Section 1557 website accessibility: deadline and scope

HHS extended the digital accessibility deadlines in May 2026. The dates now are 11 May 2027 for providers with 15 or more employees and 10 May 2028 for those below that. The requirement itself did not change, and HHS has not signalled that it is going away.

Worth knowing precisely where those dates live, because it is the first thing counsel will ask. They are not written into the Section 1557 regulation. They sit in 45 CFR part 84, the HHS rule implementing section 504 of the Rehabilitation Act, which is where the web and mobile accessibility requirements were adopted in May 2024 and where the interim final rule effective 7 May 2026 moved them back a year. Section 1557 is what makes this unavoidable for a practice: it prohibits disability discrimination in federally assisted health programs by reference to section 504, and carries section 504’s enforcement mechanisms with it. So a practice searching for its “Section 1557 deadline” is searching for the right thing — but the citation that carries the dates is part 84, not part 92.

Part 92 is not silent, though, and this is where most write-ups go wrong in one direction or the other. The Section 1557 regulation has its own technology provision at 45 CFR 92.204. It requires that health programs and activities provided through websites and mobile applications comply with section 504 as interpreted consistent with title II of the ADA, subject to the usual undue-burden and fundamental-alteration limits. What it does not do is set a date or name a WCAG version of its own. It points at section 504 — and section 504’s rule is part 84. So the two answers a practice gets from two different advisers, “it’s a 1557 problem” and “it’s a 504 problem”, are each half of the same answer.

One consequence of it being an interim final rule: it took effect immediately, but the form is one that stays open to revision. Plan against these dates; do not treat a second extension as something you can count on.

The eight answers, in short

Every line below is the value carried in this site’s claim register. The rest of this page is the working behind them.

Which rule sets the date

Dates live in 45 CFR part 84 (section 504); Section 1557 incorporates section 504's grounds and enforcement

Who is covered

Every health program or activity, any part of which receives federal financial assistance from HHS, directly or indirectly — expressly including Medicare Part B. Named recipient categories: community health centers, large and small hospitals, primary care centers.

What 45 CFR 92.204 requires

92.204 requires health programs and activities provided through websites and mobile applications to comply with section 504 as interpreted consistent with ADA title II, subject to undue-burden and fundamental-alteration limits. It sets NO independent compliance date and names NO WCAG version.

A vendor-licensed portal

Yes. 45 CFR 84.84(b)(1) reaches web content and mobile apps the recipient provides or makes available directly OR through contractual, licensing, or other arrangements.

The third-party exception

No. 45 CFR 84.85(c) excepts content posted by a third party unless that third party is posting due to contractual, licensing, or other arrangements with the recipient — which is the contracted-vendor case exactly.

Documents behind a login

Generally no. 45 CFR 84.85(d) excepts conventional electronic documents that are BOTH about a specific individual, their property or their account AND password-protected or otherwise secured. Both conditions must hold, and the exception does not reach the portal interface delivering them.

A separate accessible version

Only where it is not possible to make the web content directly accessible due to technical or legal limitations

An alternative design

Yes, but only where the alternative results in substantially equivalent or greater accessibility AND usability

Coverage is broader than “hospitals”

The test is every health program or activity, any part of which receives federal financial assistance from HHS, directly or indirectly. HHS used the 2024 rule to give official notice that Medicare Part B meets that definition — which brought in a large population of practices that had previously been told they sat outside it. The interim final rule names community health centers, large and small hospitals and primary care centers among the recipients it expects to be affected; clinics, dental offices and most private practices sit inside the same test.

Practices routinely assume this is a large-system obligation because the guidance is written for large systems. The employee-count split in the deadlines is the tell that it is not: the rule contemplates practices small enough for that threshold to matter.

Dental practices are the case where this is most often got wrong, because the abbreviation “ADA” sends the search to the wrong statute and because summaries written for hospitals quote only the fifteen-plus date. What applies to a dental practice, and by when works through the Medicare Advantage, Medicaid and CHIP test and the surfaces that fail most often in dental.

The scope that gets missed

WCAG 2.1 Levels A and AA apply across the patient-facing digital surface, not just the marketing site:

• The public website.
• The patient portal — usually a vendor product, and usually the surface patients spend the most time in.
• Documents — intake forms, after-visit summaries, financial policies, consent forms. Improperly structured PDFs that a screen reader cannot read are the single most common failure.
• Mobile apps, telehealth platforms, and social media accounts.

Documents are the part that does not get fixed by redesigning a site, and they are usually the largest single body of work. A practice with a clean, modern website and a decade of scanned intake forms is not in a good position — it just looks like one.

“A vendor built it” is not an answer

The obligation attaches to the covered entity, not to whoever built the software, and the regulation says so in terms. 45 CFR 84.84(b)(1) reaches web content and mobile apps a recipient “provides or makes available, directly or through contractual, licensing, or other arrangements”. A portal supplied by an EHR vendor and a website built by an agency are both made available through exactly such an arrangement. There is a third-party content exception at 84.85(c), but it does not apply where the third party posts under a contract or licence with you — which is the portal case precisely.

That does not mean you have to remediate someone else’s product yourself — but it does mean the vendor conversation has to happen, and it has to happen early enough that a contractual answer is still possible. Practices that start this in the final quarter before the deadline discover that their portal roadmap is not theirs to set. Which parts of a patient portal are actually in scope — and which patient documents the rule expressly leaves out — is its own guide.

Alternatives to strict conformance

45 CFR 84.87 permits alternative designs, methods or techniques where they result in substantially equivalent or greater accessibility and usability. That is a real allowance and worth knowing about — but note that it demands usability as well as accessibility, and it is a substantive equivalence test rather than an exemption. It has to be documented like one.

There is a second allowance one section further on, at 45 CFR 84.89, for noncompliance with a minimal impact on access — and, behind it, an enforcement chain that carries no fine at all. What actually happens if you miss the deadline follows that chain section by section: who can complain, the 180-day window, and what the funding remedy at the end of it really requires.

Where CivicBinder Health fits

The binder audits the website, the patient portal and the patient-facing documents against WCAG 2.1 AA, records what was tested and found, and gives remediation instructions written for the templates and documents you actually have — dated and attributable, so the work is evidenced rather than asserted.

Flat fees: $299 for a single practice site, $499 covering website, portal and documents, and $19/month for ongoing monitoring. Request a free scan to see where you stand — public surfaces only, no patient data.

If the question you actually came with is what this costs — including what HHS itself priced the requirement at, and why the extra year did not make the bill smaller — that is a separate guide.

And if you are already past the what and onto the who, what healthcare WCAG compliance vendors charge in 2026 reads the published rates off four vendors’ own pages — per page, per month and flat — and explains why quotes for the same practice differ by an order of magnitude.

Dates, standard and the rule carrying them re-verified on 30 July 2026 against the published text of the interim final rule (91 FR, doc. 2026-09266). The text of 45 CFR 92.204 and the coverage test were verified the same day against the codified regulation and the 2024 Section 1557 final rule (89 FR, doc. 2024-08711). The text of 45 CFR 84.84, 84.85 and 84.87 was verified on 31 July 2026 against the codified regulation as of the 1 July 2026 edition. Nothing here is legal advice.