If your practice receives financial assistance from HHS, such as Medicaid payments, your website and mobile apps must meet WCAG 2.1 Level AA under Section 504 by May 11, 2027 if you have 15 or more employees, or by May 10, 2028 if you have fewer. HHS pushed both dates back one year in an interim final rule that took effect on May 7, 2026; the technical standard itself didn't change.
For dental and medical practices in Fairfield County and Westchester that see HUSKY Health or New York Medicaid patients, the extra year is time to fix things properly rather than a reason to wait. This guide covers who is covered, what the standard means on a real practice site, the exceptions that don't help as much as they seem, and a 90-day plan. It's practical guidance, not legal advice.
Who does the Section 504 web rule cover?
The rule sits in subpart I of HHS's Section 504 regulation (45 CFR part 84), which applies to every program or activity that receives federal financial assistance from HHS. In a practice context, that clearly includes providers paid through Medicaid and the Children's Health Insurance Program. In Connecticut, that means HUSKY Health, whose A, B, C and D coverage groups include dental benefits administered through the Connecticut Dental Health Partnership.
Practices whose only federal money is Medicare Part B are a grayer area; some compliance guides treat them as likely covered, so get a legal opinion rather than assuming you're out. Remember too that the ADA already applies to private practices as businesses open to the public: the Department of Justice's March 2022 guidance says the ADA's requirements apply to goods and services offered on the web, even though it sets no specific technical standard for them.
The rule reaches further than your homepage. Section 84.84 covers web content and mobile apps a recipient provides or makes available "directly or through contractual, licensing, or other arrangements." A third-party booking widget, a patient portal or an app you license is your responsibility too.
What are the deadlines now, and how did they move in 2026?
HHS adopted the web and mobile requirements in a final rule on May 9, 2024. On May 11, 2026, it published an interim final rule (91 FR 25496), effective May 7, 2026, that moved both compliance dates back a year:
| Recipient size | Original date (2024 rule) | Current date (2026 interim final rule) |
|---|---|---|
| 15 or more employees | May 11, 2026 | May 11, 2027 |
| Fewer than 15 employees | May 10, 2027 | May 10, 2028 |
Why you shouldn't plan around another delay
An interim final rule takes effect immediately but invites public comment, and HHS did request comments on this one, so the dates could still change. The standard (WCAG 2.1 Level A and AA) and the exceptions stayed the same. The rule does allow a recipient to argue that full compliance would fundamentally alter a program or impose undue financial and administrative burdens, but under § 84.88 that decision must be made by the head of the organization, in writing, after considering all available resources, and you still have to do everything short of that burden.
What does WCAG 2.1 AA mean on a practice website?
WCAG 2.1 has dozens of success criteria, but practice websites fail the same handful again and again. These are the ones to check first:
| What to check | WCAG 2.1 criterion | Typical practice-site failure |
|---|---|---|
| Images have text alternatives | 1.1.1 Non-text Content | Team photos and before-and-after images with empty or file-name alt text |
| Videos have captions | 1.2.2 Captions (Prerecorded) | Welcome and procedure videos without captions |
| Text contrast is at least 4.5:1 | 1.4.3 Contrast (Minimum) | Light gray text or white text over photos |
| Pages work at 320 CSS pixels wide | 1.4.10 Reflow | Booking widgets that force sideways scrolling on phones |
| Everything works by keyboard | 2.1.1 Keyboard | Date pickers and menus that only respond to a mouse |
| Keyboard focus is visible | 2.4.7 Focus Visible | Outline removed by the theme's CSS |
| Form fields have labels and clear errors | 3.3.1 and 3.3.2 | Placeholder-only fields; errors shown only in red |
| Custom controls expose name and role | 4.1.2 Name, Role, Value | Icon-only buttons that screen readers announce as "button" |
PDFs, forms, portals and third-party widgets
Section 84.85 lists five exceptions: archived web content; conventional electronic documents such as PDFs posted before your compliance date; content posted by third parties, unless they post it under an arrangement with you; individualized, password-protected documents about a specific person, such as a patient's statement; and social media posts published before your compliance date.
