HHS Extends Section 504 Healthcare Deadline to May 11, 2027: What Changed, What Didn't, and Why Your Hospital Still Cannot Wait

Here are the old and new deadlines side by side.

The 15-employee threshold determines which deadline applies to you, not whether the rule covers you at all. A six-person primary care practice that accepts Medicaid is still subject to Section 504 — it simply has until May 10, 2028 instead of May 11, 2027. Receiving any federal HHS dollars (Medicare, Medicaid, Title X family planning, Ryan White HIV/AIDS, SAMHSA grants, HRSA grants, NIH research support) triggers Section 504 coverage.

1. WCAG 2.1 Level AA is still the standard. When the new deadline arrives, OCR will benchmark hospital and clinic websites against WCAG 2.1 Level AA — the same standard the 2024 rule originally adopted. Nothing in the IFR substitutes a different technical benchmark, relaxes the success criteria, or carves out specific WCAG provisions.

2. Section 504's underlying nondiscrimination obligation continues. Section 504 of the Rehabilitation Act has prohibited disability discrimination by recipients of federal financial assistance since 1973. The 2024 final rule clarified that this obligation includes digital accessibility, and that clarification has been in effect since the rule's general effective date of July 8, 2024. The May 11, 2026 (now 2027) date is when WCAG 2.1 AA becomes the *specific technical benchmark* OCR applies — not when OCR begins enforcing Section 504.

3. Private ADA Title III lawsuits did not pause. The vast majority of healthcare accessibility lawsuits are brought under ADA Title III (places of public accommodation), not under Section 504. The HHS extension has no effect on ADA Title III. Hospital systems, patient portals, telehealth platforms, and provider websites continue to face screen-reader-user lawsuits, demand letters, and Unruh Civil Rights Act claims in California. Litigation tracker data shows healthcare entities have been an accelerating share of website accessibility defendants for two years running.

4. State accessibility laws continue. California Unruh ($4,000 per violation, no notice required), New York General Business Law §349, Colorado HB21-1110, Illinois Information Technology Accessibility Act, and parallel statutes in roughly a dozen other states all remain in effect. None of them defer to federal compliance dates.

5. HHS OCR investigations continue. OCR can still open investigations and compliance reviews against HHS-funded recipients for digital accessibility complaints filed under Section 504's general nondiscrimination provisions. What changes on May 11, 2027 is the specific technical standard OCR will use as the bright-line benchmark — but the agency has not stopped accepting or processing complaints in the interim.

Second, HHS pointed to alignment with the DOJ's parallel Title II rulemaking. The DOJ extended its Title II web accessibility deadlines by one year on April 20, 2026 (see our DOJ Title II extension breakdown). The HHS IFR explicitly notes that the extension brings Section 504 timelines into alignment with the DOJ's Title II timelines — a consistency argument for entities that are covered by both regimes (state public hospitals, university medical centers, county health departments).

Public comment is open through July 6, 2026. HHS OCR invited input on three specific questions: the impact of the rule on recipients, the accuracy of HHS's cost and benefit estimates, and whether further rulemaking is warranted to reduce burdens on small recipients. That third question is the one to watch. If the small-recipient comments come in heavy, a follow-on rule could carve out additional exemptions for sub-threshold entities or extend the small-recipient deadline beyond May 2028. None of that is on the table for organizations with 15 or more employees — your deadline is May 11, 2027 and the comment period will not move it.

The point: three of four enforcement channels were not affected by the May 7 extension. A hospital that puts its accessibility work on ice for 12 months is gambling on the one channel that did move, while ignoring the three that did not.

Months 1–2 (May–June 2026): Establish a baseline you can defend. Run an automated accessibility scan against your public hospital website, your patient portal login and post-login flows, your appointment-scheduling forms, your telehealth platform's patient-facing pages, and any kiosk web view that appears in waiting rooms. Capture the date-stamped report. This is the documentation that proves the work was already underway when the deadline existed at May 11, 2026 — useful in both OCR and private litigation contexts.

Months 3–4 (July–August 2026): Triage by enforcement exposure, not by WCAG criterion. The accessibility failures most likely to generate a lawsuit are missing alt text on actionable images, unlabeled form fields, keyboard traps, insufficient color contrast, and broken focus indicators. These are also the failures plaintiff attorneys can document with a screen reader in under 10 minutes. Fix them first — not because they are the most severe under WCAG, but because they are the most legally visible.

Months 5–8 (September–December 2026): Fix the things that fail in production, not just in test. Run accessibility checks against actual patient flows, with actual screen-reader users where possible. Synthetic test environments routinely miss the issues that real assistive-technology users hit immediately — date pickers that trap focus, modal dialogs that confuse screen readers, error messages announced incorrectly. The expensive private-suit damages come from the production failures, not the test failures.

Months 9–11 (January–March 2027): Document a written digital accessibility policy. Section 504 requires recipients to maintain procedures for ensuring digital access. A written policy that references WCAG 2.1 AA, identifies responsible personnel, defines the procurement standard for new third-party tools, and describes the complaint-handling process is the artifact OCR will ask for first. Get it written, signed, and dated well before the new deadline.

Month 12 (April–May 2027): Final WCAG 2.1 AA audit and remediation push. A third-party audit completed 30–60 days before May 11, 2027 produces a finding-by-finding remediation log. That log is the most useful single piece of evidence a hospital can show OCR or a plaintiff attorney — it converts a question of fault into a question of progress, which is a much better question to argue.

Pitfall 2 — Ignoring third-party platforms. Patient portals, telehealth platforms, scheduling widgets, payment processors, and electronic health record patient-facing portals are typically procured from third-party vendors. Section 504 does not let a covered recipient outsource its accessibility obligation to a vendor — the recipient remains responsible for the accessibility of every digital service it offers patients, regardless of whose code renders it. Use the 12-month window to write WCAG 2.1 AA conformance requirements into your vendor contracts and your procurement intake process.

Pitfall 3 — Confusing the WCAG benchmark deadline with the underlying obligation. Hospital counsel and IT leadership routinely conflate "the deadline" with "when we need to start." The WCAG 2.1 AA benchmark deadline is May 11, 2027. The Section 504 nondiscrimination obligation that makes patient portals legally required to be usable by people with disabilities has been in effect since July 8, 2024. OCR can investigate complaints under the underlying obligation today — and the resolution agreement OCR demands will require remediation regardless of the specific benchmark deadline.