Patients find you, book, fill out forms, and pay their bills online. If your practice takes Medicare or Medicaid, Section 504 requires all of it to work for people with disabilities, too. Here's what the rule covers, and how to get there.
Section 504 applies to organizations that receive federal funding. HHS counts Medicare and Medicaid, so most healthcare providers are covered: hospitals, health centers, clinics, private practices, nursing homes, home health, and dental offices that take Medicaid.
In Virginia, that generally includes practices paid by Medicaid through Cardinal Care. The standard is WCAG 2.1 Level AA, the same one the ADA's government rule uses.
HHS Section 504 deadlines
- 15 or more employees
- May 11, 2027
- Fewer than 15 employees
- May 10, 2028
Pushed back a year in May 2026. The rule itself stayed the same.
Rules last checked November 2026.
Your website, your apps, the documents you post, and the tools a vendor runs for you. Here's what that looks like, and where a patient can get stuck.
A provider search whose filters a keyboard can't reach.
A calendar a screen reader reads as a string of numbers, with no month or day.
A new patient packet scanned as an image, so a screen reader finds no text at all.
A session that times out before someone using a magnifier can finish reading.
Payment errors shown only in red, with no message a screen reader can announce.
They get mixed up a lot. Here's who each one covers.
Part of the Rehabilitation Act of 1973. HHS's 2024 rule sets the web standard for healthcare: WCAG 2.1 AA, on the deadlines above.
Also part of the Rehabilitation Act. It covers the tech federal agencies build and buy, tested to WCAG 2.0 AA. It doesn't cover a private practice's website.
A separate law from 1990. Title II covers state and local government, and Title III covers businesses open to the public, doctors' offices included. A practice can fall under both the ADA and Section 504.
You don't need to have it all figured out. It starts with a look at your site, and a clear price for the rest.
Curious what an audit looks like? See a sample audit report (PDF).
A page or two
Send us your site. We go through a page or two with a screen reader and keyboard, then email you what we found and a price for the full audit. That's all we'll use your email for.
Every page and form patients use
We test your main pages, key tasks like booking a visit, the vendor tools in between, and the documents you post, by keyboard, zoom, and screen reader.
What you walk away with
- Every issue mapped to WCAG 2.1 AA and ranked by severity
- Clear guidance on how to fix each one
- An accessibility statement for your site
- A policy template your team can make its own
Your call
Hand the report to whoever runs your site, have us guide them, or let us make the fixes. It's written so a vendor or marketing company can act on it without us in the room.
A written record
We confirm the fixes hold, so you have a record of where your site stands if anyone asks.
Don't see yours?
What is Section 504 website compliance?
Meeting the web accessibility rule HHS added to Section 504 in 2024. Section 504 bars disability discrimination by organizations that receive federal funding, and the rule spells out what that means online: websites, mobile apps, and posted documents have to meet WCAG 2.1 Level AA, with a few narrow exceptions.
Does Section 504 apply to my practice?
Very likely, if you take Medicare or Medicaid. HHS counts both as federal funding, Medicare Part B payments included. Your attorney can confirm where you stand. We're not lawyers, but we can show you how your site measures up. Read HHS on Medicare Part B.
When is the Section 504 website deadline?
May 11, 2027 for practices with 15 or more employees, and May 10, 2028 for smaller ones. HHS pushed both back a year in May 2026. Those dates are for meeting the WCAG standard. The rest of Section 504 applies now: communicating effectively with patients who have disabilities, making reasonable changes when someone asks, and giving them equal access to what you offer online.
Are there exceptions to the Section 504 web rule?
A few, and they're narrow: archived content kept only for reference, documents posted before the deadline that no one needs to get care now, content other people post (like patient reviews), a single patient's password-protected documents (like their bill), and older social media posts. An exception never ends the duty to communicate effectively, so if a patient can't use something, you still owe them another way to get it. Read HHS's detailed Section 504 fact sheet.
What's the difference between Section 504 and Section 508?
Section 504 covers organizations that receive federal funding, like healthcare providers. Section 508 covers federal agencies and the tech they buy. Both come from the Rehabilitation Act. Section 508 uses WCAG 2.0 AA, and HHS's 504 rule uses WCAG 2.1 AA, which includes everything in 2.0 and a bit more.
Is Section 504 part of the ADA?
No. Section 504 came first, in 1973, and the ADA built on it in 1990. They overlap, though. The ADA's Title III covers businesses open to the public, including doctors' offices, so a practice can be covered by both. See what the ADA requires.
A vendor runs our patient portal. Is that covered?
Yes. The rule covers what you offer patients through a vendor, too, like a portal, scheduling tool, or bill pay page. We test the parts patients use, review the vendor's accessibility report (often called an ACR or VPAT), and give you a clear list to send them.
Do our PDFs and forms count?
Yes. New patient packets, intake forms, and notices you post online are covered. Some older files kept only for reference can be exempt. We check every document you post and fully test the ones patients need most.
What if HHS changes the rule?
It might. HHS has said it plans more rulemaking, and the rule could change. The ADA applies to practices either way, and patients who can't book online will call, or go somewhere else.
Will an audit make us compliant?
An audit shows you exactly where you stand against WCAG 2.1 AA and what to fix. Once the fixes are in and we've retested them, you have a written record of the work. Whether that covers your legal obligations is a question for your attorney.
Do you work with practices outside Richmond?
Yes. We're based in Richmond, Virginia, and work with practices across the state and beyond. The testing happens on your live site, so we don't need to be in the room.
A journey of a thousand miles begins with a single step. Ours starts with one page of your site.