Most organisations receiving HHS funding read the May 7, 2026 announcement and heard one thing: more time. That reading of the HHS Section 504 extension is understandable. It is also incomplete, and for organisations that act on it by pausing accessibility work, it carries real regulatory risk.
The HHS Office for Civil Rights extended the compliance dates for the web and mobile accessibility provisions of its 2024 Section 504 Final Rule. What it did not extend, modify, or suspend is the underlying non-discrimination obligation that has governed every HHS funding recipient since July 8, 2024. The distinction between those two things is the main focus of this blog.
Everything below is sourced exclusively to official government documents: the 2024 Final Rule published in the Federal Register, the May 7, 2026, HHS press release announcing the extension, the official web content accessibility factsheet published by HHS OCR, and the Section-by-Section Detailed Fact Sheet for recipients of HHS financial assistance.
What Section 504 Requires and Who It Covers
Section 504 of the Rehabilitation Act of 1973 (29 U.S.C. § 794) prohibits discrimination based on disability in any program or activity receiving federal financial assistance from HHS. The 2024 Final Rule, codified at 45 CFR Part 84, updated and strengthened those protections after more than 40 years without substantive revision.
The scope of coverage is broader than most compliance teams assume. According to the HHS OCR web content accessibility factsheet, the rule applies to:
- Doctors, dentists, hospitals, clinics, emergency rooms, and other health care providers
- Child welfare agencies and service providers
- Medical and nursing schools and other health-related colleges and universities
- Childcare and social service providers
The determining factor is receipt of HHS federal financial assistance, which includes funds from any of the more than 100 programmes HHS administers, such as Medicare, Medicaid, Head Start, TANF, child welfare programmes, and clinical research funding. A single Medicare or Medicaid payment is sufficient to bring an organisation within scope.
The rule does not distinguish between large health systems and small practices regarding whether it applies, only regarding when the WCAG technical standard must be met.
“The rule applies to recipients of federal financial assistance, including doctors, dentists, hospitals, clinics, emergency rooms, and other health care providers.” — HHS OCR, Official Web Content Accessibility Factsheet
What the 2024 Final Rule Requires Digitally
The 2024 Final Rule introduced, for the first time in the statute’s 50-year history, a specific technical standard for digital accessibility. That standard is WCAG 2.1 Level AA, the Web Content Accessibility Guidelines published by the World Wide Web Consortium.
The requirement covers web content and mobile applications that recipients make available, including content delivered through third-party contractual arrangements. The rule applies to websites, patient portals, mobile apps, online scheduling and payment systems, and kiosks.
The compliance structure the 2024 rule established was two-tiered based on organisation size:
- Recipients with 15 or more employees: WCAG 2.1 AA compliance by May 11, 2026
- Recipients with fewer than 15 employees: WCAG 2.1 AA compliance by May 10, 2027
Those were the original dates. Both moved on May 7, 2026. The standard itself did not.
What the May 2026 Extension Actually Changed
On May 7, 2026, HHS OCR issued an Interim Final Rule extending both compliance dates by exactly one year. The revised deadlines are:
- Recipients with 15 or more employees: May 11, 2027
- Recipients with fewer than 15 employees: May 10, 2028
The HHS press release explains the rationale: HHS received reports that a significant number of recipients, including community health centres, large and small hospitals, and primary care centres, would not be able to meet the original deadlines. The extension also aligns Section 504 requirements with the Department of Justice’s parallel rulemaking under Title II of the ADA, where compliance dates for state and local government entities with a population of 50,000 or more were also extended to April 26, 2027.
That is the full scope of what changed: the dates.
The press release states this directly. OCR Director Paula M. Stannard noted that the extension provides necessary flexibility, and in the same sentence reminded recipients that their legal obligation to ensure accessible programmes and activities remains fully intact.
“We remind recipients of their legal obligation to ensure that their programs and activities are accessible to persons with disabilities.” — Paula M. Stannard, Director, HHS Office for Civil Rights, May 7, 2026
What the Extension Did Not Change
This is the section most compliance briefings skip. The list of what the extension left untouched is longer and more consequential than what it moved.
The technical standard is unchanged
WCAG 2.1 Level AA remains the required standard. The extension did not lower the bar to WCAG 2.0, did not grant permission to comply with a subset of success criteria, and did not signal that HHS is reconsidering the standard. The destination did not move. The deadline did.
The rule’s effective date is unchanged
The 2024 Final Rule took effect on July 8, 2024. That date has not moved. Every obligation in 45 CFR Part 84, including the duty to make reasonable modifications, the effective communication requirement, and the equal opportunity to participate in programmes and activities offered online, has been in force since that date.
The HHS OCR web content accessibility factsheet makes this explicit: during the period before the WCAG deadline, the rule requires that recipients provide individuals with disabilities with effective communication, reasonable modifications where necessary to avoid discrimination, and an equal opportunity to participate in the recipient’s programmes and activities, including services offered online and through mobile apps.
The WCAG compliance dates are the dates by which the specific technical benchmark applies. They are not the dates by which the non-discrimination obligation begins.
OCR enforcement authority is unchanged
The Section by Section Detailed Fact Sheet published by HHS OCR states that pursuant to its enforcement procedures, HHS conducts investigations and initiates compliance reviews without the need for a complaint to be filed. The extension of a technical deadline does not suspend that authority. OCR can open a compliance review of any HHS-funded organisation’s digital accessibility practices today.