Read the PDF exception carefully. It doesn't cover older documents that are "currently used to apply for, gain access to, or participate in" your programs or activities. A new-patient packet, a consent form or a financial policy that patients still download and fill in must be accessible, or replaced by an accessible online form. For widgets and portals, ask each vendor for an Accessibility Conformance Report (often called a VPAT) and a remediation timeline, and put accessibility in the contract.
Why accessibility overlays aren't compliance
Toolbar and overlay products promise instant compliance. Regulators disagree. The Department of Justice's guidance cautions that automated tools must be used carefully and that a clean automated report doesn't mean a site is accessible. In April 2025 the Federal Trade Commission finalized an order requiring accessiBe to pay $1 million over claims that its AI-powered widget could make any website WCAG-compliant, and barring it from making such claims without evidence.
The litigation climate is a New York story as much as a federal one. UsableNet's 2025 midyear report counted 2,019 digital accessibility lawsuit filings in the first half of 2025 and found New York leading state-court filings. Accessibility is a property of your code and content, so that's where the fix has to happen.
A 90-day remediation plan
Days 1–30: inventory and audit
List every page template, form, PDF, video, widget and app you provide, including those hosted by vendors. Run automated checks to catch the obvious issues, then test the key journeys by hand: find a dentist, book an appointment, complete intake, pay a bill. Use only a keyboard, then a screen reader, then a phone at high zoom.
Days 31–60: fix templates and forms
Fix issues at the template level so one change repairs every page: color contrast, focus styles, heading structure, form labels and error messages, and reflow on small screens. Caption videos and write real alt text. Replace in-use PDF forms with accessible web forms, or remediate the PDFs.
Days 61–90: vendors, documents and proof
Collect conformance reports from booking, portal and payment vendors and escalate gaps. Publish an accessibility statement with a way to report problems, train whoever edits the site to keep new content accessible, and keep dated records of the audit, fixes and vendor responses. Re-test after every redesign or new widget.
When a rebuild is cheaper than a repair
If the audit finds problems baked into an old theme or page builder, fixing them page by page can cost more than rebuilding on accessible components. Our dental practice website and medical practice website services rebuild on accessible components with WCAG 2.1 AA as the target, with business websites starting at $2,500 (web design) and patient-facing apps from $8,000 (mobile app development). Practices reviewing their site should also check forms and tracking against our guide to HIPAA-compliant forms and analytics for dental websites.
Frequently asked questions
What is the Section 504 website accessibility deadline now?
May 11, 2027 for recipients of HHS financial assistance with 15 or more employees, and May 10, 2028 for those with fewer than 15. HHS extended both dates by one year in an interim final rule effective May 7, 2026. The standard, WCAG 2.1 Level AA, didn't change.
Does Section 504 apply to a private dental or medical practice?
It applies if the practice receives federal financial assistance from HHS, which includes payments through Medicaid and CHIP, such as Connecticut's HUSKY Health or New York Medicaid. Practices whose only federal funding is Medicare Part B should get a legal opinion. Private practices are also subject to the ADA as businesses open to the public.
Are PDF forms exempt from the Section 504 web rule?
Only partly. PDFs posted before your compliance date are excepted, but not if patients still use them to apply for, gain access to or participate in your services. New-patient packets and consent forms that patients download and complete must be accessible or replaced with accessible web forms.
Will an accessibility widget or overlay make my practice website compliant?
No. The Department of Justice warns that automated tools can miss problems, and in 2025 the Federal Trade Commission ordered accessiBe to pay $1 million over claims that its AI widget could make any website WCAG-compliant. Compliance comes from fixing the site's code, content and third-party tools.
What's the difference between Section 504 and the ADA for websites?
Section 504 applies to programs that receive federal financial assistance, and HHS's rule sets a specific standard, WCAG 2.1 Level AA, with fixed deadlines. The ADA applies to businesses open to the public; the Department of Justice says it covers websites but hasn't set a technical standard for private businesses.
Use the extra year to fix it once
The 2026 extension gives practices until May 2027 or May 2028, depending on staff size, but the requirement is unchanged: WCAG 2.1 AA for every website, app, form and widget you provide. Inventory what you have, fix the templates and forms, hold vendors to the same standard and keep records.
