Healthcare website compliance in 2026: Section 504, pixels and the new deadlines
The new Section 504 dates, what's left of HHS's tracking guidance, and the state health data laws that apply without HIPAA.
Key takeaways
- HHS pushed its Section 504 web deadline to May 2027 for larger providers, still at WCAG 2.1 AA.
- Trackers on portals, scheduling and symptom checkers still count as disclosing health information, and a cookie banner isn't a HIPAA authorization.
Section 504: WCAG 2.1 AA, with new dates
HHS's 2024 Section 504 rule requires funded providers' websites, apps and licensed portals to meet WCAG 2.1 Level AA (opens in a new tab). A May 11, 2026 interim final rule (opens in a new tab) moved both deadlines back a year:
| Recipient | New compliance date | Standard |
|---|---|---|
| 15 or more employees | May 11, 2027 | WCAG 2.1 AA |
| Fewer than 15 employees | May 10, 2028 | WCAG 2.1 AA |
Who counts? Hospitals and Medicaid, CHIP and Medicare providers and plans. If you take Medicare or Medicaid, plan as if you're covered; Part B-only practices should confirm with counsel.
ADA Title III still applies today
The ADA lists the office of a health care provider (opens in a new tab) as a public accommodation, so private suits don't wait for HHS. Healthcare was about 2% of the 5,114 suits UsableNet counted in 2025, and dental practices report demand letters asking $2,500 to $25,000 plus fixes.
Tracking: what's left of HHS's guidance
A June 2024 Texas ruling struck one part of HHS's online tracking bulletin (opens in a new tab), on IP addresses and public condition pages. The rest stands:
- Trackers on authenticated pages, like a portal, generally access PHI.
- Scheduling, symptom checkers and reason-for-visit forms bring public pages under HIPAA.
- A vendor that receives PHI needs a BAA.
- A cookie banner isn't a valid HIPAA authorization.
Outside HIPAA, the FTC's Health Breach Notification Rule (opens in a new tab) treats pixel sharing as a breach, and in July 2026 the FTC sued Hims & Hers over Meta and Snap pixels.
Pixel class actions have settled for up to $46 million (Kaiser Permanente), and California's wiretap law allows $5,000 per violation.
State health data laws apply without HIPAA
Cash-pay practices that don't bill electronically may be outside HIPAA, but not these laws:
- Washington's My Health My Data Act: separate opt-in consent to collect and to share, a linked health data policy, and a private right of action.
- Nevada SB 370: similar consent, and no geofencing near health facilities.
- Connecticut: covers every controller doing business in the state, with no threshold.
What to do this quarter
- Remove trackers from booking, portal, intake and symptom pages. Consent doesn't fix these for HIPAA.
- Put everything else behind consent, honoring Global Privacy Control.
- Fix accessibility in order: forms, images, buttons and captions first.
- Publish an accessibility statement, and re-check after every change.
ComplyMo lists your trackers, holds them until consent and ranks accessibility fixes on Growth and up. It never sees patient data or signs BAAs, so it doesn't make a site HIPAA compliant. See ComplyMo for healthcare.
General information, not legal advice. Confirm your obligations with counsel.