ADA Title II and Section 504: What Public and Healthcare Websites Must Fix by 2027

green Disabled Access sign with an arrow, fixed to an iron railing beside a set of steps

From 26 April 2027, every US state or local government entity with a total population of 50,000 or more has to make its web content and mobile apps meet WCAG 2.1 Level AA. That covers counties, cities, school districts, public universities and transit agencies. From 11 May 2027, the same standard applies to every recipient of HHS financial assistance with fifteen or more employees: hospitals, clinics, health centers, and the state agencies, social service providers and colleges that HHS also funds.

Both dates were meant to arrive a year earlier. The Department of Justice and HHS each moved them by interim final rule in spring 2026, and both said they may propose easing the substance. Neither has. Today the 2027 dates are what the regulations say, and the first one is about 29 weeks away.

If you also sell into the EU, the European Accessibility Act is a separate regime, covered in our EAA article.

The Dates

Who	Rule	Compliance date
State and local government, total population 50,000 or more	ADA Title II, 28 CFR 35.200(b)(1)	26 April 2027
State and local government under 50,000, and every special district government	28 CFR 35.200(b)(2)	26 April 2028
HHS recipient with 15 or more employees	Section 504, 45 CFR 84.84(b)(1)	11 May 2027
HHS recipient with fewer than 15 employees	45 CFR 84.84(b)(2)	10 May 2028

"Total population" is a defined term. For most entities it is the Census Bureau's decennial count; an independent school district uses the Small Area Income and Poverty Estimates. A state university or a transit authority takes the combined population of the governments it belongs to. A special district government gets the 2028 date whatever its size.

A county hospital is typically both a public entity and an HHS recipient. Check both dates and work to whichever comes first.

What the Rules Require

The two rules are worded almost identically, and three phrases do most of the work.

"Web content and mobile apps." Web content is defined broadly: text, images, sound, video, controls, animations and "conventional electronic documents", meaning PDFs, word processor files, presentations and spreadsheets. Mobile apps are the native apps people download to phones and tablets.

"Directly or through contractual, licensing, or other arrangements." The obligation follows the service, not the server. A permit portal run by a vendor, a payment page hosted by a processor, a learning platform licensed by a school district: all of it counts as yours. In the 2024 final rule DOJ gave the example directly: an entity that links to a third-party site to take payment of fees, parking tickets or taxes must make sure that site complies.

"Level A and Level AA success criteria and conformance requirements specified in WCAG 2.1." The June 2018 version, not 2.2. Building to 2.2 does no harm, but 2.1 AA is the legal bar.

The outs are narrow. Compliance is not required where it would cause a fundamental alteration or undue financial and administrative burdens, but the head of the entity (or a designee) has to decide that after considering all available resources, put the reasons in writing, and still do everything short of the burden. A separate "conforming alternate version" is allowed only where direct accessibility is impossible for technical or legal reasons. There is also a minimal impact provision, but that is a defense you argue after a complaint, not a design target.

For scale, DOJ's 2024 analysis counted 109,893 websites and 8,805 mobile apps run by 91,489 state and local entities, with $16.9 billion in implementation costs over the first three years. The April 2026 extension cites a total 10-year cost estimate of $24.7 billion. The 2024 HHS rulemaking as a whole covers about 453,084 recipients.

What Is Excepted, and on What Conditions

Both rules carry the same five exceptions, and each has a condition that is easy to miss.

Archived web content, only if all four hold: created before your compliance date (or reproducing paper or other physical media from before then), kept exclusively for reference, research or recordkeeping, not altered after archiving, and stored in a dedicated area clearly marked as archived. Old minutes scattered across live department pages do not qualify. Move them.
Preexisting conventional electronic documents, posted before your date, unless they are currently used to apply for, gain access to, or participate in a service. The 2019 permit application PDF still linked from the permits page is not excepted.
Content posted by a third party, unless it is posted under a contractual, licensing or other arrangement with you. Public comments on a forum are excepted. Anything a contractor posts for you is not.
Individualized, secured documents: files about a specific person, their property or their account, behind a password or otherwise secured. A tax bill or a lab result PDF. The exception covers the document. The portal around it is still in scope.
Social media posts published before your date.

None of this removes the general duty. Both 2026 extensions say obligations under Title II and Section 504 continue regardless of the compliance dates. A resident who asks for an accessible copy of an excepted document can still be entitled to one.

What Remediation Means in Practice

CMS templates and components

Most public sites are a handful of templates and a dozen components repeated across thousands of pages. Fix the header, navigation, search, accordion, table and form components once and every page inherits the fix. Check heading order, landmarks, visible focus (2.4.7), text contrast of 4.5:1 (1.4.3), 3:1 contrast for controls and field borders (1.4.11), reflow on narrow screens (1.4.10) and text resized to 200 percent (1.4.4). If the theme is custom or years old, this is where most of the budget belongs.

Forms, payments and permits

Transaction paths are what complaints are about. Every field needs a label exposed to assistive technology (3.3.2), errors described in text (3.3.1), autocomplete on personal data fields (1.3.5), full keyboard operation (2.1.1), and session time limits the user can turn off, adjust or extend (2.2.1). That last one is easy to miss in payment and permit flows, where a session can expire while a screen reader user is still on page two. Custom widgets (date pickers, address lookups, file uploads) need a correct name, role and value (4.1.2). The processor's embedded payment frame has to pass too, so test the whole flow, not your half of it.

