Coverage
Who must comply.
Federal digital accessibility rules apply through several distinct regulatory frameworks — each with its own scope, covered entity definition, and compliance date. The entity categories below summarize the practical application of those frameworks to the organizations AccessMark most commonly serves.
Regulatory applicability depends on specific facts — including the entity's population threshold, its receipt of federal financial assistance, and the services it delivers through digital channels. The summaries below are descriptive, not determinative.
01
Municipalities and local governments
Cities, towns, counties, and special district governments providing services to residents through web and mobile channels.
Digital assets in scope
Official municipal website, service portals (permits, taxes, payments), transparency and open-data pages, constituent-facing forms, mobile applications, and any third-party content made available through municipal domains.
Applicable regulations
ADA Title II — 28 CFR §35.200
Technical standard: WCAG 2.1 Level AA. Covered regardless of federal funding status.
Compliance date
April 26, 2027 for entities with total population of 50,000 or more. April 26, 2028 for entities below that threshold and for special district governments. Dates amended by DOJ Interim Final Rule, 91 FR 20902, effective April 20, 2026.
Recommended next step
A scoped audit of the municipal website and any citizen-facing applications, producing a findings report that can be submitted to the municipal legislature or council as part of the FY budget cycle.
02
State and territorial agencies
Executive-branch departments, public authorities, and programs administering state or territorial services — including public health agencies and Medicaid-equivalent authorities.
Digital assets in scope
Agency websites, beneficiary portals, grant-application systems, licensing platforms, public-facing dashboards, and any mobile applications used to deliver agency services.
Applicable regulations
ADA Title II — 28 CFR §35.200
HHS Section 504 — 45 CFR Part 84
Agencies administering HHS-funded programs are subject to both frameworks. Technical standard under both: WCAG 2.1 Level AA.
Compliance date
ADA Title II: April 26, 2027. HHS Section 504: May 11, 2026 for recipients with 15 or more employees — subject to a pending HHS Interim Final Rule under OIRA review.
Recommended next step
A coverage analysis to identify which properties fall under Section 504 (HHS-funded programs) and which fall exclusively under Title II — the two frameworks have different deadlines and overlapping but not identical scope.
03
Hospitals and health systems
Acute-care hospitals, specialty hospitals, and integrated delivery networks receiving Medicare, Medicaid, or other HHS financial assistance.
Digital assets in scope
Public website, patient portal, appointment-scheduling systems, telehealth platforms, mobile applications, check-in kiosks, machine-readable standard-charges files, and consumer-friendly shoppable-services display.
Applicable regulations
HHS Section 504 — 45 CFR Part 84, §84.85(c)
CMS Price Transparency — 45 CFR §180.50
HIPAA Privacy — 45 CFR §164.520
Technical standard for digital accessibility: WCAG 2.1 Level AA.
Compliance date
May 11, 2026 for recipients with 15 or more employees. May 10, 2027 for recipients with fewer than 15 employees. Both dates subject to a pending HHS Interim Final Rule (RIN 0945-AA30) under OIRA review.
Recommended next step
An audit that covers the full patient-facing digital surface — website, portal, telehealth, and kiosks — with findings organized by both WCAG criterion and the governing rule, so that OCR compliance-review documentation flows directly from the report.
04
Health plans and insurers
Commercial insurers, Medicare Advantage plans, Medicaid managed care organizations, and public health-plan authorities receiving federal financial assistance from HHS.
Digital assets in scope
Member portal, provider directory, prior-authorization systems, claims and benefits interfaces, plan-finder tools, formulary search, mobile applications, and public marketing pages carrying enrollment or benefits information.
Applicable regulations
HHS Section 504 — 45 CFR Part 84
Section 1557 of the ACA
Plans receiving federal financial assistance are covered by Section 504. Section 1557 imposes parallel nondiscrimination obligations on covered health programs and activities.
Compliance date
May 11, 2026 for plans with 15 or more employees. May 10, 2027 for plans with fewer than 15 employees. Subject to pending HHS Interim Final Rule.
Recommended next step
A targeted audit of the member portal and provider directory — the two surfaces most frequently cited in OCR complaints — followed by a broader scope that includes marketing pages and mobile applications.
05
Medical groups, IPAs, and MSOs
Independent practice associations, medical service organizations, and affiliated physician groups that deliver services under arrangements with federally funded health plans or hospital systems.
Digital assets in scope
Group-level websites, patient-scheduling tools, portal integrations with hospital or plan systems, telehealth platforms, and any mobile applications published under the group's brand.
Applicable regulations
HHS Section 504 — 45 CFR Part 84
Coverage depends on whether the organization receives federal financial assistance directly or through a parent or affiliated entity. Subsidiary relationships to HHS-funded holdings typically bring the group within scope.
Compliance date
May 11, 2026 if the organization has 15 or more employees and receives HHS financial assistance. May 10, 2027 for smaller organizations. Subject to pending HHS Interim Final Rule.
Recommended next step
A coverage analysis to confirm Section 504 applicability through the organization's funding relationships, followed by a scoped audit of patient-facing properties. Groups operating under a parent MSO benefit from a coordinated engagement across affiliated entities.
06
Vendors, contractors, and SaaS providers
Technology providers and contractors whose products are used by covered entities to deliver public services, administer benefits, or communicate with constituents and patients.
Why vendors are affected
Under 28 CFR §35.200, a covered entity's obligations extend to web content and mobile applications "provided or made available, directly or through contractual, licensing, or other arrangements." Covered entities flow their obligations to vendors through procurement requirements and master service agreements.
Practical effect
Vendors that cannot demonstrate WCAG 2.1 AA conformance are increasingly disqualified during procurement, or required to remediate under accelerated timelines within existing contracts. Independent certification is becoming a bid prerequisite for contracts with state agencies, hospitals, and health plans.
Effective timing
Vendors typically face compliance demands before their covered-entity customers' regulatory deadlines — driven by procurement cycles, RFP requirements, and customer risk management rather than by the rule's own compliance date.
Recommended next step
A certification of the vendor's product against WCAG 2.1 AA, with a scope addendum aligned to the modules that covered entities license. The certification becomes a reusable asset attached to RFP responses.
Scope clarifications
Common misreadings of coverage.
A few patterns come up frequently during coverage analysis. The entries below address them directly rather than leaving them to be inferred.
Purely private businesses are not covered by Title II or Section 504.
ADA Title III applies instead, with a different enforcement profile and no parallel WCAG mandate from DOJ at this time. Private businesses that receive federal financial assistance, however, may be covered by Section 504 regardless of their sector.
Puerto Rico municipalities and hospitals are covered on the same terms as U.S. mainland entities.
ADA Title II and HHS Section 504 apply in Puerto Rico without modification. Certain other federal programs — such as the CMS Rural Health Transformation Program — do exclude territories, but the accessibility rules do not.
A later compliance deadline is not an exemption.
Small entities and those with fewer than 15 employees have additional time, not a reduced obligation. The 2027 and 2028 dates are compliance milestones, not scope reductions.
Not sure whether your organization is covered?
A coverage analysis identifies which rules apply to which of your digital properties, based on the entity's funding profile and service portfolio. It is typically a one-meeting engagement.