Vendor liability is unchanged
This is the provision most organisations are not reading carefully enough. The web content accessibility factsheet draws a clear line between third-party content that is exempt and third-party content that is not. The narrow exemption applies only to content posted by members of the public who are not acting for or under contract with the recipient, for example, a public comment on a social media page.
The exemption explicitly does not apply to content posted due to contractual, licensing, or other arrangements between the third party and the recipient. That includes online payment processing websites, third-party patient portals, online scheduling platforms, and telehealth applications that recipients contract with vendors to provide.
When a vendor platform your organisation uses to deliver programme services fails WCAG 2.1 AA, your organisation, not the vendor, bears the regulatory consequence under Section 504.
The Practical Implication: July 8, 2024, is the Date that Matters
The dominant response to the extension has been relief. The accurate response is recalibration.
The WCAG compliance date that moved to May 2027 governs one specific obligation: conformance to the WCAG 2.1 AA technical standard. The broader obligation to ensure non-discriminatory access to programmes and activities delivered digitally has been in force since July 8, 2024. An HHS-funded organisation whose patient portal is inaccessible to screen reader users cannot point to a 2027 deadline as a defence in an OCR complaint today. The effective communication and reasonable modification obligations apply now.
| What Changed | What Did Not Change |
|---|---|
| Compliance deadlines were extended to May 11, 2027 for entities with 15 or more employees. | WCAG 2.1 Level AA remains the required technical accessibility standard. |
| Compliance deadlines were extended to May 10, 2028 for entities with fewer than 15 employees. | The Section 504 rule remains effective from July 8, 2024. |
| The implementation timeline is now aligned with the DOJ’s revised Title II accessibility schedule. | Covered entities must continue providing effective communication to individuals with disabilities. |
| Organizations have additional time to complete remediation and accessibility improvements. | Requirements for reasonable modifications remain unchanged. |
| The revised dates provide more time for planning, budgeting, and implementation. | Equal access to programs, services, and activities remains mandatory. |
| Only the compliance timeline changed; the underlying obligations did not. | OCR enforcement authority, covered-entity obligations, and applicable third-party responsibilities remain in effect. |
Five things HHS-funded Organisations Should do Before May 2027
The additional year is most useful to organisations that use it for structured preparation rather than deferral. Here is what the official record supports doing.
1. Determine your coverage status now
If your organisation receives funds through any of the more than 100 programmes HHS administers, including Medicare, Medicaid, Head Start, TANF, clinical research grants, or child welfare funding, Section 504 applies. Coverage is not limited to hospitals and health systems. It reaches medical schools, nursing programmes, community health centres, social service providers, and childcare organisations. Small size does not mean exemption. It only affects your WCAG deadline.
2. Audit your current digital properties against WCAG 2.1 AA
A WCAG 2.1 AA audit of your primary website, patient portal, mobile applications, and any online service delivery platforms produces the factual baseline your compliance programme needs. Without it, you cannot know which barriers currently expose your organisation to the effective communication and reasonable modification obligations that are already active.
3. Audit your vendor contracts
For every third-party platform your organisation uses to deliver programme services, review whether your contract specifies WCAG 2.1 AA conformance as a vendor obligation. As the official factsheet confirms, contractual third-party content is not exempt. The patient portal, telehealth platform, online scheduler, or payment system you contract with falls under your Section 504 obligations. If your vendor agreements do not currently require accessibility conformance, they should.
4. Designate a Section 504 coordinator
Recipients with 15 or more employees are required under 45 CFR § 84.7 to designate at least one person to coordinate efforts to comply with the rule. This requirement was not introduced by the 2024 rule; it has been part of Section 504 since its original implementation. If your organisation does not have a designated coordinator, that is a current compliance gap, not a 2027 issue.
5. Establish grievance procedures
The same section requires recipients with 15 or more employees to adopt grievance procedures that provide for a prompt and equitable resolution of complaints. This, too, is an existing requirement that applies now.
A Note on the Comment Period
The Interim Final Rule that extended the Section 504 WCAG deadlines is accepting public comments through July 6, 2026. HHS has specifically invited input on the rule’s impact on recipients, the accuracy of its cost and benefit estimates, and whether further rulemaking is warranted to reduce burdens on small recipients. Organisations with views on the extension or the underlying requirements have until that date to submit comments through the Federal Register.
HHS also noted it is considering whether the substantive provisions of the 2024 rule may need further revision. If additional rulemaking occurs, there will be a notice-and-comment period. Until any such changes are finalised, the 2024 rule as currently written remains in force.
What the Extension Does Not Give You
A year’s extension on a technical deadline does not suspend an active compliance obligation. It does not pause OCR’s authority to investigate complaints. It does not exempt vendor-delivered digital services from your Section 504 responsibilities. And it does not change the fact that the non-discrimination duty under 45 CFR Part 84 has been running for almost two years.
The extension is time. What your organisation does with it determines whether May 2027 arrives as a confirmation of work already done or as the date the exposure becomes impossible to ignore.
Is Your Organisation Section 504 Ready? Pivotal Accessibility conducts WCAG 2.1 AA audits against the technical standards required under HHS Section 504, covering web content, mobile applications, and third-party vendor platforms. Contact us to discuss your compliance programme. Request an Accessibility Audit