Three weeks before healthcare organizations faced a federal deadline to make patient portals, scheduling apps, and check-in kiosks accessible, HHS pulled it back — but only partway, and only for some of them.
The rule in question came from HHS's Office for Civil Rights (OCR): a Section 504 final rule requiring recipients of HHS funding — hospitals, health systems, insurers, clinics, and any organization that takes Medicaid or Medicare dollars — to bring their websites, mobile apps, and kiosks into line with WCAG 2.1 AA. The original compliance date was May 11, 2026. Days before it hit, OCR announced a one-year extension. For organizations with 15 or more employees, the new deadline is May 11, 2027. For organizations with fewer than 15 employees, it's May 10, 2028.
That looks, at a glance, like a reprieve. For most covered entities, it's really a scheduling change with a trap built into the fine print.
What the Extension Actually Does — and Doesn't Do
The extension moves the date. It does not move the scope, and it does not create a new category of exemption. Every organization that was covered under the original rule is still covered. The 15-employee line is a timing threshold, not a coverage threshold — a distinction a lot of compliance teams are currently getting backwards.
Read that sentence again if you run a smaller clinic, a regional insurer's member portal, or a state Medicaid contractor with a lean staff. Having fewer than 15 employees does not mean you're exempt from Section 504. It means your deadline lands on May 10, 2028 instead of May 11, 2027. If your organization receives HHS funding in any form — Medicaid, Medicare, HRSA grants, or other federal health dollars — the digital accessibility requirement applies to you regardless of headcount. The only question the employee count answers is when.
The Stat: HHS OCR's Section 504 final rule sets a compliance deadline of May 11, 2027 for HHS-funded organizations with 15 or more employees, and May 10, 2028 for those with fewer than 15 employees — a one-year extension from the original May 11, 2026 date, granted just days before it took effect. (Source: HHS Office for Civil Rights)
Why HHS Moved the Date at All
OCR didn't extend the deadline because the underlying obligation was in question. It extended it because implementation at scale — retrofitting patient portals, EHR-linked scheduling tools, telehealth platforms, and physical kiosks across thousands of covered entities — was running behind the original one-year runway. An extension buys covered entities more time to remediate. It does not buy them a pass on the remediation itself, and it does not pause enforcement of other overlapping obligations, including ADA Title II and Title III exposure that many healthcare organizations already carry independent of Section 504.
For compliance and IT leaders, the practical takeaway is that the extension changed a due date on a calendar, not the size of the project. If your remediation work was already underway, you now have breathing room to do it properly instead of rushing a partial fix before the old date. If your organization was waiting to see whether the rule would be delayed indefinitely or watered down, that bet didn't pay off — the rule stands, the WCAG 2.1 AA standard stands, and the only thing that moved is the calendar.
Where Healthcare Organizations Are Most Exposed
Patient-facing digital properties in healthcare carry a specific kind of risk that general commercial websites don't: the people most likely to need accommodations — older patients, patients with chronic conditions, patients using screen readers or switch devices — are disproportionately represented in the population actually using the portal. A patient scheduling tool that isn't keyboard-navigable, a symptom-checker that isn't compatible with screen readers, or a check-in kiosk with no non-visual mode isn't just a compliance gap. It's a barrier to care for exactly the population the funding is meant to serve.
That's a meaningfully different risk profile than a retail site's accessibility gap, and it's worth treating the new deadline as an operational floor, not a target.
A Practical Timeline
| Milestone | Date | Applies To |
|---|---|---|
| Original Section 504 compliance deadline | May 11, 2026 | All covered HHS-funded entities |
| Extended deadline | May 11, 2027 | Organizations with 15+ employees |
| Extended deadline | May 10, 2028 | Organizations with fewer than 15 employees |
| WCAG standard referenced by the rule | WCAG 2.1 AA | All covered entities, regardless of size |
What to Do With the Extra Time
The extension is only useful if it's spent on remediation rather than on relief. A few things are worth prioritizing now, whichever deadline applies to you:
Confirm your coverage status in writing
Don't assume small size means no obligation. If your organization receives any HHS funding — Medicaid reimbursement, HRSA grants, Medicare participation — get a documented determination of your covered-entity status and your applicable deadline. This is a five-minute conversation with counsel or compliance staff that prevents a much longer conversation with OCR later.
Audit before you build a remediation plan
You can't scope a WCAG 2.1 AA remediation project without knowing where you actually stand today. That means testing patient portals, scheduling flows, mobile apps, and kiosk interfaces against the real success criteria — not a spot check of the homepage. For context on how widespread these gaps are even outside healthcare, the WebAIM Million analysis has consistently found that roughly 95.9% of home pages have at least one detectable WCAG 2 failure. Healthcare organizations are not an exception to that pattern; if anything, patient-facing tools built on top of legacy EHR vendors tend to inherit accessibility debt rather than fix it.
Treat the deadline as the last mile, not the starting line
A one-year extension sounds generous until you map it against the actual remediation timeline for a hospital system's full digital footprint — portal, app, telehealth, kiosks, and any third-party widgets embedded across all of them. Organizations that start scoping now, rather than in early 2027, are the ones that hit the date with a clean result instead of a rushed one.
It's also worth remembering the scale of who's affected by these barriers in the first place. The CDC estimates that roughly 1 in 4 U.S. adults live with a disability, and WHO data puts color vision deficiency at roughly 8.3% of men and 0.5% of women — a population that any color-dependent status indicator, chart, or form validation in a patient portal needs to account for directly, not as an afterthought.
The Bottom Line
HHS gave covered healthcare organizations more runway, not a different destination. The rule, the WCAG 2.1 AA standard it's built on, and the coverage criteria are unchanged. The only variable that moved is the date, and even that variable depends on a headcount threshold that determines timing, not obligation. Treat May 2027 or May 2028 as the last checkpoint on a project that should already be underway, not as a reason to wait.
If you don't know exactly where your patient-facing websites, apps, and kiosks stand against WCAG 2.1 AA today, that's the gap to close first. Get a full accessibility audit from WCAG.World and get a clear, prioritized picture of what needs to change before either deadline arrives.