On this page · 11 sections
- The dates and numbers that matter
- Who is a recipient, and which date is yours
- What the rule covers in a provider's digital estate
- How the five exceptions apply to medical records and forms
- The patient journeys to test first
- Vendor contracts: portals, telehealth and payment tools
- A 25-week plan to 11 May 2027
- Worked cost example: a 250-bed community hospital
- What could still change
- How eCorpIT can help
- References
Summary. Recipients of HHS financial assistance with 15 or more employees must make their web content and mobile apps meet WCAG 2.1 Level A and AA from 11 May 2027; recipients with fewer than 15 employees have until 10 May 2028. An interim final rule published on 11 May 2026, effective from 7 May 2026, pushed each deadline back a year without changing the standard. Content provided through contractual or licensing arrangements counts, so vendor-hosted portals and scheduling, bill-pay and telehealth tools are in scope; kiosks have no technical standard. From 13 November 2026, 179 days remain to Tuesday 11 May 2027. HHS may propose changes but otherwise expects to enforce that date. The eCFR, current to 10 November 2026, shows the 2027 and 2028 dates and we found no further delay, but a pending lawsuit by the National Federation of the Blind asks a federal court to vacate the extension.
About this article. For compliance, digital and IT leads at US healthcare providers and their vendors. On 13 November 2026 we checked every date, section and figure against Federal Register texts, the eCFR, HHS and Department of Justice (DOJ) pages, W3C, WebAIM and ITI; HHS pages that refuse automated requests were read through named Internet Archive copies. This is general information, not legal advice: whether your organisation is a recipient, and which date applies, is a question for your counsel. No vendor paid for inclusion. Researched with AI assistance and reviewed by our editorial team.
The dates and numbers that matter
The table summarises the current rule text and the interim final rule.
| Item | What the rule says now | Where it lives |
|---|---|---|
| Recipients with 15 or more employees | WCAG 2.1 A and AA from 11 May 2027 (was 11 May 2026) | 45 CFR 84.84(b)(1) |
| Recipients with fewer than 15 employees | From 10 May 2028 (was 10 May 2027) | 45 CFR 84.84(b)(2) |
| Standard | Level A and AA success criteria and conformance requirements of WCAG 2.1 | 45 CFR 84.84(b) |
| Scope | Web content and mobile apps provided directly or through contractual, licensing or other arrangements | 45 CFR 84.84(a) |
| Kiosks | No exclusion or discrimination in programmes provided through kiosks; no technical standard | 45 CFR 84.83 |
| Exceptions | Five: archived content, preexisting documents, third-party posts, individualised secured documents, preexisting social media posts | 45 CFR 84.85 |
| Defences | Fundamental alteration or undue burden, decided by the recipient's head or a designee in writing | 45 CFR 84.88 |
Comments closed on 6 July 2026; eCFR shows section 84.84 last changed on 11 May 2026. HHS's fact sheet on web, mobile and kiosk duties (archived 11 May 2026) still gives the original dates, and HHS's Section 504 page still linked it on 29 October 2026, so do not take dates from it.
HHS gave two reasons: many recipients, especially local governments and smaller ones, would miss the original dates, and many small governments, federally qualified health centres (FQHCs) and others could now persuasively claim the fundamental alteration or undue burden defences it had expected to be rare. The rule followed DOJ's one-year delay of 20 April 2026 for ADA Title II, covered in our ADA Title II guide for state and local governments.
HHS still rejected a virtual mental health provider's claim that the rule brings no material benefit: an inaccessible telehealth site or app, it said, denies a disabled patient care paid for with federal money.
Who is a recipient, and which date is yours
Part 84 applies to programmes and activities receiving HHS financial assistance. HHS's fact sheet lists doctors, dentists, hospitals, clinics and other providers, child welfare agencies, medical and nursing schools, and childcare and social service providers, and says funds from any of the more than 100 programmes HHS runs, including Medicare, Medicaid, Head Start and TANF, bring an entity in. Whether a given payment stream makes you a recipient is a legal question; get counsel's answer in writing.
