Healthcare Website Accessibility: The HHS Deadline Moved to 2027

In May 2026, HHS extended the compliance deadline for its web and mobile accessibility rule by one year. If you run a healthcare website that receives federal funding, that sounds like breathing room. It mostly is not, and this post explains why. The extension moves one administrative deadline. It does nothing to the private lawsuits that are already the larger day-to-day risk for most healthcare providers.

Who this rule actually covers

The rule reaches any entity that receives federal financial assistance through HHS. In practice that is most of healthcare, because Medicare and Medicaid payments count as federal financial assistance. Hospitals, community health centers, dental and medical practices that bill Medicare or Medicaid, behavioral health providers, Head Start agencies, and state health programs all fall inside it. If your practice accepts Medicaid or Medicare patients, assume you are covered.

The employee count that sets your deadline is the recipient's total headcount, not the number of people who touch the website. A three-provider clinic with front-desk, billing, and clinical staff can easily cross fifteen employees, which puts it in the May 2027 tier rather than 2028. When you are close to the line, plan for the earlier date.

Why HHS pushed the date

HHS cited the same reasons the Department of Justice gave when it extended the parallel ADA Title II deadline for state and local governments in April 2026: recipients reported that remediation was taking longer than expected, that qualified vendors were scarce, and, notably, that generative AI tools were not delivering the automated fixes some had counted on. The agency chose to extend rather than enforce against providers acting in good faith.

What WCAG 2.1 AA requires on a healthcare site

The technical standard is the same one courts reference in ADA website cases, so meeting it serves both purposes at once. The failures that show up most often on healthcare sites:

• Online appointment booking that a keyboard cannot operate: date pickers, time-slot grids, and multi-step forms built for the mouse only
• Insurance verification forms with carrier dropdowns of two hundred options and no type-to-search, and fields labeled only by placeholder text
• Patient intake forms posted as scanned-image PDFs, which are invisible to a screen reader and a documented failure pattern under the rule
• Provider and location pages where portraits carry no alternative text and Book buttons are unlabeled icons
• Low-contrast text on the disclaimers and PHI warnings that carry real legal weight

The patient portal deserves a separate note. Most portals sit behind a login, which puts them outside a public sitemap scan, but they are squarely inside the rule. Portals have to be reviewed on their own, usually with the portal vendor. Our own dental and clinic checklist walks through the booking and intake failures in more detail.

The language-access overlap

Section 1557 treats disability access and language access together. A healthcare site that adds an accessibility statement should also address meaningful access for patients with limited English proficiency, because the same rule expects both. Many providers handle the two separately and leave a gap that a complaint can point to.

What to do before the deadline you actually care about

The honest deadline for most providers is not May 2027. It is the day a serial plaintiff's crawler reaches your site, which could be any day. The work is the same either way:

1. Scan the public pages a patient reaches before signing in: home, find-a-provider, appointment booking, insurance, contact, and any downloadable forms
2. Fix the keyboard and form failures first, because those are what screen-reader users hit and what demand letters cite
3. Replace scanned-image intake PDFs with real HTML forms or tagged PDFs that have text and labeled fields
4. Publish an accessibility statement that names WCAG 2.1 Level AA, references both ADA Title III and Section 1557, includes language access, and gives a monitored email and phone number
5. Keep a dated record of the scans and the fixes, because good-faith remediation history is the evidence that resolves both an HHS complaint and a private demand letter

If you want to see where your site stands right now, run a free WCAG 2.1 AA scan before you plan anything. And if a demand letter has already arrived, start with our 7-step response plan rather than calling the sender.

How Invoset fits

Invoset scans the public pages of a healthcare site against WCAG 2.1 Level AA on a schedule, emails you when a change introduces a new issue, and keeps a dated audit-trail PDF. That record is the good-faith documentation both an HHS administrative complaint and a private ADA demand letter look for. We test the public patient-facing pages; the portal behind the login is out of scan scope and should be reviewed with your portal vendor. Start with a free scan and decide from there.