Your HHS Grant Now Comes With a Website Deadline: What Section 504 Requires by May 2027

On May 7, 2026, the Department of Health and Human Services published an interim final rule extending compliance deadlines for web and mobile app accessibility under Section 504 of the Rehabilitation Act. If your organization receives HHS financial assistance and has 15 or more employees, you now have until May 11, 2027 to make your website and mobile applications conform to WCAG 2.1 Level AA. Organizations with fewer than 15 employees have until May 10, 2028.

You probably have not heard about this. Almost all of the web accessibility coverage this spring focused on the DOJ extending ADA Title II deadlines, which apply to state and local governments. The HHS rule moved on a parallel track, got less press, and applies to a completely different set of organizations: recipients of HHS financial assistance. That includes community health centers, social services programs, health-adjacent nonprofits, and a long list of associations that receive federal grants or pass-through funding without thinking of themselves as regulated entities.

This post answers the four questions an executive director actually has: does this apply to us, which deadline is ours, what does WCAG 2.1 AA mean on a site like ours, and what happens if we miss it.

Does This Apply to Your Organization?

Section 504 of the Rehabilitation Act applies to any organization that receives federal financial assistance. The HHS rule specifically covers recipients of HHS financial assistance, which is broader than most executive directors realize. HHS administers more than 100 grant programs across agencies including the Administration for Children and Families, the Health Resources and Services Administration, the Substance Abuse and Mental Health Services Administration, the Centers for Disease Control and Prevention, and the National Institutes of Health.

If your association or nonprofit receives any of the following, this rule applies to you:

• Direct HHS grants (community health, behavioural health, workforce development, public health preparedness)
• Federal pass-through funding (state or county agencies distributing HHS funds to subrecipients)
• Cooperative agreements with any HHS operating division
• Medicaid or Medicare participation (for health-care-adjacent organizations)

The key phrase is "recipients of federal financial assistance." If your organization has a grant from any HHS program, you are a recipient. If a state agency distributes HHS funds to your organization as a subgrant, you are a recipient. The rule does not distinguish between direct and indirect funding.

This is not ADA Title II, which covers state and local governments. This is not ADA Title III, which covers places of public accommodation and has no explicit web standard. This is Section 504, and it now has a specific technical standard (WCAG 2.1 Level AA) and a specific compliance date.

Which Deadline Is Yours?

The HHS interim final rule, published in the Federal Register on May 11, 2026, establishes two compliance tiers:

• Recipients with 15 or more employees: May 11, 2027
• Recipients with fewer than 15 employees: May 10, 2028

These dates are extensions. The original compliance dates were May 11, 2026 and May 10, 2027 respectively, set by the May 9, 2024 final rule. HHS extended them because, in the words of the Office for Civil Rights, many covered entities indicated they would not be able to meet the original deadlines.

The interim final rule is still governing as of this writing. Comments closed on July 6, 2026. No final rule has been published yet, which means the dates could move again. But "could move" is not a compliance strategy. The safest assumption is May 11, 2027 for most associations.

For comparison, the DOJ extended the ADA Title II deadlines to April 26, 2027 for larger public entities and April 26, 2028 for smaller ones. Both rules converge on the same technical standard: WCAG 2.1 Level AA.

What WCAG 2.1 Level AA Actually Means on Your Website

WCAG 2.1 Level AA is a set of 50 success criteria published by the World Wide Web Consortium. It covers four principles: perceivable, operable, understandable, and robust. In practice, on a typical association or nonprofit website, it means:

Every image has alternative text. Screen readers announce what the image conveys. Decorative images are marked so screen readers skip them.

Every form field has a visible label. Placeholder text inside a field does not count. Labels must be programmatically associated with their inputs so assistive technology can announce them. Error messages must identify which field has the error and describe how to fix it, not just turn the border red.

All interactive elements are keyboard accessible. A user who cannot use a mouse must be able to navigate your entire site, including menus, forms, and modal dialogs, using only the keyboard. Focus must be visible, and it must follow a logical order.

Text meets minimum contrast ratios. Normal text needs a 4.5:1 contrast ratio against its background. Large text (18pt or 14pt bold) needs 3:1. Gray text on white backgrounds, which is common in modern designs, almost always fails.

Video content has captions. Pre-recorded video needs synchronised captions. Live video needs captions if technically feasible. Auto-generated captions from YouTube or Vimeo are a starting point but are not sufficient on their own because they miss technical terms, proper nouns, and context.

