Why a hospital’s accessibility deadline now sits in its vendor contracts

The week

On May 7, 2026, the HHS Office for Civil Rights announced an interim final rule, published in the Federal Register on May 11. It pushed back the web and mobile accessibility dates in its 2024 Section 504 rule by one year. Recipients of HHS financial assistance with 15 or more employees, which had faced a May 11, 2026 date, now had until May 11, 2027. Smaller recipients moved from May 10, 2027 to May 10, 2028. The technical standard, WCAG 2.1 Level AA, did not change. Other Section 504 duties, including the duty to make reasonable modifications, were not extended. HHS said it was aligning with the Justice Department’s April 2026 extension of the ADA Title II dates, and it took comments through July 6. Hospitals, health centers and other funded providers gained a year only days before the original date.

Earlier in this series we looked at the Justice Department’s extension for state and local governments. The HHS rule covers a different population, and its practical meaning differs too. A county mostly publishes its own content. A health system mostly buys its patient-facing estate. The portal, the scheduling tool, the bill-pay page, the telehealth app and the check-in kiosk usually come from vendors, each with its own release cycle. Section 504 responsibility stays with the funded provider regardless of who wrote the code. That makes the extra year a contracting year more than a remediation year.

A hospital’s digital estate splits into three layers with different owners: content the hospital writes, platforms the hospital configures, and services a vendor runs on its behalf. Each needs a different instrument. Together they cover everything a patient touches online.

Content the hospital writes

This layer includes the public website, service-line pages, patient education handouts, intake and consent forms, financial assistance policies and price transparency pages. It is the only layer the hospital fully controls, and it usually holds the largest backlog. Documents are the hard part. Marketing, nursing education, revenue cycle and compliance each publish PDFs, often from scanned originals or design tools that strip the structure screen readers depend on.

The workable approach is to fix content where it is made. That means accessible templates in the office suite staff already use, a short pre-publication check owned by each publishing department, and a content inventory with an owner and a disposition for every item. Much of what sits on hospital websites is stale, and retiring it is cheaper than repairing it. Forms deserve priority over brochures. An inaccessible financial assistance application blocks a benefit, while an inaccessible brochure blocks information that may exist elsewhere.

Remediation tools have improved, including automated tagging of PDFs. Automated output still needs human review of reading order, alternative text and form labels before anything clinical or financial is published. A realistic budget pays for that review as well as for software. A useful measure is the share of patient-facing PDFs that have passed a manual check, reported alongside the scan results.

Measurement keeps the layer honest. A monthly scan of new pages and documents, reported by publishing department, shows where new debt is being created. Pairing it with a quarterly manual test of the highest-traffic patient tasks, such as finding a clinic, paying a bill or requesting records, catches what scanners miss. Both results belong in the same governance forum that approves web content, not in a separate IT report.

Platforms the hospital configures

The patient portal, online scheduling, telehealth and the mobile app are built by vendors but configured, branded and extended locally. Failures here have two sources. Some sit in the vendor’s code: a date picker that cannot be operated by keyboard, or a video visit window that traps screen reader focus. Others are introduced by the hospital: custom questionnaires, images uploaded without descriptions, low-contrast brand colors and embedded third-party widgets.

Contracts should split those responsibilities explicitly. The vendor should warrant WCAG 2.1 AA conformance for the base product. It should supply a current accessibility conformance report for each major release and fix defects within defined times by severity. The hospital should own its configuration, with an accessibility test inside its own change process. A conformance report is a vendor’s claim. The agreement should let the hospital or an independent tester verify it, and should oblige the vendor to disclose known defects without waiting for complaints.

Release cadence matters as much as initial conformance. Large portal and EHR vendors ship updates several times a year, and an update can undo a fix. A useful clause ties regression testing to each release and gives the hospital notice before patient-facing changes go live. Health systems on the same platform can also pool effort. User groups can test common workflows once, share results and press the vendor together on a single defect list.

Services a vendor runs on the hospital’s behalf

The third layer is the least visible. Statements from an outsourced billing company, payment pages from a processor, text reminders and surveys, after-hours answering services, chat assistants and lobby kiosks are often run end to end by a third party. Patients experience them as the hospital. Many of these contracts were signed by revenue cycle, patient experience or facilities teams rather than IT, and few mention accessibility at all.

The first task here is discovery. Procurement and accounts payable records can show which vendors deliver anything a patient sees or hears. Each should be asked for conformance evidence and a remediation plan. The gaps can then be ranked by how many patients a service reaches and whether it gates care or payment. Kiosks need particular attention. A check-in device that cannot be used independently pushes patients to a staffed desk that may not exist at every site or every hour.

Renewal dates set the pace. Many of these agreements run for one to three years, so an extra year gives most hospitals at least one renewal in which to add accessibility terms. A shared clause library helps: legal, procurement and compliance agree the language once, and every patient-facing purchase uses it. Organizations should check with counsel on how responsibility is allocated under existing agreements, and on which Section 504 duties continue to apply in the meantime.

With hindsight

Writing in October 2026, the extended dates stand as HHS published them, as far as we have seen, and the comment period closed in July. Because the change came by interim final rule, organizations should still confirm the current dates with counsel. The two extensions together set a consistent pattern across federal civil rights rules: 2027 for larger entities, 2028 for smaller ones, and WCAG 2.1 AA as the target throughout. Neither extension touched the older duties to communicate effectively and to make reasonable modifications, so patients could still raise complaints in the meantime. The PDF backlog remains the stubborn part of the work, and automated tools still need human review. The procurement point has held up. The patient-facing services that change fastest are the ones hospitals do not build, and the contract is the only place a hospital can set how those services behave.