HHS Section 504 web accessibility rule: what it means for your PDFs

If your hospital, clinic, health department or human services agency receives federal financial assistance from the U.S. Department of Health and Human Services (HHS), the Section 504 web accessibility rule applies to the PDFs you post. HHS adopted it in May 2024 as subpart I of 45 CFR part 84, with the same standard as the ADA Title II rule for governments: WCAG 2.1 Level AA. After a one-year extension in May 2026, recipients with 15 or more employees have until May 11, 2027, and smaller recipients until May 10, 2028, as of October 2026. Many older files can stay as they are, but the forms and current information patients rely on cannot. This guide covers who is covered, what is exempt, how common health documents sort out, and a plan you can start now. It is not legal advice, so confirm the details with counsel.

What the HHS Section 504 web rule requires

Section 504 of the Rehabilitation Act bars disability discrimination in programs that receive federal financial assistance. HHS rewrote its Section 504 regulation in a final rule published May 9, 2024. Under 45 CFR 84.84, web content and mobile apps that a recipient "provides or makes available, directly or through contractual, licensing, or other arrangements" must "comply with Level A and Level AA success criteria and conformance requirements specified in WCAG 2.1."

PDFs are covered by name. Web content includes conventional electronic documents, which 45 CFR 84.10 defines as files in "portable document formats (PDF), word processor file formats, presentation file formats, and spreadsheet file formats." Files a vendor posts for you count too, such as on an online bill-pay site.

For what WCAG 2.1 AA asks of a PDF, see our Title II guide and which checks software can fix.

Section 504 compliance dates for 2027 and 2028

HHS extended both dates in an interim final rule published May 11, 2026.

In HHS's words, "The amendments do not alter any other provisions from the 2024 final rule." Among its reasons, HHS cited comments on behalf of federally qualified health centers (FQHCs) that "some FQHCs have experienced issues with making the electronic documents they rely on fully accessible." HHS also plans further rulemaking on the rule's substance and will consider a proposed rule.

• The extension is being challenged. On May 21, 2026, the National Federation of the Blind sued DOJ and HHS in federal court in Maryland to set aside both extensions. As of October 2026, no ruling has been reported.
• Your existing duties did not move. The interim rule says: "Regardless of the compliance dates, recipients have an ongoing obligation to ensure that their programs and activities offered using web content and mobile apps are accessible to individuals with disabilities in accordance with their other obligations under section 504."
• The exception dates moved too. The archive and preexisting-document exceptions refer to your compliance date, so a PDF posted in August 2026 could now count as preexisting. Confirm with counsel how the new date applies while the lawsuit is pending.

Who must comply with Section 504

A recipient is any government, agency, institution or organization that receives federal financial assistance from HHS, "directly or through another recipient," including through subgrants. HHS's fact sheet lists "doctors, dentists, hospitals, clinics, emergency rooms, and other health care providers," child welfare agencies, medical and nursing schools, and social service providers, funded through programs such as Medicare, Medicaid, Head Start and TANF. That takes in health departments, community health centers, state Medicaid and human services agencies, and many universities and nonprofits.

The whole organization is often covered. The definition of "program or activity" reaches all the operations of a government department or agency that receives the assistance, an entire university, and an entire private organization "principally engaged in the business of providing education, health care, housing, social services, or parks and recreation." A health system's whole website is in scope, not only the grant-funded pages.

Medicare Part B may count. Medicare Part A has long been treated as federal financial assistance. In its May 2024 Section 1557 rule, HHS said it also treats Part B payments to providers as federal financial assistance, for Section 504 as well. A practice whose only federal funding is Part B should confirm with counsel, as should any recipient near the 15-employee line.

Which PDFs are exempt under 45 CFR 84.85

The five exceptions match Title II's in substance. HHS ties its dates to employee count rather than population, says "programs or activities" where DOJ says "services, programs, or activities," and words the fourth exception's title slightly differently.

1. Archived web content, if it was created before your compliance date, is kept only for reference, research or recordkeeping, is unchanged since archiving, and sits in an area clearly identified as archived.
2. Preexisting conventional electronic documents, "unless such documents are currently used to apply for, gain access to, or participate in the recipient's programs or activities." HHS's own example of a document in current use is "a PDF form that must be filled out and submitted when submitting medical information to a health provider."
3. Content posted by a third party, such as a patient's comment, unless the third party posts it under a contract or other arrangement with you.
4. Individualized, password-protected documents or otherwise secured conventional electronic documents, meaning a document about one person, their property or their account that is password-protected or otherwise secured. HHS wrote that content "may be otherwise secured if it requires a member of the public to use some process of authentication or login to access the content."
5. Preexisting social media posts made before your compliance date.