PDF documents are tagged and navigable. A PDF that was created by printing a Word document to PDF without running accessibility checks is not compliant. Tagged PDFs have heading structure, reading order, and alternative text for images. Most associations have years of board reports, white papers, and annual reports behind their member login that have never been tagged.

The Three Things That Reliably Fail on Association Websites

We have audited dozens of association and nonprofit websites against WCAG 2.1 AA. Three categories of failure appear on nearly every site:

1. The membership or donation form. This is consistently the worst-performing page on the site. Inputs lack associated labels. Required fields are indicated only by color (a red asterisk that a color-blind user cannot distinguish). Error messages appear in a banner at the top of the form without identifying which specific field caused the error. Multi-step forms lose focus between steps, stranding keyboard users. Payment fields embedded from a third-party processor often have their own accessibility failures that you inherit.

2. Gated PDFs. Associations routinely publish research reports, policy briefs, standards documents, and board materials as PDFs behind a login wall. Most of these were never tagged for accessibility. They have no heading structure, no reading order, no alternative text on charts and graphs, and no bookmarks for navigation. A 40-page annual report that a sighted user can scan in five minutes is effectively a wall of undifferentiated text to a screen reader user. The volume is usually the problem: a site might have 200 PDFs accumulated over five years, and remediating all of them is a project in itself.

3. The event calendar or registration flow. Many associations use a third-party embed for event registration (Cvent, Eventbrite, a custom iframe from their AMS). These embeds are outside your direct control. They often fail keyboard navigation, drop focus after form submission, and present date pickers that are completely inaccessible to screen reader users. The legal exposure is yours, not the vendor's, because the user experience is on your website.

What Happens If You Miss the Deadline

The extensions are not relief. They move a federal compliance date. They do not reduce your legal exposure in three other areas:

Private litigation. Accessibility lawsuits against websites have increased every year since 2018. The ADA Title III theory (websites as places of public accommodation) does not require a specific technical standard, which means a plaintiff does not need to wait for a federal compliance date to file suit. Courts have been using WCAG as a benchmark in ADA Title III cases for years.

OCR complaints. The HHS Office for Civil Rights investigates complaints under Section 504. An extension of the compliance deadline does not prevent someone from filing a complaint. It may influence how OCR evaluates your good-faith efforts, but it does not create a safe harbour.

Procurement requirements. Grant renewal applications, government contracts, and enterprise procurement processes are increasingly asking for documented accessibility conformance evidence. Level Access, which sells accessibility services and should be read with that interest in mind, reports that the first year of European Accessibility Act enforcement has led enterprise and public-sector buyers to routinely require documented conformance during vendor selection and renewal. The same trend is emerging in U.S. federal and state procurement. If your association competes for contracts or grant renewals, your accessibility posture is becoming part of the evaluation.

What You Can Do Before the Deadline

Ten months is enough time to audit and remediate a typical association website. It is not enough time if you start in March 2027. The work has four phases:

Audit. A WCAG 2.1 AA audit against your production site identifies every failure, ranks them by severity, and maps them to the specific success criterion they violate. Automated tools catch about 30 percent of issues. The rest require manual testing with a screen reader, keyboard navigation, and human judgment.

Remediation plan. A dated schedule that assigns each finding to a sprint or milestone. Critical failures (forms that cannot be submitted, content that cannot be perceived) come first. The plan needs to account for the PDF backlog separately, because remediating 200 PDFs is a different workflow from fixing template-level issues.

Accessibility statement. A published page on your website that states which standard you conform to, identifies any known limitations, and provides a mechanism for users to report barriers. The HHS rule requires a feedback mechanism. A working contact form or email address dedicated to accessibility feedback satisfies this, but only if someone actually monitors it.

Ongoing monitoring. Accessibility is not a one-time project. Every new page, every content update, every plugin update can introduce new failures. Ongoing monitoring means automated scans on a schedule, manual checks when templates change, and training for content editors so they do not reintroduce failures with every blog post or event listing.

The Engagement Is Scopeable

The addressable cohort for this rule is specific: organizations that receive HHS financial assistance and have 15 or more employees. The technical standard is defined: WCAG 2.1 Level AA. The deadline is fixed: May 11, 2027. That makes this a scopeable engagement, not an open-ended compliance program.

An audit, a remediation plan with a dated schedule, a published accessibility statement, and a working feedback mechanism. That is what the rule requires. That is what we deliver.