Section 504 Website Accessibility: The HHS Web Rule, Its New 2027 Deadline and What to Fix First

Your website is where a daughter fills in the referral form at midnight, where a caregiver applies for a job, and where a patient finds your notice of privacy practices. If any of those steps cannot be completed with a keyboard or a screen reader, someone with a disability cannot use your program the way everyone else can.

HHS put that principle into a specific rule in 2024 and then moved its deadline in 2026. This guide covers what the Section 504 website accessibility rule requires, the current compliance dates, what it covers and excludes, and a practical check you can run against WCAG 2.1 AA this month.

What the Section 504 Website Accessibility Rule Requires

The requirement is at 45 CFR 84.84. A recipient of HHS federal financial assistance must make sure that web content and mobile apps it provides or makes available, directly or through contractual, licensing or other arrangements, are readily accessible to and usable by people with disabilities. The technical standard is WCAG 2.1, Level A and Level AA success criteria and conformance requirements.

The original rule, published May 9, 2024, set compliance dates of May 11, 2026 for recipients with 15 or more employees and May 10, 2027 for smaller recipients. On May 11, 2026, HHS published an interim final rule extending those dates. The current dates are:

• 15 or more employees: May 11, 2027
• Fewer than 15 employees: May 10, 2028

The interim final rule took effect May 7, 2026, and HHS took comments through July 6, 2026. Because it is an interim rule, it could be revised again. Check the regulation text before you plan around any date, including these.

Is Your Agency a Recipient?

The rule applies to recipients, which 45 CFR 84.10 defines as any public or private agency, organization or person to which federal financial assistance is extended directly or through another recipient. The same section defines federal financial assistance broadly, but excludes contracts of insurance or guaranty.

Whether a particular agency's Medicare or Medicaid revenue makes it a recipient is a legal question with real nuance, and it is one to put to counsel rather than settle from a blog post. Two practical points while you wait for that answer. First, the ADA applies separately: the Department of Justice's web guidance for businesses open to the public says inaccessible websites can limit access to a public accommodation's goods and services, and points to WCAG as helpful guidance even though DOJ has not mandated a standard for those businesses. Second, the work to meet WCAG 2.1 AA is the same whichever law applies.

What Is Covered and What Is Excepted

Covered web content is broad: text, images, video, controls and conventional electronic documents such as PDFs, on your site and in your apps, including what vendors run for you. For a home care agency that usually means the public site, referral and inquiry forms, the careers page and online application, any client or family portal, online bill pay, and posted notices and forms.

45 CFR 84.85 lists exceptions:

• Archived web content that meets the rule's definition: created before the compliance date, kept only for reference or recordkeeping, not altered since, and stored in a clearly marked archive area.
• Conventional electronic documents posted before the compliance date, unless they are currently used to apply for, gain access to or participate in your programs.
• Content posted by a third party, unless the third party posts under a contract or arrangement with you.
• Individualized, password-protected documents about a specific person, such as a statement in a portal.
• Social media posts made before the compliance date.

Two further provisions limit the duty. Under 84.88, if compliance would cause a fundamental alteration or undue financial and administrative burden, the recipient bears the burden of proving it, and the decision must be made by the head of the recipient or a designee with a written statement of reasons. Under 84.89, noncompliance with a minimal impact on access can be treated as meeting the requirement, but only if people with disabilities can still get the same information, interactions and transactions with substantially equivalent timeliness, privacy, independence and ease of use. Neither is a plan. Both are defenses you would have to prove.

The Pages to Fix First

Rank pages by whether a person needs them to get care, get a job or exercise a right:

1. 1.Referral, inquiry and contact forms. These are how people enter your program.
2. 2.Careers page and job application. The pre-May 2027 PDF application is not excepted if people still use it to apply.
3. 3.Patient rights, privacy notices and nondiscrimination notices.
4. 4.Client or family portal login and core tasks, including bill pay.
5. 5.Service area, services and phone numbers.
6. 6.Everything else, starting with your most visited pages.

A WCAG 2.1 AA Check You Can Run in an Afternoon

These success criteria come straight from WCAG 2.1 and cover the failures most likely on a small agency site. Test the six priority pages above against each.

• 1.1.1 Non-text Content (A): every image that conveys information has a text alternative serving the same purpose. Check logos, photos of staff and icons used as buttons.
• 1.2.2 Captions, Prerecorded (A): every video with audio has captions.
• 1.3.1 Info and Relationships (A): headings, lists and form labels are real structure, not just bold text.
• 1.4.3 Contrast, Minimum (AA): text contrast of at least 4.5:1, or 3:1 for large text. Light grey text on white usually fails.
• 1.4.10 Reflow (AA): content works at a width equivalent to 320 CSS pixels without scrolling in two directions. Test by zooming the browser to 400%.
• 1.4.11 Non-text Contrast (AA): form borders, focus outlines and icons reach 3:1 against their background.
• 2.1.1 Keyboard (A): everything works with a keyboard alone. Put the mouse away and try to submit the referral form.
• 2.4.4 Link Purpose (A): link text makes sense, so "Download the client rights notice" rather than "click here".
• 2.4.7 Focus Visible (AA): you can always see where keyboard focus is.
• 3.1.1 Language of Page (A): the page declares its language, which matters if you publish Spanish pages too.
• 3.3.1 Error Identification and 3.3.2 Labels or Instructions (A): each field has a label, and errors are described in text, not just by turning a border red.
• 4.1.2 Name, Role, Value (A): custom menus, accordions and chat widgets expose their names and states to assistive technology.

Record each failure with the page, the criterion and a screenshot. That list becomes the work order.

Contracts Are Part of Compliance

The rule reaches content you provide "directly or through contractual, licensing, or other arrangements." If a vendor hosts your website, application portal, scheduling page or family portal, the vendor's accessibility is your obligation. Add three items to every new or renewing contract: a commitment to WCAG 2.1 AA conformance, a written accessibility conformance report for the product, and a timeline for fixing reported defects.

A Timeline to May 11, 2027

• October to December 2026: inventory pages, documents and apps; run the check above on priority pages; ask vendors for conformance reports.
• January to March 2027: fix priority pages; convert or replace in-use PDFs, starting with the job application and intake forms.
• April 2027: retest with keyboard, zoom and a screen reader; publish an accessibility statement with a contact for reporting barriers.
• May 11, 2027: compliance date for recipients with 15 or more employees. Keep a record of what you tested and when.

Agencies with fewer than 15 employees have until May 10, 2028 under the current text, but the same work order applies, and a smaller site is usually faster to fix. Whatever your size, assign one owner. Accessibility work stalls when it belongs to "marketing" and "the website vendor" at the same time. The owner keeps the failure list, chases vendor fixes, and retests each page after every redesign or new form, because a site that passed in April can fail again in June when someone adds an inaccessible chat widget.

Building It In

Accessibility is cheaper to build into a site than to retrofit. Nuraflow is being designed with an agency website builder whose themes and forms connect to intake and recruiting, and the trust page describes how the platform approaches security and privacy. Treat any vendor's accessibility claims, ours included, as something to verify against the checklist above.

This article is general information, not legal advice. Whether your agency is a recipient under Section 504, and how the ADA applies to you, are questions for counsel.