I’m not a WCAG expert. I want to say that plainly, up front, because the last thing healthcare needs is one more person overstating their credentials on a compliance topic that carries real legal weight.
What I am is a fierce champion for it. I’ve spent years watching what happens when accessibility gets treated as a checkbox instead of a design discipline — and I’ve had the benefit of learning from people who actually do this for a living. My understanding of WCAG comes largely from my working relationship with Level Access (Spiro Papathanasakis’s team, formerly eSSENTIAL Accessibility), who I leaned on heavily when I was first building out accessibility practices inside a healthcare organization. Everything technical in this post is either their language, WCAG’s own published criteria, or the federal government’s own regulatory text — not my personal interpretation.
The blind spot: accessibility isn’t just contrast and screen readers
Ask most marketing or web teams what “accessibility” means and you’ll get two answers: color contrast, and screen readers. Both matter enormously. Neither is the whole picture.
The Centers for Disease Control estimates that roughly 7 million Americans have some form of vision impairment, including about 1 million who are blind. More broadly, an estimated 32.17 million people in the U.S. — 9.46% of the population — reported any presenting visual acuity loss in 2024. (CDC, Fast Facts: Vision Loss)
Most of those 32 million people are not screen reader users. They have low vision — conditions like macular degeneration, diabetic retinopathy, glaucoma, or retinitis pigmentosa — and they experience the web very differently depending on which part of their vision is affected:
Central vision loss (common with macular degeneration) means someone may rely on screen magnification, zooming a page to 200% or 400% to read it at all. If your page doesn’t reflow cleanly at high zoom — if it forces horizontal scrolling in two directions instead of stacking content vertically — that’s not a cosmetic bug. It’s a wall. This is exactly why WCAG Success Criterion 1.4.10 (Reflow) exists: content should remain usable at 400% zoom without requiring scrolling in two dimensions.
Peripheral vision loss — tunnel vision, from conditions like glaucoma or retinitis pigmentosa — is the one I think gets the least attention, and it’s the one that has nothing to do with contrast at all. Someone with a narrow field of view sees only a small window of the screen at a time, like looking through a cardboard tube. If your “Add to Cart” button lives in the top-right on one page and the bottom-left on the next, a sighted user barely notices. A tunnel-vision user has to physically re-scan the entire page to relocate it every single time. This is precisely what WCAG’s consistency criteria are built to prevent:
- 3.2.3 Consistent Navigation — navigation mechanisms that repeat across pages must appear in the same relative order every time.
- 3.2.4 Consistent Identification — components with the same function must be identified consistently (the same icon, the same label, the same placement) across the whole site.
- 2.4.3 Focus Order — the order elements receive keyboard focus has to follow a logical, predictable sequence.
- 2.4.5 Multiple Ways and 2.4.6 Headings and Labels — more than one way to find a page (nav, search, sitemap), and headings/labels descriptive enough that someone scanning a narrow field of view can tell what a section is without seeing the whole page at once.
- 2.4.7 Focus Visible — anyone navigating by keyboard (which includes many low-vision and motor-impairment users) needs to be able to see, unambiguously, where they are on the page.
None of that is about color. All of it is about whether someone can predict where things are without seeing the whole page at once.
If you want to actually see this, not just read about it: the W3C’s own Web Accessibility Initiative has a short excerpt, “Low vision: Challenging assumptions and understanding differences,” where they darken a screen to simulate tunnel vision and walk through how traditional page layouts fail people experiencing it in real time. It’s the clearest five minutes I’ve found on why this isn’t an edge case. Watch it on YouTube.
The law isn’t hypothetical anymore — and here’s the actual language
This isn’t a “nice to have.” For most hospitals and health systems, it’s federal law, and I’d rather quote the source directly than tell you what I think it means.
Under 45 CFR § 84.84, HHS’s regulation implementing Section 504 of the Rehabilitation Act and Section 1557:
“(b)(1) Beginning May 11, 2027, a recipient with fifteen or more employees shall ensure that the web content and mobile apps that the recipient provides or makes available… comply with Level A and Level AA success criteria and conformance requirements specified in WCAG 2.1, unless the recipient can demonstrate that compliance with this section would result in a fundamental alteration in the nature of a program or activity or in undue financial and administrative burdens.
(2) Beginning May 10, 2028, a recipient with fewer than fifteen employees shall ensure that the web content and mobile apps that the recipient provides or makes available… comply with Level A and Level AA success criteria and conformance requirements specified in WCAG 2.1…”
45 CFR § 84.84, as amended 91 FR 25507, May 11, 2026
That’s WCAG 2.1 Level AA — the same standard behind every criterion listed above — written directly into federal regulation, tied to any organization receiving federal financial assistance. For most hospitals and health systems, that’s Medicare and Medicaid participation — but it doesn’t stop there. “Federal financial assistance” is a broader legal term that also captures federal grants (HRSA, Ryan White, NIH, and similar programs), loans and subsidies, and certain federal contracts, including contracts of insurance and ACA Marketplace subsidy arrangements. Veterans Affairs and Department of Defense healthcare contracts are significant examples — hospitals and health systems that participate in the VA’s Community Care Network, hold other VA healthcare contracts, or contract with the medical commands of any DoD service branch (Army, Navy, Air Force — through TRICARE, the Defense Health Agency, or the Military Health System) are typically recipients of federal financial assistance in their own right, separate from and in addition to any Medicare or Medicaid participation. If your organization touches any of those funding streams — Medicare, Medicaid, VA contracts, DoD medical command contracts, HHS grants, or ACA Marketplace arrangements — this rule likely already applies to you. Noncompliance isn’t a fine sitting off to the side of the business. It’s the funding itself.
A note on dates, because this matters and it’s easy to get wrong: the original rule was published May 9, 2024, with a compliance deadline of roughly one year out. HHS’s Office for Civil Rights extended that deadline by a year in an Interim Final Rule published May 7, 2026. The current, correct deadlines are May 11, 2027 for recipients with 15+ employees and May 10, 2028 for recipients with fewer than 15. OCR Director Paula M. Stannard put it this way in HHS’s own announcement:
“OCR remains committed to ensuring that individuals with disabilities have equal access to health care… This extension provides covered entities additional time to bring their websites and mobile applications into compliance while OCR continues its work to ensure that individuals with disabilities are not denied equal access to health care.”
I’m flagging the dates specifically because some good, otherwise-reliable resources — including pages I’d normally point you to without a second thought — haven’t caught up to this extension yet and still list the original 2026/2027 dates. Always confirm compliance dates against HHS’s own published rule before you build a deadline into a plan.
Where to go from here
Level Access’s Section 504 compliance overview is a genuinely useful resource for two things in particular: their list of exactly which digital experiences are covered (patient portals, scheduling and registration forms, kiosks, email, patient chat and messaging, online payment, telehealth, and — worth noting for anyone running a healthcare marketing account — social media posts), and a clear explainer of WCAG’s version and conformance-level system. I’d lean on it for that context. For the compliance dates themselves, go to HHS directly.
I’ll say it again, because it’s the whole point of this post: I’m not the expert here. I’m the person in the room who cares enough to keep asking the experts the right questions, and to make sure the answers actually get built into the sites healthcare organizations put in front of patients. If you’re building or auditing a healthcare digital experience and you’re only checking contrast ratios and screen reader labels, you’re checking real things — just not all of them.
Thank you to Spiro Papathanasakis and the team at Level Access for the years of patience teaching me to see the web the way someone with low vision actually experiences it — not just the way a sighted designer assumes they do.
