The US Department of Health and Human Services (HHS) finalized a landmark rule nearly two years ago. It requires all recipients of federal financial assistance to make their websites, mobile applications, and kiosk-based programs accessible to individuals with disabilities. Compliance deadlines are fast approaching. Organizations must act now to avoid penalties.
Who Must Comply With the HHS Rule
Covered Organizations and Programs
The rule applies broadly across healthcare and social services. Any organization receiving federal financial assistance from HHS falls under this mandate. This includes health care providers, health plans, social services agencies, child welfare organizations, and educational providers.
Specifically, organizations participating in Medicare, Medicaid, child welfare initiatives, or federally funded clinical research must comply. Furthermore, the rule extends beyond websites. It covers mobile applications and any programs delivered through kiosks — even those operated by third-party vendors on behalf of covered entities.
Compliance Deadlines by Organization Size
Two distinct deadlines apply, depending on organization size:
- Organizations with 15 or more employees must comply by May 11, 2026.
- Organizations with fewer than 15 employees must comply by May 10, 2027.
These deadlines are firm. Entities should begin their accessibility audits immediately, as technical remediation often takes considerable time.
Technical Standards Under WCAG 2.1 Level AA
What the Guidelines Require
The rule adopts the Web Content Accessibility Guidelines (WCAG) 2.1 Level AA as its governing technical standard. These guidelines address several common accessibility failures that currently limit digital access for users with disabilities.
Organizations must ensure their digital content works with assistive technologies. Screen readers, for instance, must be able to parse all documents. Improperly structured PDFs are a frequent compliance failure. Additionally, all video and multimedia content must include captions and audio descriptions to serve users who are deaf or hard of hearing.
Alternative Methods of Compliance
Covered entities are not locked into a single compliance path. The rule permits alternative accessibility methods. However, those alternatives must offer an equal or greater level of access than WCAG 2.1 Level AA provides. Therefore, organizations exploring alternative approaches must document how their methods meet or exceed the standard baseline.
Exemptions From the Accessibility Requirements
Not all digital content falls under the WCAG 2.1 Level AA mandate. The rule carves out specific exemptions to avoid placing an unreasonable burden on organizations for legacy or inactive content. The following content types are exempt:
- Archived web content that organizations do not update after the compliance date
- Certain legacy electronic documents not used for active program participation
- Third-party content that the covered entity does not control
- Individualized, password-protected documents shared with specific users
- Pre-existing social media posts published before the compliance deadline
Organizations should note that these exemptions are narrow. Any active, public-facing digital content used to deliver program services remains subject to the rule’s requirements.
Risks of Non-Compliance
HHS Enforcement Actions
HHS can initiate a compliance review on its own initiative. It may also open an investigation in response to a complaint from an individual. Such reviews carry real consequences. Fines and other penalties apply to entities that HHS finds non-compliant.
Private Litigation Risks
Beyond federal enforcement, private litigation poses a growing threat. Website accessibility lawsuits — filed by individuals or as class actions — have risen sharply in recent years. Most of these cases rely on alleged violations of Title III of the Americans with Disabilities Act. Consequently, non-compliant organizations face exposure on two fronts: federal regulatory action and private civil suits.
Steps to Take Before the Deadline
Organizations should begin with a comprehensive accessibility audit of their websites, mobile apps, and kiosk content. Many website hosting providers offer built-in tools to help identify and remediate WCAG 2.1 Level AA failures. Additional guidance is available through HHS’s official fact sheet on Section 504 of the Rehabilitation Act.
Key action items include:
- Audit all public-facing web content and mobile applications
- Identify and remediate common failures such as non-readable PDFs and uncaptioned video
- Review third-party vendor agreements to confirm their content complies
- Document all accessibility improvements and alternative access methods
- Confirm whether archived or legacy content qualifies for an exemption
The May 2026 deadline leaves little time for larger organizations. Starting the remediation process today is critical to achieving full compliance.
