Field Notes · 04

Website accessibility law for medical practices, in plain English

Three federal rules can reach a clinic website, and the deadlines just moved. Here is which ones apply to you, what standard they point to, and where the real risk sits.

Patrick Jean-Baptiste · September 2, 2026

Every few months a clinic owner forwards me a demand letter, or a vendor's email warning that a compliance deadline is days away. They ask whether it is real. The answer is usually "partly." The rules are real. The deadlines are real. The vendor's sense of urgency is a sales pitch.

This note lays out the three federal rules that can reach a medical practice website, which one applies to you, and what they ask for. I build websites for a living and I have no law license. Treat this as preparation for a conversation with your attorney.

The standard everyone points to: WCAG 2.1 Level AA

First, the yardstick. Every federal rule below points to the same technical standard: the Web Content Accessibility Guidelines, version 2.1, Level AA. WCAG is published by the W3C, the same body that maintains HTML. Version 2.2 exists and is a little stricter, but 2.1 AA is the version the regulations name.

WCAG 2.1 AA is about fifty testable criteria. Text contrast, keyboard operability, labeled form fields, captions on video, a logical heading structure and no flashing content are among them. The ten signs I described in a separate note map directly onto it.

There is no certification and no badge. No government body stamps your site as compliant. You meet the criteria or you do not, and auditors, plaintiffs and judges make the call.

Rule one: Section 504 of the Rehabilitation Act (HHS)

This rule matters most for private practices, and its deadline just moved.

In May 2024 the Department of Health and Human Services finalized a rule under Section 504. For the first time, recipients of HHS funding must make their websites and mobile apps conform to WCAG 2.1 AA. "Recipients of HHS funding" reaches further than it sounds. If your practice takes part in Medicaid, CHIP, Medicare Advantage or most other federal health programs, you are almost certainly covered. Traditional Medicare Part B on its own has been treated differently, and that is a question for your attorney.

The original compliance dates were May 2026 for practices with fifteen or more employees and May 2027 for smaller ones. On May 7, 2026, HHS pushed both back a year. The new dates are May 11, 2027 for practices with fifteen or more employees and May 10, 2028 for practices with fewer than fifteen.

Two points about that extension. First, it moved the deadline for the technical standard and nothing else. Section 504's general ban on discrimination has applied to your website all along.

Second, a year sounds long. Most practices have never had their site tested, do not know how bad it is, and rely on a template vendor who has never heard of WCAG. Start now and the deadline is comfortable. Start in early 2027 and you pay rush rates.

Rule two: the Americans with Disabilities Act, Title III

Title III covers "places of public accommodation," and the statute names a doctor's office explicitly. The Department of Justice has said for more than a decade that this extends to those businesses' websites. DOJ has never published a Title III regulation that defines an accessible website. The lawsuits live in that gap.

More than 5,000 website accessibility lawsuits were filed in federal and state courts in 2025. The number has climbed nearly every year for a decade. The filings cluster in New York, Florida, California, Pennsylvania and Illinois, so Florida practices sit in one of the busiest jurisdictions in the country.

A small number of firms file most of these cases on behalf of serial plaintiffs. They cite WCAG as the measure of failure. Most cases settle for a five-figure sum plus a promise to fix the site. The settlement usually costs less than the defense, and that is the whole business model.

Health care is a steady target because the harm is easy to describe to a judge. A blind plaintiff who cannot book an appointment or read a form makes a stronger story than one who cannot buy a sweater.

Title III has no deadline, because there is no rule to set one. The exposure is continuous.

Rule three: ADA Title II (for public entities only)

County health departments, public hospital districts, community college clinics and other arms of state or local government fall under Title II. DOJ finalized a Title II web rule in April 2024, and it also points at WCAG 2.1 AA. Entities serving populations of 50,000 or more had until April 24, 2026. Smaller entities and special districts have until April 26, 2027.

Private practices can skip this section. If you run a website for a public entity, your first deadline has already passed.

Florida-specific notes

Florida has no separate state web accessibility law for private businesses, so the federal rules above are the ones that apply. Florida does have a very active plaintiffs' bar and a federal bench that has seen many of these cases. Do not count on a dismissal.

What "compliant" costs, and what it does not

WCAG 2.1 AA is a design and content discipline, and building it in from the start costs little. On a small brochure-style clinic site, the full fix usually takes a few days. That covers contrast, labels and alt text, the heading outline, keyboard-operable navigation, and real forms in place of scanned PDFs. A site built correctly stays compliant with ordinary care.

Three things do not make you compliant.

An accessibility overlay widget. These pop-up panels are sold by subscription with a promise of automated compliance. They do not fix the underlying code. They are regularly named in lawsuits against the sites that installed them. In 2025 the Federal Trade Commission ordered one of the largest vendors to pay a million dollars over its compliance claims. Installing one is like hanging a "wheelchair accessible" sign on a building with a step at the door.

An accessibility statement page by itself. It is worth having. It signals good faith and gives patients a way to report barriers. Without the work behind it, it does nothing.

A scan that came back green. Automated scanners catch roughly a third of WCAG failures. They will never tell you that your alt text is meaningless, or that your form cannot be completed with a keyboard.

Where to start

Test the site yourself with the ten signs, or have someone do a manual review. Then work through the fix-it sequence.

Fix contrast, labels, alt text and headings first. They are cheap, and they remove the most obvious grounds for a demand letter. Then take on keyboard navigation and forms, which are the substantive issues. Post an accessibility statement with a real email address for reporting problems. Then ask your attorney which of the three rules applies to your practice, and whether your vendor contracts cover any of this.

If the site runs on a page-builder theme with a dozen plugins, the answer may be that a correct rebuild is easier than a patch. That is often true, and the rebuilt site usually ends up faster and cheaper to run.