules can use one inventory and one strategy to cover both.
The standard is also the same: WCAG 2.1 AA. A single conformance approach works across both rules.
What Recipients Should Do With Exception Content
Exception content still has to be accessible on request. Section 504 requires recipients to provide effective communication and program access. If a person with a disability needs the content and it falls under an exception, the recipient still has to make it usable for that person.
An archived PDF that a researcher with a disability needs can be made accessible on request. A preexisting third-party tool can be replaced or supplemented. Exceptions reduce the universal conformance requirement, not the underlying obligation to provide access.
The practical step for most recipients is an inventory of digital assets, mapped against the five exceptions. Content that does not qualify gets prioritized for an accessibility audit and remediation plan. Content that qualifies still gets logged so it can be made accessible on request.
Frequently Asked Questions
Does the HHS Section 504 rule require an accessibility audit?
The rule does not name an audit as a required step, but conforming to WCAG 2.1 AA is the obligation. The only reliable way to verify conformance is a manual evaluation conducted by qualified auditors against each success criterion. A scan alone flags approximately 25% of issues and cannot determine conformance. Recipients serious about meeting the standard work through a structured WCAG evaluation.
What is the compliance date for the HHS Section 504 web rule?
Compliance dates depend on recipient size, mirroring the staggered approach used for the ADA Title II rule. Recipients should confirm the date that applies to their organization based on the published rule and their classification.
Does archived content lose its exception if we update it?
Yes. The archived content exception requires the material to remain unchanged. Any edit removes the exception, and the updated content must conform to WCAG 2.1 AA.
Are preexisting PDFs always exempt?
No. A PDF posted before the compliance date is only exempt if it is not currently used to apply for, access, or participate in a recipient’s programs, services, or activities. Forms, applications, and active service documents do not qualify regardless of when they were posted.
Do social media platform accessibility issues count against the recipient?
The recipient is responsible for the content they post. Platform-level accessibility issues belong to the platform. Captions, alt text, and contrast in the recipient’s posts are the recipient’s responsibility for any post on or after the compliance date.
Each exception is narrower than it first appears. Reading the rule carefully, mapping content against each category, and confirming conformance for everything else is the path that holds up.
Contact Accessible.org for help scoping a Section 504 web accessibility project.
