The funding you can't afford to lose: ADA compliance and what the May 11th deadline really means

Update: HHS’ Office for Civil Rights Extends Web and Mobile Accessibility Compliance Deadline

• Recipients with 15 or more employees will now have until May 11, 2027, to comply.
• Recipients with fewer than 15 employees will now have until May 10, 2028, to comply.

‍

Let's cut straight to it. Most conversations about ADA web compliance center on the threat of lawsuits. And yes, that risk is very real. But for medical practices, behavioral health organizations, community health centers, and wellness providers that receive federal funding, there's a more immediate and arguably more devastating consequence sitting quietly in the fine print: the loss of your Medicare and Medicaid reimbursements.

That's not hyperbole. That's the law.

What changes on May 11th, 2027

The Department of Health and Human Services finalized its Section 504 rule under the Rehabilitation Act, and the compliance clock starts ticking on May 11, 2027. For organizations with 15 or more employees, that date has already passed.

Section 504 has existed for decades, but HHS has now given it teeth in the digital space. For the first time, the rule explicitly requires that your website and mobile applications meet WCAG 2.1 Level AA standards, the same technical benchmark we've covered before in the context of ADA litigation. The difference here is who's holding the stick.

Under the ADA, a private plaintiff's attorney files a lawsuit. Under Section 504, the Office for Civil Rights (OCR), an arm of the federal government, can open a compliance investigation, issue corrective action directives, and ultimately recommend the suspension or termination of your federal financial assistance.

Read that last part again. For most practices, Medicare and Medicaid aren't just a payment stream; they're the financial backbone of the entire organization.

What if your practice doesn't accept Medicare or Medicaid? You're not off the hook; you're just exposed differently. ADA Title III classifies every private medical and wellness practice that serves the public as a "public accommodation," regardless of how you're paid. That means private-pay practices, concierge medicine, med spas, and cash-only clinics are subject to the same WCAG 2.1 AA compliance obligation. 

The difference is the enforcement path: instead of OCR and federal funding loss, your risk is private plaintiff litigation, the "click-by" lawsuit we've covered before. Same standard, different stick.

"We take Medicare, does this really apply to us?"

Yes. Unambiguously.

The trigger for Section 504 is the receipt of "federal financial assistance." Medicare reimbursements qualify. Medicaid reimbursements qualify. Federal grants for community health programs qualify. If any federal dollars flow into your organization, you are a covered entity under this rule.

Here's where it gets important to understand the two-deadline structure:

• Organizations with 15 or more employees: Deadline is May 11, 2027. You are already in the enforcement window.
• Organizations with fewer than 15 employees: Deadline is May 10, 2028. You have time, use it.

If you fall into the first category and haven't acted yet, this isn't a reason to panic, but it absolutely is a reason to move quickly and deliberately. The OCR doesn't typically show up on May 12th with a termination letter. Enforcement is complaint-driven and investigation-based. But the moment a patient with a disability files a complaint because they couldn't navigate your patient portal or read your informed consent form, you are officially on the clock, and your federal funding is on the table.

The "catch-all" you can't escape

Even for smaller organizations still within their deadline window, there's a provision worth understanding: the ADA Title III "catch-all."

This clause means that, regardless of whether you're technically past your Section 504 deadline, you are already legally obligated to provide meaningful access to patients with disabilities. If someone can't use your website due to an accessibility barrier, you can't simply point to a future deadline and say, "We'll fix it." The obligation to provide effective communication exists right now.

The WCAG 2.1 AA deadline sets the standard for how your website must be built. The duty not to discriminate has always been in effect.

What OCR enforcement actually looks like

Understanding the mechanics of enforcement helps you assess your real risk level.

The Office for Civil Rights doesn't conduct random sweeps of medical websites, at least not yet. What they do respond to is formal complaints filed by patients or disability advocacy organizations. When a complaint is filed, OCR initiates an investigation that typically involves:

1. A formal request for documentation of your accessibility policies and remediation efforts
2. A technical review of your web content against WCAG 2.1 AA criteria
3. A negotiated corrective action plan if violations are found

If you cooperate and demonstrate a good-faith remediation effort, the outcome is usually a compliance agreement with a defined timeline. If you ignore the investigation or demonstrate willful non-compliance, the consequences escalate, up to and including the referral of your case to the Department of Justice and the suspension of federal funding.

The good news: organizations that have already begun remediation, documented their efforts, and can show a clear compliance roadmap are in a significantly stronger position, even if the work isn't 100% complete.