The date turns on headcount. HHS's own example: a clinic with 15 employees that books vaccination appointments online must make that scheduling content conform from the earlier date, while a clinic with 14 employees gets the later one. HHS's 2024 analysis counted 453,084 recipients likely to bear web and app costs, including 3,044 hospital firms, and described the 339,789 physician, dentist and other practitioner offices among them as predominantly small firms with fewer than 15 employees.
| Organisation | Typical status | Your date |
|---|---|---|
| Hospital or health system taking Medicare or Medicaid | Recipient, 15 or more employees | 11 May 2027 |
| FQHC with HHS grants | Recipient; check headcount | 11 May 2027 at 15 or more employees |
| Independent practice with fewer than 15 employees | Recipient if it receives HHS funds | 10 May 2028 |
| County or city hospital, hospital district or public health department | Recipient and ADA Title II public entity | The earlier of the two rules' dates |
| Digital health vendor selling to providers | Usually not a recipient itself | Your customers' dates, through contracts |
Public hospitals carry both rules. Under Title II, governments of 50,000 or more people must comply from 26 April 2027, 15 days before the Section 504 date; smaller governments and special district governments have until 26 April 2028. HHS's analysis notes that DOJ's special-district count includes hospital and health districts. For a hospital district, or a small town's clinic with 15 or more employees, Section 504 therefore arrives almost a year before Title II.
What the rule covers in a provider's digital estate
Scope reaches systems providers do not build: a licensed EHR portal, a scheduling widget, a payment page, a telehealth platform and a white-label app are all made available through contractual, licensing or other arrangements. The third-party exception covers posts by members of the public, not content placed under a contract; HHS's fact sheet names an online fee payment site as content that stays in scope.
DOJ's first-steps guide uses a public hospital's portal as a Title II example: the portal and its HTML must meet WCAG 2.1 AA, PDFs about one patient are exempt, and the hospital must still give that patient the content in a usable format, such as large print. HHS's fact sheet makes the same point for Section 504, citing medical files supplied in an accessible format on request.
Kiosks are handled differently. Section 84.83 bars excluding people with disabilities from programmes delivered through kiosks but sets no WCAG-style standard, and the rule defines kiosks as self-service machines patients use to check in, give information or have vital signs taken. HHS's fact sheet says a recipient can meet the duty with a procedure that lets someone who cannot use the kiosk register directly with staff at the main desk. Staff must know that alternative and offer it without a longer wait.
How the five exceptions apply to medical records and forms
Applied to healthcare content, the section 84.85 exceptions look like this.
| Exception | Exempt healthcare example | Not exempt |
|---|---|---|
| Individualised, secured documents | A PDF lab report, statement or after-visit summary for one patient, inside the portal | The portal's HTML pages, menus and messaging; a PDF notice sent to all patients |
| Preexisting conventional documents | A patient education PDF posted before your compliance date | An intake or consent PDF patients still complete, whenever it was posted |
| Third-party content | Patient reviews or comments on your pages | Vendor scheduling, payment and telehealth tools you place on your site |
| Archived web content | An old newsletter in a marked archive, unchanged | Current visiting rules filed under an archive heading |
| Preexisting social media | Posts made before your compliance date | Posts made after it |
Two rules cut across the table. First, intake packets are the commonest trap: a PDF patients complete is currently used to take part in care, so the preexisting-document exception does not apply. Second, the cut-off dates moved with the deadline. The archive, preexisting-document and social media exceptions are tied to the date the recipient must comply with section 84.84, which is now 11 May 2027 or 10 May 2028, not the 2026 and 2027 dates the fact sheet prints. That is our reading of the text; confirm it with counsel.
The patient journeys to test first
WCAG 2.1 added 17 success criteria to WCAG 2.0, 12 of them at Level A or AA. Several matter in clinical apps: autofill-ready personal-data fields (1.3.5), reflow at 320 CSS pixels (1.4.10), 3:1 contrast for chart lines and borders (1.4.11), single-pointer alternatives to pinch and swipe (2.5.1), labels that match speech input (2.5.3), and status messages such as a booking confirmation announced without moving focus (4.1.3).
