Section 504 Web Accessibility: The Deadline Your Health-Program Clients Are Actually On

The Clock Your Health-Program Clients Are On

Most contractors working the SLED market have internalized one set of accessibility dates: April 26, 2027 and April 26, 2028, the ADA Title II compliance deadlines for state and local government websites. If you deliver to cities and counties, those are the dates on your planning board.

But there is a second rule, run by a different federal agency, that reaches a slice of your clients the Title II dates do not describe — and it has its own calendar. If any client in your portfolio receives federal financial assistance from the Department of Health and Human Services — a county health department, a community health center, a public hospital, a nursing home, a clinic that participates in Medicaid or CHIP, a state human-services agency — that client is a recipient under Section 504 of the Rehabilitation Act of 1973, and HHS's web-accessibility rule for recipients is a separate obligation with separate deadlines.

The contractor who plans the whole portfolio against the Title II dates is, for those clients, planning against the wrong clock. This post maps the Section 504 rule as it actually stands in July 2026: what it requires, how its dates moved, why it reaches entities Title II never touches, and the documentation posture that holds up under both rules at once.

Two Rules, Two Regulators, One Standard

Start with the relationship between the two rules, because the contractors who get this wrong usually get it wrong by collapsing them into one.

ADA Title II is enforced by the Department of Justice. It covers state and local government entities regardless of funding, and its web rule lives in 28 CFR Part 35. Its technical standard is WCAG 2.1 Level AA.

Section 504 is a funding-conditioned civil-rights statute: any program or activity that receives federal financial assistance must not discriminate on the basis of disability. HHS enforces Section 504 for the recipients it funds, and on May 9, 2024, HHS's Office for Civil Rights published a final rule (89 FR 40066) updating 45 CFR Part 84 to define what web and mobile accessibility means for those recipients. Its technical standard is also WCAG 2.1 Level AA — the same standard DOJ adopted for Title II. HHS's own fact sheet on the Part 84 rule states the rule "requires compliance with specific technical standards, the Web Content Accessibility Guidelines (WCAG) 2.1 AA."

So the what is identical: the same guidelines, the same Level AA success criteria, the same underlying scanning-and-remediation work on a deliverable. What differs is the who, the when, and the how the clock is drawn — and those differences are exactly where a mixed portfolio gets mismanaged.

The Section 504 Clock — and How It Moved in May 2026

The Section 504 web rule did not set a single deadline. It tiered its compliance dates by the recipient's size, measured in employees:

• Recipients with 15 or more employees originally had two years from the May 2024 rule — a first deadline of May 11, 2026.
• Recipients with fewer than 15 employees originally had three years — May 10, 2027.

Then, in the spring of 2026, HHS did what DOJ had done a few weeks earlier for Title II: it hit pause. On May 7, 2026, HHS's Office for Civil Rights announced an interim final rule extending both Section 504 web deadlines by one year, published in the Federal Register on May 11, 2026 (Extension of Compliance Dates, document 2026-09266). Per HHS's press release, the new dates are:

• May 11, 2027 for recipients with 15 or more employees.
• May 10, 2028 for recipients with fewer than 15 employees.

HHS's stated reason was that a significant number of recipients — the agency named community health centers, smaller hospitals, and primary care providers — reported they could not meet the original 2026 deadline, and that aligning the Section 504 timeline with DOJ's parallel Title II extension would create consistency for organizations covered by both. Like DOJ's rule, HHS used the interim-final-rule mechanism to make the extension effective immediately and opened a comment period after the fact. That comment window has already closed — it ran through July 6, 2026. So as of today, the extended dates are in effect, the comment period is over, and HHS now owes a reasoned response to the comments it received before it issues anything final. There is no published schedule for that.

Why 504 Reaches Clients Title II Never Touches

Here is the part that changes the size of your covered-client list, and it is the single most important thing in this post.

Title II attaches to government status. Section 504 attaches to federal money. Those are different triggers, and the gap between them is populated with clients you might not have flagged as accessibility-regulated at all.

A private, nonprofit community health center is not a state or local government, so it is not a Title II entity. But if it participates in Medicaid or receives HHS grant funding — and most do — it is a Section 504 recipient, and the WCAG 2.1 AA web obligation reaches its patient portal, its appointment scheduler, and its mobile app on the Section 504 clock. The same is true of a private hospital taking Medicare and Medicaid, a nursing home, a federally qualified health center, and a nonprofit social-services provider operating on HHS grants.

For a contractor, this means the accessibility obligation is not confined to the "government client" column of your book. If you build or maintain digital services for the health-and-human-services sector at all, some of those deliverables are governed by Section 504 whether or not the client is a unit of government. And a state Medicaid agency or a county health department sits in the overlap: it is a Title II entity and a Section 504 recipient, covered by both rules at once, on two clocks that do not share a date.

The Trap: 504 and Title II Don't Share a Calendar

The May 2026 extensions are the reason a contractor has to keep the two clocks separate rather than mentally merging them into "everything moved to 2027."

Look at the dates side by side. Title II: April 26, 2027 for entities serving 50,000 or more people, April 26, 2028 for smaller entities and special districts. Section 504: May 11, 2027 for recipients with 15 or more employees, May 10, 2028 for recipients with fewer than 15. They are close — deliberately aligned within a few weeks — but they are not the same date, and the tiering that assigns a given client to a given date is drawn on a completely different axis.

Title II tiers by population served. Section 504 tiers by employee count. Those can point in opposite directions for the same organization. A small rural county serving well under 50,000 people lands on the later Title II date — but if that county's health department employs more than 15 people and takes HHS funding, its Section 504 obligation lands on the earlier of the two 504 dates. A large urban hospital district might be a big employer facing the earlier 504 deadline while, as a special district, catching the later Title II one. You cannot assume that "smaller client" means "later deadline" on both rules, because the two rules are not measuring the same thing.