Your third-party tools are your responsibility, too

Here's a detail that catches many compliance officers off guard. The HHS rule holds you accountable for the accessibility of any digital tool you provide or make available to patients, even if you didn't build it yourself.

That scheduling widget from a third-party vendor? Your responsibility. Is the telehealth platform embedded in your patient portal? Your responsibility. The online intake form from your EHR system? Your responsibility.

The practical implication: reach out to every digital vendor you work with and request a VPAT (Voluntary Product Accessibility Template). A VPAT is a standardized document that details how a product conforms to WCAG criteria. If a vendor can't provide one, that's a red flag worth taking seriously.

The bottom line for federally funded organizations

The May 11th deadline reframes the ADA web compliance conversation entirely for practices and organizations that receive federal funding. This is no longer just about avoiding plaintiff attorneys; it's about protecting the revenue stream your organization depends on to operate.

The path forward isn't complicated, but it does require intentional action:

• Know which deadline applies to your organization
• Audit your website and mobile applications against WCAG 2.1 AA standards
• Request VPATs from your third-party digital vendors
• Document your remediation efforts, even work in progress
• Establish an ongoing maintenance process; accessibility isn't a one-time fix

Want to know exactly where your website stands? Our ADA Compliance White Paper walks through the 10 technical essentials for WCAG 2.1 compliance, a 4-phase remediation roadmap, and a vendor compliance toolkit you can put to work immediately.

And if you'd rather talk through your specific situation, schedule a free strategy call with our team. We work exclusively with healthcare and wellness organizations; we speak your language and understand your compliance environment.

Your Compliance Questions, Answered Plainly

Q1: Does the May 11th HHS deadline apply to my practice if we accept Medicare or Medicaid?
Yes unambiguously. The trigger for Section 504 of the Rehabilitation Act is receiving "federal financial assistance." Medicare reimbursements qualify. Medicaid reimbursements qualify. Federal grants for community health programs qualify. If any federal dollars flow into your organization, you are a covered entity and the deadline applies.

Q2: What happens if my practice misses the May 11th compliance deadline?
The Office for Civil Rights (OCR) doesn't show up the next day with a termination letter; enforcement is complaint-driven. But the moment a patient with a disability files a complaint because they couldn't use your patient portal or read your intake form, OCR can open a formal investigation. That process can lead to a corrective action plan, and if you don't cooperate, it can escalate to referral to the Department of Justice and suspension of your federal funding, including Medicare and Medicaid reimbursements.

Q3: My practice has fewer than 15 employees. Do I still need to comply?
Your Section 504 deadline is May 10, 2028 You have more time. But you are not off the hook today. ADA Title III's duty to provide meaningful access to patients with disabilities is already in effect regardless of your organization's size. A smaller deadline doesn't eliminate your current legal obligation; it just sets the technical standard timeline.

Q4: We're a private-pay, cash-only practice. Does any of this apply to us?
Yes, just through a different enforcement path. ADA Title III classifies every private medical and wellness practice that serves the public as a "public accommodation." That includes concierge medicine, med spas, and cash-only clinics. Your compliance standard is the same as WCAG 2.1 Level AA, but instead of OCR and federal funding loss, your risk is private-plaintiff litigation.

Q5: What exactly is WCAG 2.1 Level AA, and how do I know if my website meets it?
WCAG 2.1 Level AA is the technical accessibility standard required by the HHS rule. It covers things like sufficient color contrast, keyboard navigability, screen reader compatibility, proper image alt text, and accessible forms. The only way to know if your site meets it is through a proper audit, including both automated scanning and manual testing. Automated tools alone catch roughly 30–40% of issues; human review is required for the rest.

Q6: Are my third-party tools, such as scheduling software, telehealth platforms, and intake forms, also my responsibility?
Yes. The HHS rule holds you accountable for any digital tool you provide or make available to patients, even if you didn't build it. Start by requesting a VPAT (Voluntary Product Accessibility Template) from every digital vendor you work with. A VPAT documents how their product conforms to WCAG. If a vendor can't or won't provide one, that's a compliance risk you're carrying.

Q7: We haven't started yet. Is it too late to avoid enforcement consequences?
Not necessarily. Organizations that can document a good-faith remediation effort, even if work is in progress, are in a significantly stronger position if an OCR complaint is filed. The worst position to be in is no documentation, no audit, and no plan. Starting now and building a clear compliance roadmap matters, even if you're past the deadline.