HHS Section 504 May 11, 2026 Deadline: Healthcare Web Accessibility Requirements (And Why the DOJ Extension Doesn't Help)

It covers any facility, program, or activity with 15 or more employees that receives HHS funding through grants, contracts, or reimbursement programs. In practice that includes:

• Hospitals and health systems that bill Medicare or Medicaid
• Federally qualified health centers (FQHCs)
• Community mental health centers
• University medical centers and academic medical centers
• State and local public health departments
• Tribal health programs and IHS service units
• Long-term care facilities receiving Medicare/Medicaid
• Behavioral health and substance use providers receiving SAMHSA funding
• Maternal and child health programs (Title V)
• Ryan White HIV/AIDS Program grantees
• Research institutions with NIH grants that operate patient-facing digital services
• Any private practice that participates in Medicare or Medicaid (the threshold is the 15-employee count, not the size of the funding stream)

The 15-employee threshold is intentionally low. HHS designed the rule to cover the substantial majority of healthcare delivery in the United States. If your entity bills any federal healthcare program and employs 15 or more people, assume you are covered until your counsel tells you otherwise.

The kiosk provision is the surprise for many organizations. Hospitals that have spent the past two years remediating websites often have not audited their physical kiosk fleet. Each kiosk model needs to be evaluated against the standard, and replacements have to be specified for accessibility from procurement onward.

The same WCAG criteria the DOJ uses applies here. Color contrast 4.5:1, alt text on every meaningful image, keyboard navigation throughout, programmatically associated form labels, no keyboard traps, captions on video, accessible PDFs, ARIA used correctly. If you have already scanned for ADA Title II compliance, that work substantially carries over — the standard is the same.

The DOJ has no authority over the HHS rule. The April 20 IFR was issued under the DOJ's rulemaking power for Title II. HHS issued a separate final rule under Section 504, and only HHS can amend or extend it. As of today there is no public signal that HHS intends to follow the DOJ's lead.

For dual-covered entities, the earliest deadline controls. Many organizations are subject to both rules — a county hospital, a public university medical center, a state-run public health system. For those entities, the HHS May 11, 2026 deadline applies first, and the Title II April 26, 2027 deadline applies as a second checkpoint. Compliance to the HHS standard generally satisfies Title II as well, since the technical standard is identical.

Layer one: HHS Office for Civil Rights. OCR can investigate complaints, conduct compliance reviews, require corrective action plans, and ultimately suspend or terminate federal financial assistance. For a Medicare-participating hospital, that is an existential threat — not a fine. Most enforcement begins with a complaint from a patient or advocate, triggers a fact-finding letter, and progresses through voluntary compliance before reaching termination of funding.

Layer two: private ADA lawsuits. Section 504 violations also create a private right of action under the ADA. Plaintiff attorneys do not need to wait for OCR. They can file directly in federal court, citing the same WCAG 2.1 AA standard. In 2025, 3,117 federal web accessibility lawsuits were filed — a 27% increase over 2024. Healthcare organizations are an increasingly prominent share of those defendants because patient portals are obvious, public-facing, and easy for plaintiffs to test.

Layer three (de facto): state laws. California Unruh statutory damages of $4,000 per violation, New York Human Rights Law, Colorado HB 21-1110, and dozens of other state accessibility statutes apply independent of any federal rule. A California hospital can be sued under Unruh whether HHS extends the deadline or not.

The risk profile is asymmetric. A small Section 504 violation that triggers an OCR complaint may take months to resolve and cost legal time. A successful private ADA lawsuit can include attorney's fees, statutory damages, and remediation injunctions — typical settlements range from $20K to $100K, with outliers (Fashion Nova $5.15M, the largest of 2025) reaching far higher. DOJ has been intervening in proposed settlements when they look inadequate, which signals the federal government still treats these cases seriously even while extending its own deadline.

Day 1-3: Inventory and baseline scan. List every patient-facing digital surface: main hospital site, patient portal, telehealth platform, mobile apps (iOS + Android), check-in kiosks (every model in service), payment systems, all third-party embedded tools (scheduling widgets, payment iframes, chatbots). Run a WCAG 2.1 AA scan against each website and patient-facing portal. Save the dated reports.

Day 4-7: Triage by severity and reach. Rank findings by severity (per WCAG) and by reach (how many patients hit that page or function per month). Color contrast on a billing page used by 50,000 patients/month outranks alt text on an internal staff intranet page. Focus the next two weeks on the high-severity / high-reach intersection.

Day 8-11: Quick-win remediation. Fix the patterns that recur sitewide — add alt text to the hero images, fix the color contrast tokens in the design system, add ARIA labels to icon-only buttons, label the form fields without <label> elements. These changes can ship in the next deploy and immediately improve the audit posture across hundreds of pages.

Day 12-14: Documentation pack. Save the dated baseline scan, the dated remediation log, the dated re-scan showing progress, and a written remediation plan with milestones. Good-faith compliance documentation is what reduces settlement exposure when (not if) a complaint comes in.

Throughout: kick off the structural work. A 14-day sprint is triage. The structural work — design system audit, accessibility regression testing, kiosk procurement standards, mobile app remediation, ongoing monitoring — has to start now and continue past May 11.

For dual-covered entities, the practical work is the same. A county hospital that has to meet HHS Section 504 by May 2026 and DOJ Title II by April 2027 should treat the May 2026 deadline as binding for both. The technical standard is identical, the audit work is shared, and arriving at WCAG 2.1 AA conformance for HHS automatically satisfies the Title II technical requirement.

Build accessibility into the design system, not a one-time project. Healthcare organizations that treated the original April 24, 2026 Title II deadline as a sprint are in much better shape today than those that deferred. The same lesson applies here: organizations that integrate accessibility into design systems, code review, procurement specs, and content workflows will not face this stress again at the 2027 and 2028 checkpoints. Those that triage May 11 and disengage will face it three more times.

• Patient portal third-party iframes. MyChart, Athena, and similar embedded portals are often treated as out-of-scope by hospital IT. They are not — if the patient experiences them on your domain, they are part of your covered surface.

• PDFs of forms, EOBs, and lab results. Healthcare generates enormous volumes of PDFs, most of them inaccessible. Forms that patients fill out, explanation-of-benefits documents, lab results delivered as PDFs — all need to meet PDF/UA or be offered in an equivalent accessible format.

• Telehealth video without captions. Live captions during synchronous telehealth visits are required when requested. Recorded telehealth, patient education videos, and on-demand content all need captions and transcripts.

• Appointment scheduling forms with custom date pickers. Custom date/time widgets are a frequent WCAG failure (keyboard inaccessible, screen reader inaccessible, no programmatic labels). Replace with native HTML inputs or accessible component libraries.

• Kiosk procurement without accessibility specs. New kiosk orders being placed in 2026 must specify accessibility in the RFP. Replacing a non-compliant kiosk fleet after May 11 is a multi-quarter capital expenditure — starting the procurement conversation now is critical.

• Symptom checkers and chatbots. AI-powered patient interaction tools are a fast-growing surface and a frequent compliance gap. They need to be keyboard-navigable, screen-reader-accessible, and the underlying conversation must work without color or motion cues.

• Provider directories and search. Find-a-doctor pages with custom map components, faceted search, and dynamic filtering are common Section 508 / WCAG failure points. They are also high-traffic, high-visibility — making them prime testing targets for plaintiffs.