Patient portals and scheduling

Everything above, plus appointment pickers, intake questionnaires, secure messaging and telehealth video. Messages such as "appointment confirmed" must be announced without moving focus (4.1.3).

Documents

The cheapest accessible PDF is the one you never make. Publish agendas, notices and forms as HTML where you can. For PDFs that have to stay: tags, a correct reading order, real form fields, the document language and text alternatives for images. Then fix the production side (Word templates with real headings, export settings that keep tags, a check before anything is posted), or you will be remediating next week's agenda forever.

Video and meetings

Prerecorded video needs captions (1.2.2) and audio description where the picture carries meaning (1.2.5). Live audio in synchronized media needs live captions (1.2.4), which for most cities, counties and school boards means the streamed public meeting. Old recordings can go to the archive under the four conditions above.

Mobile apps

Native apps are held to the same criteria through the platform's accessibility layer: every control labeled for VoiceOver and TalkBack, no lock to one orientation (1.3.4), a simple tap alternative to swipe and pinch gestures (2.5.1).

Packaged Software: Your Vendor's Code, Your Obligation

If your site runs on a hosted government CMS, your payments go through a processor's hosted page and your patient portal is a module of your EHR, most of the code fixes belong to your vendors. Your job is procurement: ask each vendor for a conformance report against WCAG 2.1 AA, test their claims on your own critical paths, and write a conformance obligation and a fix-by date into the contract or the renewal. Your content (PDFs, video, alt text, the pages your staff write) stays your job on any platform.

This article is most useful if you run in-house, legacy or customized systems: a homegrown permit portal, a heavily modified CMS theme, an app whose agency has moved on, an intake form bolted onto a vendor product. Nobody else will fix those.

Why an Overlay Does Not Get You There

The rule measures your content against WCAG 2.1 AA. An overlay is a script that sits on top of the page. It cannot write a meaningful description of a chart, caption a meeting, tag a PDF or change a native app, and it does not reach the third-party payment or scheduling domain your users are sent to.

The FTC has already looked at the instant compliance claim. In January 2025 it published a proposed consent order with accessiBe, maker of the accessWidget overlay, after alleging that the product did not make all websites WCAG compliant. The proposed order included a $1,000,000 payment and a required disclosure that the product does not fix barriers on third-party domains that do not also run it.

The Date Risk

Both DOJ and HHS wrote that they "will consider issuing an NPRM" on the substance during the extension. DOJ's regulatory agenda entry says it is considering whether provisions "could be made less burdensome", with the proposal date "To Be Determined".
Both also wrote that if no such NPRM is issued and nothing else points to a further delay, each department "fully anticipates implementing the regulation at the new deadline."
The National Federation of the Blind filed suit in the District of Maryland on 21 May 2026 (National Federation of the Blind v. Department of Justice, 1:26-cv-02007), challenging both extensions. There has been no ruling as of early October 2026.
A proposed rule changes nothing on its own. A final or interim final rule does, and 2026 showed how late one can come: DOJ's extension took effect on 20 April 2026, four days before the date it moved.

So the risk runs both ways: a proposal could ease the rule, and the lawsuit argues the date should never have moved. Planning on a reprieve is a bet. If DOJ or HHS does publish a further delay, re-plan before spending more.

A Plan Worth Doing Whatever Happens

Some of this pays off under any outcome, because Title II and Section 504 already require equal access. Do regardless:

Fix the templates and components.
Make the top transaction paths (pay, apply, register, book, sign in) work with a keyboard and a screen reader, end to end.
Stop producing new inaccessible PDFs.
Put WCAG 2.1 AA into every contract and renewal.
Caption public meetings.

Hold back if a delay is published: bulk remediation of rarely used old documents. A proper archive is usually cheaper anyway.

Working back from 26 April 2027 (HHS recipients have until 11 May 2027):

October to mid November 2026: inventory. Every domain, app, vendor system and document library. Sort documents by whether anyone still uses them to get a service. Decide what gets archived or deleted.
Mid November to January: templates, components and the top transaction paths. Send vendors your conformance request now. Contract cycles move slower than code.
January and February: documents in active use, forms, captions and app fixes. Submit app updates by the end of February to leave room for store review.
March: test. Keyboard only first, then NVDA or JAWS on Windows, VoiceOver on iOS and macOS, TalkBack on Android, on the real critical paths. A scanner cannot tell you whether alt text means anything.
April: freeze and guard. Add automated checks to the build and the publishing workflow, so the next agenda and the next release do not undo the work. Where an undue burden claim really applies, get the written statement signed before the date, not after a complaint.

On cost, the HHS extension cites National League of Cities reports of one-time PDF and website remediation quotes of $10,000 to $20,000, and up to $70,000 a year, for cities of unstated size.

Where to Get Help

We fix accessibility in the code: templates, component libraries, forms, portals and mobile apps, with checks in the build so the fix holds. No overlays, and no audit-only reports. The approach is on our accessibility remediation service page, and the EU side is in our European Accessibility Act article.

We are engineers, not lawyers: which date applies and whether an undue burden claim stands are questions for your counsel. If you have a custom portal and a date to hit, write to office@c9group.dev.