Field Notes · 04

Website accessibility law for medical practices, in plain English

Three separate federal rules can reach a clinic website, and the deadlines just moved. Here is which ones apply to you, what standard they point to, and where the real risk sits.

Patrick Jean-Baptiste · September 2, 2026

Every few months a clinic owner forwards me a demand letter, or an email from a vendor warning that a compliance deadline is days away, and asks whether it is real. The honest answer is usually "partly." The rules are real. The deadlines are real. The vendor's sense of urgency is usually a sales pitch.

This note lays out the three federal rules that can reach a medical practice website, which one applies to you, and what they actually ask for. I build websites for a living and I have no law license, so treat this as preparation for a conversation with your attorney.

The standard everyone points to: WCAG 2.1 Level AA

Before the rules, the yardstick. Every federal regulation discussed below points to the same technical standard: the Web Content Accessibility Guidelines, version 2.1, Level AA. WCAG is published by the W3C, the same body that maintains HTML itself. Version 2.2 exists and is a little stricter, but 2.1 AA is what the regulations name.

WCAG 2.1 AA is about fifty testable criteria. Text contrast, keyboard operability, labeled form fields, captions on video, a logical heading structure, no content that flashes. The ten signs I described in a separate note map directly onto it. There is no certification, no badge, and no government body that stamps your site as compliant. You either meet the criteria or you do not, and the people who decide are auditors, plaintiffs and judges.

Rule one: Section 504 of the Rehabilitation Act (HHS)

This is the one that matters most for private practices, and the one with the deadline that just moved.

In May 2024 the Department of Health and Human Services finalized a rule under Section 504 that, for the first time, requires recipients of HHS funding to make their websites and mobile apps conform to WCAG 2.1 AA. "Recipients of HHS funding" is broader than it sounds. If your practice participates in Medicaid, CHIP, Medicare Advantage or most other federal health programs, you are almost certainly covered. Traditional Medicare Part B on its own has historically been treated differently, which is a question for your attorney.

The original compliance dates were May 2026 for practices with fifteen or more employees and May 2027 for smaller ones. On May 7, 2026, HHS extended both by a year. The new dates are May 11, 2027 for practices with fifteen or more employees and May 10, 2028 for practices with fewer than fifteen.

Two things to understand about that extension. First, it moved the deadline for the specific technical standard, and nothing else. Section 504's general prohibition on discrimination has applied to your website all along. Second, a year sounds like a long time until you realize that most practices have never had their site tested, do not know how bad it is, and are relying on a template vendor who has never heard of WCAG. Start now and the deadline is comfortable. Start in early 2027 and you are paying rush rates.

Rule two: the Americans with Disabilities Act, Title III

Title III covers "places of public accommodation," and a doctor's office is named explicitly in the statute. The Department of Justice has said for more than a decade that this extends to the websites of those businesses. What DOJ has never done for Title III is publish a technical regulation saying what an accessible website is. That gap is where the lawsuits live.

More than 5,000 website accessibility lawsuits were filed in federal and state courts in 2025, a number that has climbed nearly every year for a decade. The filings are concentrated in New York, Florida, California, Pennsylvania and Illinois. Florida practices are in one of the busiest jurisdictions in the country for these cases. Most are filed by a small number of firms on behalf of serial plaintiffs, they cite WCAG as the measure of failure, and the overwhelming majority settle for a five-figure sum plus a promise to remediate. The settlement is usually cheaper than the defense, which is the entire business model.

Health care is a consistent target because the harm is easy to describe to a judge. A blind plaintiff who cannot book an appointment or read a form is a more sympathetic story than one who cannot buy a sweater.

There is no deadline under Title III because there is no rule to have a deadline. The exposure is continuous.

Rule three: ADA Title II (for public entities only)

If you are a county health department, a public hospital district, a community college clinic or any other arm of state or local government, Title II applies instead. DOJ finalized a Title II web rule in April 2024, also pointing at WCAG 2.1 AA. Entities serving populations of 50,000 or more had until April 24, 2026. Smaller entities and special districts have until April 26, 2027. Private practices can skip this section, but if you run a website for a public entity, your first deadline has already passed.

Florida-specific notes

Florida has no separate state web accessibility statute for private businesses, so the federal rules above are the operative ones. What Florida does have is a very active plaintiffs' bar and a federal bench that has seen a lot of these cases. Do not count on a dismissal.

What "compliant" costs, and what it does not

The good news is that WCAG 2.1 AA is a design and content discipline, and it is not expensive to build in from the start. On a small brochure-style clinic site, the entire remediation is typically a few days of work: fixing contrast, adding labels and alt text, repairing the heading outline, making the navigation keyboard-operable, and replacing scanned PDF forms with real ones. A site built correctly stays compliant with ordinary care.

What does not make you compliant:

An accessibility overlay widget. These are the pop-up panels sold by subscription that promise automated compliance. They do not fix the underlying code, they are regularly named in lawsuits against the sites that installed them, and in 2025 the Federal Trade Commission ordered one of the largest vendors to pay a million dollars over its compliance claims. Installing one is the equivalent of putting a "wheelchair accessible" sign on a building with a step at the door.

An accessibility statement page by itself. Worth having, because it signals good faith and gives patients a way to report barriers. Useless without the work behind it.

A scan that came back green. Automated scanners catch roughly a third of WCAG failures. They will never tell you that your alt text is meaningless or that your form cannot be completed with a keyboard.

Where to start

Test the site yourself using the ten signs, or have someone do a manual review, then work through the fix-it sequence. Fix contrast, labels, alt text and headings first; they are cheap and they remove the most obvious grounds for a demand letter. Then address keyboard navigation and forms, which are the substantive issues. Put an accessibility statement on the site with a real email address for reporting problems. Then talk to your attorney about which of the three rules applies to your practice and whether your vendor contracts cover any of this.

If the site is built on a page-builder theme with a dozen plugins, be prepared for the answer to be that it is easier to rebuild it correctly than to patch it. That is often true, and the rebuild usually ends up faster and cheaper to run as well.