The May 2027 Accessibility Deadline: What It Means for Your Practice

In May 2026, the Department of Health and Human Services pushed back its deadline for web accessibility under Section 504 by a full year. If you run a small practice, that sounds like good news. It isn't, and the reason why is worth understanding.

What actually changed

The rule itself didn't move. Practices receiving federal financial assistance — which, in practice, means anyone billing Medicare or Medicaid — must bring their websites, patient portals and mobile apps into conformance with WCAG 2.1 Level AA.

What moved was the date:

The standard is identical for both. Smaller practices got more time, not a lighter obligation.

Why the extension is the bad news

Regulators don't extend deadlines because a requirement turned out to be easy. HHS granted the extension after receiving reports that a significant number of covered organisations — community health centers, small hospitals, primary care practices — were not going to make the original date.

If you were hoping the rule would quietly go away, the extension is evidence in the opposite direction. It's an acknowledgement that enforcement is coming and that the sector wasn't ready.

What WCAG 2.1 AA actually asks for

The standard has a reputation for being impenetrable. In practice, most failures come from a short list of unglamorous problems:

• Text that doesn't have enough contrast against its background. Pale grey body copy, or a brand colour that looked right in the mockup and fails when measured.
• Images with no alt text. Provider headshots and facility photos that a screen reader announces as nothing at all, or reads aloud as a filename.
• Form fields without labels. Usually the new patient intake form, which makes it the one that matters most. A placeholder is not a label — the text disappears the moment someone starts typing.
• Links and buttons with no text inside them. Icon links, logo links, menu toggles. A screen reader reaches them and has nothing to announce.
• A missing language attribute on the page itself, which determines whether a screen reader pronounces your content correctly at all.

None of these are exotic. All of them are fixable. The difficulty isn't technical — it's that nobody at a small practice has been assigned to look.

Section 504 is not the only rule in play

This is where it gets genuinely confusing, and where most practices we speak to lose the thread. Three separate federal requirements reach your website, and they don't line up neatly:

ADA Title III

Treats your website as a place of public accommodation. There's no filing, no certification, and no warning — exposure arrives as a demand letter, usually generated from an automated scan.

Section 504

The one with the 2027 date. Enforced by the HHS Office for Civil Rights and tied to your federal funding rather than to a fine.

HIPAA

Reaches your site wherever patient information moves: intake forms, the patient portal, third-party scripts. Anywhere data passes to a vendor, a Business Associate Agreement has to pass with it.

Meeting one does nothing for the other two.

What to do between now and May 2027

You have roughly ten months if you're in the 15-plus cohort. That's comfortable if you start, and not if you don't. Three things worth knowing before you plan anything:

1. Find out where you actually stand. Automated testing catches somewhere between a third and a half of real barriers, but it will find the common failures listed above in minutes, and it tells you the size of the problem.
2. Remediation under a deadline costs several times what planned work costs. You lose the ability to schedule it, to bundle it with a redesign you were going to do anyway, and to choose who does it.
3. Conformance isn't a one-time job. Every content update can drift a site back out of compliance. Organisations that make one-off fixes have been pursued again over the same issues.