| Patient journey | Where it usually breaks | Who owns the code |
|---|---|---|
| Find a doctor or location | Map-only results, filters that need a mouse, low contrast | Website team or CMS vendor |
| Book an appointment | Date pickers and time slots a screen reader cannot read; no confirmation announced | Scheduling vendor |
| Sign in and verify identity | Session time limits, CAPTCHA, unlabelled one-time code fields | EHR vendor and identity provider |
| View results and messages | Charts with no text alternative, low-contrast trend lines | EHR vendor |
| Complete intake and consent | Untagged PDF forms, missing labels, unclear error messages | Provider |
| Pay a bill | Payment frames with unlabelled fields and errors | Payment vendor |
| Join a telehealth visit | Join, mute and camera controls without accessible names | Telehealth vendor |
| Refill a prescription | Gesture-only actions in the app | App vendor or in-house team |
| Check in at a kiosk | Touch-only screens with no audio | Kiosk vendor and front desk |
Test each journey five ways: keyboard only; a desktop screen reader such as NVDA or JAWS; VoiceOver on iOS and TalkBack on Android; 400% zoom with text spacing overrides; and a contrast check. WebAIM, maker of the WAVE checker, warns that a clean automated scan does not prove a page accessible. Its February 2026 scan of one million home pages found detectable WCAG failures on 95.9% of them, and the Health and Fitness category averaged 54.4 detected errors per home page.
On telehealth, the platform's controls must work by keyboard and screen reader, because the app is in scope, while interpreters and captioning for the consultation fall under effective communication duties that apply now.
WCAG 2.2 became a W3C Recommendation on 5 October 2023. It adds 9 success criteria, including accessible authentication and a 24 by 24 CSS pixel minimum target size, and removes 4.1.1 Parsing as obsolete. The rule names 2.1. Building sign-in to 2.2's authentication criterion suits an older patient population, but report against 2.1; our WCAG 2.2 audit guide covers the newer criteria.
Vendor contracts: portals, telehealth and payment tools
Most patient-facing code belongs to vendors, but the obligation sits with the recipient. Treat accessibility like the business associate agreement: a contract term backed by evidence, reviewed before renewal.
Ask each vendor for an Accessibility Conformance Report on ITI's VPAT 2.5Rev template (April 2025) in the WCAG or INT edition, which cover WCAG 2.0, 2.1 and 2.2; the 508 edition carries WCAG 2.0 only, missing the 12 Level A and AA criteria 2.1 added. ITI says there is no VPAT certification and that it does not review or approve reports, so test the vendor's main journeys yourself.
DOJ's first-steps guide, published in January 2025 and revised after the 2026 extension, lists contract practices that suit hospitals: accessibility details before signing, a warranty of conformance with standards and laws, no disclaimer of it, indemnity for breach, and testing and publishing results on vendor products.
| If the vendor | Then the provider should |
|---|---|
| Hosts the portal and controls its code | Get a WCAG-edition report and a dated roadmap; test your configured instance, since branding and custom content can add failures |
| Lets you configure templates, colours and content | Fix your configuration yourself; vendor conformance claims do not cover your changes |
| Supplies a kiosk with no accessible mode | Set up a staffed alternative now and add accessible features at the next hardware refresh |
| Cannot fix a component for a technical or legal reason | Provide a conforming alternate version and document the reason |
| Says a fix is too expensive for you | Note that the undue burden defence needs a written decision by your head or a designee, weighing all resources |
A 25-week plan to 11 May 2027
Monday 16 November 2026 to Friday 7 May 2027 is 25 weeks, leaving a short buffer before the deadline.
| Weeks | Dates | Work |
|---|---|---|
| 1 to 2 | 16 to 27 Nov | Confirm recipient status and headcount in writing; inventory websites, portal, apps, kiosks, PDF forms, videos and vendors; name an owner |
| 3 to 5 | 30 Nov to 18 Dec | Automated scans of every site; Xcode Accessibility Inspector and Android Accessibility Scanner on the apps; request reports and roadmaps from vendors |
| 6 to 11 | 21 Dec to 29 Jan | Manual audit of the 9 patient journeys above, including vendor-run steps |
| 6 to 21 | 21 Dec to 9 Apr | Fix shared components, then templates and forms; convert intake PDFs to accessible HTML; submit the last app release by early April |
| 18 to 23 | 15 Mar to 23 Apr | Verify vendor fixes in your own configured environment; amend contracts at renewal |
| 23 to 25 | 19 Apr to 7 May | Regression testing, accessibility statement and feedback route, staff training on kiosk alternatives and accessible-format requests |
Schedule app work early: web fixes go live on deploy, but patients keep an old build until store review clears and they update. Check clinical release freezes and EHR upgrade windows in week 1. If you also own a health plan, CMS-0057-F API work due primarily from 1 January 2027 competes for the same engineers; see our CMS-0057-F build plan.
