If your organization receives federal financial assistance from the Department of Health and Human Services (HHS), you are likely covered by the updated Section 504 of the Rehabilitation Act of 1973.
The HHS Final Rule, published May 9, 2024, requires covered entities to bring websites, mobile apps, patient portals, kiosks and other digital content into conformance with Web Content Accessibility Guidelines (WCAG) 2.1 Level AA. For organizations with 15 or more employees, they must be compliant by May 11, 2026. Those with fewer than 15 employees have until May 10, 2027, to comply.
This is not a distant regulatory horizon.
Healthcare organizations typically run six- to 12-month development and procurement cycles. Audits, remediation planning, vendor negotiations and staff training all take time. For organizations managing complex digital ecosystems like multiple patient-facing platforms, third-party integrations and legacy content, the sheer amount work required to reach full compliance is substantial.
Here is what your organization needs to start doing now, and in what order.
Step 1: Confirm Whether You Are Covered
The scope of HHS Section 504 is broader than many organizations assume.
Any entity receiving federal financial assistance from HHS, either directly or indirectly, is included. That covers hospitals, health systems, health plans, Medicare Advantage organizations, Medicaid managed care plans, clinical research institutions, digital health companies, pharmaceutical and biotech firms receiving federal research funding, community health centers and behavioral health providers.
The threshold for being included is incredibly low. A single Medicare or Medicaid payment is enough to trigger coverage.
If your organization has not yet confirmed its status, that determination needs to happen now. The 15-employee threshold governs your deadline, not whether the rule applies to you.
A small clinic with eight employees that bills Medicaid is subject to Section 504. It simply has until May 2027 rather than May 2026 to comply.
Do not mistake a later deadline for an exemption.
The rule’s reach also has implications for vendors and technology partners serving covered entities. If your customers receive federal financial assistance from HHS, they are accountable for the accessibility of digital tools they provide or make available through contractual, licensing or other arrangements. This means that your product’s accessibility posture directly affects their compliance.
Like digital health companies compelled to comply, software vendors and platform providers that cannot demonstrate WCAG 2.1 AA conformance risk losing or failing to win contracts with covered entities. Getting ahead of that conversation now is a competitive advantage.
Step 2: Inventory Your Digital Assets
Before you can audit for accessibility, you need a complete picture of everything that needs to be audited. This step is often underestimated, particularly in larger organizations where digital properties are spread across departments and legacy systems.
Your inventory should include:
- Public-facing websites and microsites
- Patient portals and online scheduling tools
- Mobile applications
- Telehealth platforms and video consultation interfaces
- Digital intake forms and consent documents
- PDFs, Word files and other downloadable documents in active use
- Self-service kiosks and check-in terminals
- Intranet resources available to staff with disabilities
- Third-party tools embedded in your platforms, including payment processors, EHR integrations and appointment reminders
One clarification worth noting on documents: pre-existing PDFs and conventional electronic documents that are archived and not currently used for your programs or activities may qualify for a limited exception under the rule.
However, if a legacy document is the one a patient uses to apply for services today, the exception does not apply. When in doubt, treat it as covered.
Step 3: Conduct a Human-Led Accessibility Audit
Once you have your inventory, the next step is a structured accessibility audit against WCAG 2.1 Level AA success criteria. This is where many organizations make a costly mistake: relying on automated scanning tools alone.
Automated tools are valuable. They can efficiently flag a predictable set of issues, such as missing alt text, insufficient color contrast and unlabeled form fields. For ease of flagging common accessibility problems, they certainly can be part of your testing approach.
However, a landmark study by the UK Government Digital Service tested 13 automated tools against 142 known accessibility barriers and found the best-performing tool detected only 40% of problems. The rest require human testers using actual assistive technologies: screen readers, keyboard-only navigation, voice control software and other tools that people with disabilities rely on every single day.
This distinction matters, especially in health contexts. A patient portal that passes an automated scan may still be unusable for a blind patient trying to navigate appointment scheduling with a screen reader. A telehealth consent form that looks clean in an audit dashboard may present a completely different experience for a user with a cognitive disability.
Human-led testing, conducted by testers with lived disability experience, surfaces these real-world gaps before they reach patients.
Aspiritech’s accessibility analysts are Section 508 Trusted Testers certified by the Department of Homeland Security. They combine professional certification with neurodivergent lived experience. This disability-informed combination consistently uncovers usability issues that automated tools miss and that purely credential-based testing teams overlook.
