Question 1

Which practices does Section 1557 cover?

Accepted Answer

Section 1557 covers any health program that receives federal financial assistance — which includes accepting Medicare or Medicaid. That reaches nearly every clinic, dental office, and community health center.

Question 2

What if a third party built my website?

Accepted Answer

It still counts — the rule covers your website and patient portal even when a vendor built or hosts them. Your binder includes a dated remediation plan written as a work order you hand straight to your web vendor.

Question 3

Do I need any technical skills?

Accepted Answer

None. We run the scan, write every finding in plain language, and prepare the legal documents. You simply hand the remediation plan to whoever maintains your website.

Question 4

What exactly is the deadline?

Accepted Answer

Providers with 15 or more employees must comply by May 11, 2027; fewer than 15, by May 10, 2028. HHS extended these dates in 2026 — the requirement itself is not going away.

Question 5

Do you access any patient data?

Accepted Answer

No. We scan only your public website and the public front of your patient portal — never anything behind a login — and we store no patient data, only defect metadata.

Question 6

What does a Section 1557 website accessibility engagement actually involve?

Accepted Answer

Four steps, all of them run by us. We scan your public website, the public front of your patient portal and the documents you publish against WCAG 2.1 Level A and AA; we rank every failure by severity; we prepare the Notice of Nondiscrimination and accessibility statement for your practice to adopt and post; and we hand you a dated remediation plan written as a work order. WCAG 2.1 Level A and AA is the standard the regulation itself names, at 45 CFR 84.84. The Readiness Binder is $299 one-time for a single-location practice and $499 for multi-site or FQHC coverage.

Question 7

What does our practice have to hand over to start?

Accepted Answer

Four things, none of them clinical: your website address, the public address of your patient portal login, your employee count, and a list of the documents you publish — intake forms, fee schedules, notices. The employee count is what decides your date, because 45 CFR 84.84(b) sets May 11, 2027 for recipients with fifteen or more employees and May 10, 2028 for recipients with fewer. We ask for no logins, no credentials and no patient records, so there is no protected health information involved and no business associate agreement to sign.

Question 8

What is not included in the binder?

Accepted Answer

Three things, stated plainly. The binder is an evidence record, not legal advice — it does not replace an attorney reading your obligations. We do not edit your website ourselves; the remediation plan is written for whoever maintains it, in-house or a vendor. And we do not install an accessibility overlay widget: 45 CFR 84.84 requires the web content a recipient provides or makes available to comply with WCAG 2.1 Level A and AA, and a script layered over the page does not change what the underlying content is.

Question 9

How many organizations does the rule cover?

Accepted Answer

About 453,084. That is HHS’s own count, from the Regulatory Impact Analysis published with the 2024 section 504 final rule: “Table 6 of the Regulatory Impact Analysis reports that there are about 453,084 recipients covered by this rulemaking” (89 FR 40179). It counts every recipient of federal financial assistance from HHS rather than health care alone, but it is why a single-dentist office and a hospital system are reading the same regulation and the same two dates.

Security

Reporting a vulnerability

Accounts

What is stored

Who else processes data

Also true