Limits that are separate from the exceptions

Under 84.88, a recipient can try to show that full compliance would cause a fundamental alteration or undue financial and administrative burdens. The head of the recipient or a designee decides in writing, and you still do as much as you can. HHS has said it "intended the fundamental alteration and undue burden defenses to apply only to rare situations." Section 84.89 covers failures whose impact on access is minimal. Ask counsel before relying on either.

Exempt documents must still be provided on request

Section 84.77 requires communication with people with disabilities to be as effective as with others, with auxiliary aids and services provided "in accessible formats, in a timely manner, and in such a way as to protect the privacy and independence of the individual with a disability." HHS's fact sheet adds that for individualized documents, "the recipient must still ensure that an individual with a disability is able to access the information in documents that pertain to them."

HHS's 2024 rule adds three points. Once you know a patient needs accessible bills, a recipient "generally may not require the individual with a disability to make repeated requests for accessibility." Urgent information, such as post-operative instructions, needs a faster path. And the portal that delivers secured documents generally must itself meet WCAG 2.1 AA.

Sorting common health-sector PDFs

For a hospital with 300 employees and a compliance date of May 11, 2027, the rules might play out like this. Confirm these working decisions with counsel.

If you are also covered by ADA Title II

County health departments, public hospitals, state Medicaid agencies and state university medical centers are public entities that usually take HHS money. HHS said such a recipient "will be required to comply with both this rulemaking and all title II regulations," each with its own dates.

For a large county the dates are about two weeks apart. For smaller governments and special districts, the Section 504 date can come almost a year sooner, at least for the department that receives HHS funds. The work is the same, so one plan serves both. Separately, the ACA Section 1557 rule at 45 CFR 92.204 requires recipients' websites and mobile apps to comply with Section 504 "as interpreted consistent with title II of the ADA." Confirm with counsel which rules apply to you.

A plan for your PDFs before May 2027

1. Name an owner. Recipients with 15 or more employees must already designate a Section 504 coordinator under 84.7. Give that person the PDF work and a budget.
2. Count every PDF, including clinic and foundation microsites and vendor platforms. Our guide to finding every PDF shows how.
3. Sort before you fix: fix, archive, keep as preexisting, individualized, or remove. Write down why, using the archive guide for edge cases.
4. Fix what patients use first: intake and consent forms, financial assistance documents, benefit applications, eligibility rules, prices and current notices.
5. Change templates, in Word, InDesign and the letters your systems generate, so new PDFs start out accessible.
6. Set up the request path. Publish how to ask, decide who answers and how fast, and record each patient's format preference.
7. Keep evidence of decisions, remediated files and requests. See how to prove PDF accessibility.
8. Re-check quarterly, because new and edited files after your date join the backlog.

How Ockem Proof fits a Section 504 plan

Ockem Proof, our product, remediates PDFs to WCAG 2.1 Level AA. Software fixes mechanical problems, such as tab order and document language, tags structure for a reviewer to check, and re-checks every fix. A person makes the judgment calls: your reviewer confirms reading order, approves any color change, and approves AI-drafted alt text, titles and form field names before they are written into the file. In Ockem's measurements of production documents in August 2026, the median document needs one manual check, and the 90th percentile needs two.

Each certified document gets a certificate and a public verification page stating what software verified, what your organization attested, and what is not claimed. For security reviews: drafting runs on self-hosted models on hardware Ockem operates; no customer document content goes to a third-party model. Your documents are not used for model training unless your workspace turns that on. Proof produces evidence, not legal advice. The rule-by-rule deep dives show what Proof fixes and what your reviewer decides.

Proof is for documents you publish. It is not offered for documents that contain protected health information, such as the patient-specific PDFs described above; see Security and procurement.

Next steps

Try one PDF (opens an external site) of up to 10 pages free, with no account, such as an intake form. Count what you publish with the free PDF inventory tool, and see the WCAG coverage map for how Proof handles each check. Then read finding every PDF, Title II and PDFs and archive, keep or fix.

Questions

This guide explains the rules in plain language. It isn’t legal advice. Check how they apply to your organization with counsel.