Your audit should result in a documented findings report that maps identified issues to specific WCAG 2.1 success criteria, assigns severity levels and provides the information your development teams need to remediate efficiently.
Step 4: Build a Prioritized Remediation Roadmap
A comprehensive audit of a complex health organization’s digital ecosystem will surface more issues than can be fixed at once. That is expected. What matters is having a clear, prioritized plan that sequences remediation work by impact and aligns with your compliance deadline.
Prioritization should be driven by patient impact and compliance risk. Patient-facing systems that are essential for accessing care should be addressed first. Those systems include but are not limited to patient portals, scheduling tools, telehealth platforms and intake forms. Secondary content, internal tools and lower-traffic pages can follow in later phases.
Your roadmap should also account for vendor timelines. Under HHS Section 504, organizations are responsible for the accessibility of digital content they provide or make available through third-party arrangements.
If a vendor-supplied tool is not WCAG 2.1 AA compliant, you need to know now. Going one step further, your vendor contracts for new procurements should require WCAG 2.1 AA conformance as a standard term.
Asking vendors for a Voluntary Product Accessibility Template (VPAT) or Accessibility Conformance Report (ACR) is a reasonable and increasingly common procurement practice.
Step 5: Remediate, Test and Verify
Remediation is not a one-pass process. Fixes introduced during development can create new issues or break previously compliant functionality. Accessibility needs to be integrated into your quality assurance workflow. Test for it at each stage of the development cycle, not only at launch.
The cost of fixing accessibility defects increases significantly as software moves through the development cycle. Issues caught during design and development are a fraction of the cost to fix compared to those discovered after release.
By building accessibility testing into your existing QA process, you gain both a compliance strategy and a cost management framework.
For organizations managing ongoing content updates, embedding accessibility checks into content publishing workflows is equally important. Publishing new pages, documents, multimedia content and features creates new compliance obligations. Accessibility cannot be treated as a project with a single fixed end date.
Step 6: Train Your Teams
Technical remediation addresses existing gaps, but it does not prevent new ones from being introduced. Staff training is a necessary component of any sustainable accessibility program.
Training needs vary by role:
- Developers need to understand how to write accessible code and use semantic HTML correctly.
- Designers need to apply accessible color contrast, focus indicators and interaction patterns from the start.
- Content authors need to know how to write meaningful alt text, structure documents properly and caption video content.
- Procurement teams need to know what to require from vendors.
Organizations should not treat accessibility as an isolated IT or compliance project. Rather, it is a cross-functional discipline that needs to be respected on an ongoing basis. Organizations that fail to do so will find themselves in the same remediation cycle repeatedly. Training helps break that pattern.
Step 7: Document Everything
In the event of a complaint or an OCR investigation, documentation of your compliance program demonstrates good-faith effort and structured progress.
That documentation should include your digital asset inventory, audit findings and severity assessments, remediation plans and timelines, vendor correspondence and accessibility representations, training records and your published accessibility statement.
You should also include an accessibility statement on your website that describes your current conformance level, known limitations and a mechanism for users to report issues or request accessible alternatives. This is a best practice that signals commitment to compliance and provides a documented feedback channel.
The Bottom Line
The May 2026 HHS Section 504 digital accessibility deadline is not a distant concern for health organizations. For those managing complex digital ecosystems across patient-facing platforms, third-party integrations and legacy content, the window to achieve full WCAG 2.1 AA compliance is increasingly narrow.
The consequences of falling short are significant: loss of federal funding, OCR enforcement action and private litigation. But the more immediate cost of inaction is measured in patients who cannot access the care they need because the digital front door is closed to them.
Aspiritech helps pharmaceutical, biotech, digital health and healthcare organizations build and sustain accessibility programs that meet HHS Section 504 requirements. Our team of Section 508 Trusted Testers are certified by the Department of Homeland Security and informed by neurodivergent lived experience. We deliver the human-led audits, remediation roadmaps, ongoing testing and staff training that regulated health environments require.
Send us an email or schedule a free 30-minute accessibility strategy session to identify your highest-risk gaps and build a realistic path to compliance before the May 2026 deadline.
If you need more accessibility resources, visit our health services hub for additional tips and insights.