Worked cost example: a 250-bed community hospital
HHS's 2024 regulatory impact analysis priced web accessibility from service prices that unnamed vendors publicly quoted, in 2023 dollars: about $440 a year for a small practice website, about $1,500 for a medium site and about $3,500 for a large one. It used $2,500 a year for each of the 113,295 recipients outside practitioner offices, which it described as typically larger. HHS says the one-year delay cuts the web and app section's annualised costs by $114.3 million and its benefits by $204.6 million (7% discount rate, 2022 dollars).
Those are ongoing subscriptions, not a first-round fix of a portal, an app and a stack of forms. The bottom-up example below uses the loaded rate DOJ applied in its Title II analysis, $109.80 an hour (the 2022 median wage of $54.90 for software and web developers, programmers and testers, doubled for benefits and overhead), and DOJ's upper-bound captioning price of $15 a minute of video. The hours are our planning assumptions, not quotes.
| Work item | Assumption | Hours or units | Cost |
|---|---|---|---|
| Inventory and automated scans | 2 websites, portal, app, 2 kiosks | 80 h | $8,784 |
| Manual audit of patient journeys | 9 journeys, 14 web and app runs at 16 h | 224 h | $24,595 |
| Website components and templates | Navigation, forms, find-a-doctor, location pages | 480 h | $52,704 |
| Portal configuration and custom content | Branding, colours, custom pages, messages | 240 h | $26,352 |
| In-house scheduling and bill-pay screens | Two flows | 320 h | $35,136 |
| Intake and consent PDFs rebuilt | 80 forms at 3 h | 240 h | $26,352 |
| Mobile app fixes and two releases | iOS and Android | 360 h | $39,528 |
| Kiosk alternative procedure and signage | Front desk process | 40 h | $4,392 |
| Regression, statement, staff training | All channels | 160 h | $17,568 |
| Captions for patient education video | 600 minutes at $15 | 600 min | $9,000 |
| Total | 2,144 h | $244,411 |
The arithmetic: 2,144 hours at $109.80 is $235,411, plus $9,000 of captioning, for $244,411. Against HHS's $3,500 a year for a large site, that is about 70 years of the subscription figure ($244,411 divided by $3,500 is 69.8), so the analysis averages are not a remediation budget. It excludes work inside vendor products, which belongs with the vendor under contract. Swap in your own rate; the hours hold whoever does the work.
What could still change
Dates could move either way. HHS will consider proposing changes to the 2024 rule, including the web and app requirements, and otherwise expects to enforce the new date. Its Unified Agenda entry for RIN 0945-AA30 says it is weighing a proposal to make parts of the rule less burdensome, and lists only the interim final rule in its timetable. We found no such proposal or further extension in the Federal Register as of 13 November 2026. The only later change to part 84, a final rule of 3 November 2026 effective 4 January 2027, amends the definition of disability in section 84.4(g) and leaves the web and app sections untouched.
In the other direction, the National Federation of the Blind sued DOJ and HHS on 21 May 2026 (National Federation of the Blind v. Department of Justice, D. Md., No. 1:26-cv-02007). As reported by Seyfarth Shaw, it argues the agencies had no good cause to skip notice and comment, and asks the court to vacate both extensions and enforce the original deadlines. The docket shows an NFB summary judgment motion of 28 September 2026 and a government request on 12 November 2026 for more time to respond, with no ruling yet. An NFB win could revive the 11 May 2026 date for large recipients, which has already passed.
HHS issued the delay without prior notice and comment, relying on two Administrative Procedure Act exceptions, so a further change could also arrive quickly. Treat 11 May 2027 as the latest safe date, not a target to wait for, and watch the Federal Register and the court. Meanwhile the duties to make reasonable modifications under 45 CFR 84.68(b)(7) and to communicate effectively apply today; HHS expects, for example, a state Medicaid enrolment site to be modified so eligible disabled residents can apply.
How eCorpIT can help
eCorpIT is a Gurugram-based technology organisation, founded in 2021, assessed at CMMI Level 5 and MSME certified, with senior-led engineering teams working across AWS, Microsoft and Google platforms. Our accessibility audit and remediation team tests and fixes provider websites, portal configurations, scheduling and bill-pay flows, iOS and Android apps and PDF intake packets against WCAG 2.1 AA, including the vendor-run steps your contracts depend on. Talk to us at /contact-us/.
Last updated: 13 November 2026.