The practical failure mode is a contractor who tells a health-program client "you have until spring 2028" based on the client's small population, when the client's employee count actually puts its Section 504 portal work on a 2027 deadline. Getting the axis wrong by one tier is getting the deadline wrong by a full year — in the direction that leaves the client exposed.

What Section 504 Shares With Title II

Once you are inside the Section 504 rule, most of the substance will look familiar, because HHS built it to track the Title II approach.

The standard is WCAG 2.1 Level AA — identical success criteria, identical scope across web content and mobile applications. The remediation work on a covered portal is the same work whether the driver is Title II or Section 504.

The exceptions are the same five. Both rules carve out a limited set of content that need not meet WCAG 2.1 AA: archived web content; certain preexisting conventional electronic documents; certain content posted by a third party; individualized, password-protected conventional electronic documents; and preexisting social-media posts. As with Title II, these exceptions are narrow and conditional — a document a patient actively uses to apply for or participate in a program is not "archived," and content you produced and the client posted is not "third-party." Do not read the exceptions as a wide escape hatch.

The overlay problem is identical. HHS did not bless automated widgets any more than DOJ did. The FTC's position, crystallized in the January 2025 accessiBe complaint and the resulting consent order, is that marketing an automated tool as something that "makes your site compliant" is a deceptive practice. That posture is regulator-agnostic: it applies to a Section 504 deliverable exactly as it applies to a Title II one. Automated testing is a genuine and necessary part of the work — but it catches only a portion of WCAG issues (Deque's published research puts axe-core's coverage around 57% of issues by volume, mapping to roughly 16 of the 50 WCAG 2.1 AA success criteria), and no scan can substitute for manual review or make a conformance claim.

Both rules are being challenged in the same lawsuit. When the National Federation of the Blind sued in the U.S. District Court for the District of Maryland in May 2026, it named both the DOJ Title II extension and the HHS Section 504 extension in a single complaint, asking the court to vacate both interim final rules and reinstate the original deadlines. That is a shared risk: a vacatur would snap both clocks back at once, and the original Section 504 date for 15-plus-employee recipients — May 11, 2026 — is, like the large-entity Title II date, already in the past. The three-clocks analysis that mapped this uncertainty for Title II applies with equal force to the 504 side of a mixed portfolio.

What Doesn't Move on the Section 504 Clock

As with Title II, the things that actually govern a contractor's exposure sit outside the extension entirely.

The underlying Section 504 duty predates the rule by half a century. Section 504 has prohibited disability discrimination by recipients of federal funds since 1973. The 2024 rule set a technical standard and a date for digital access; it did not create the non-discrimination obligation. A patient who cannot use a Medicaid provider's scheduling portal with a screen reader has a discrimination argument grounded in the statute regardless of what the compliance-date calendar says — which is why the deadline moving does not make the risk disappear, it just moves the bright-line date.

The contract clauses don't have a regulatory off-switch. If your agreement with a health-program client warrants WCAG 2.1 AA conformance and flows the obligation down to you, that warranty is enforceable on its own terms whether the Section 504 deadline is 2026, 2027, or vacated back to 2026 by a federal court. The clause, not the Federal Register, is what a tender of defense quotes back to you.

The documentation expectation only grows. An extended deadline is more runway to build the record, not permission to stop building it — and under a possible vacatur, the work done during the "extra" year is retroactively the work that was always required.

What a Contractor Should Actually Do

The posture that survives all of this is the same one that survives the Title II uncertainty, applied deliberately to the health-program corner of your portfolio.

• Tag which clock each client is on — and flag the ones on both. Go through your book and mark, for each client, whether it is a Title II entity, a Section 504 recipient, or both, and which tier (population for Title II, employee count for Section 504) sets its date. The clients in the overlap are the ones most likely to have their deadline mis-stated.
• Run dated structural scans and keep the results. A timestamped Readiness Scanner run against a covered portal establishes the "before" state and the ongoing-monitoring record. The scan is structural and automated — it does not certify conformance and does not replace manual review — but a dated, methodology-disclosed result is exactly the kind of contemporaneous evidence that matters when someone asks what you did and when.
• Keep an audit defense log per client. Section 504 investigations run through HHS's Office for Civil Rights, and the thing OCR — like DOJ, like a plaintiff's counsel — evaluates is whether the entity took reasonable, documented steps. A chronological record of scans, findings, remediation, and retesting is the artifact that answers that question, and it is equally probative under 504 and Title II.
• Don't let the mobile half of the portfolio slip. The Section 504 rule reaches mobile applications on the same terms as web content, exactly as the Title II rule does. A health-program client's patient app is on the clock alongside its website.
• Never overclaim. Neither your work nor any tool "makes the client Section 504 compliant." What you produce is automated, structural evidence and a defensible paper trail — say precisely that, in your ACRs, your status reports, and your marketing. The FTC posture makes the honest framing the safe one.

The One-Line Version

Section 504 is the accessibility rule your health-program clients are on, and it is not ADA Title II wearing a different hat: same WCAG 2.1 AA standard, but a different regulator, a different funding-based trigger that reaches private providers Title II never touches, and a clock tiered by employee count that moved to May 11, 2027 and May 10, 2028 — near Title II's dates but not identical to them. If any client in your portfolio takes HHS money, plan that client against the 504 calendar, document the work on a dated record, and don't assume the deadline your municipal clients cite is the one that applies. The contractor who tracks both clocks and keeps the evidence is the one who is right no matter which deadline holds.

---

This post is for informational purposes only and does not constitute legal advice. Consult with qualified legal counsel for guidance specific to your situation.