Sin categoría

Healthcare Website Compliance: The HHS Accessibility Deadline and Tracking Pixels

If your practice receives federal financial assistance from HHS, your website and mobile apps must meet WCAG 2.1 Level AA by May 11, 2027 if you have 15 or more employees, or by May 10, 2028 if you have fewer. Separately, advertising pixels on health websites can create privacy risk, whether or not HIPAA applies to you. Start with an inventory of what your site contains and what it sends to third parties.

This article is general information, not legal advice. Your compliance decisions should be reviewed by qualified counsel.

Did the HHS web accessibility deadline change?

Yes. HHS published an interim final rule on May 11, 2026, effective May 7, that extended both dates by a year.

Recipient size Original date New date
15 or more employees May 11, 2026 May 11, 2027
Fewer than 15 employees May 10, 2027 May 10, 2028

Many articles online still list the old dates. It was issued as an interim rule with a request for comments, so we recommend checking for later updates before you make final plans.

The extension doesn’t pause everything. HHS writes that, regardless of the compliance dates, recipients have an ongoing obligation to make programs offered through web content and mobile apps accessible to people with disabilities.

Who does this rule cover?

The rule applies to recipients of federal financial assistance from HHS. HHS issues tens of thousands of grants each year to a wide range of recipients. It also reaches web content and apps provided directly or through contractual, licensing or other arrangements. So your patient portal or booking vendor may be part of your duty, even though you did not build it.

Whether your organization counts as a recipient is a question for your counsel. A private cash-only practice may fall outside this rule and still face ADA expectations as a business open to the public. We cover that in our small business ADA guide.

What does the standard require in practice?

The rule adopted WCAG 2.1 Level AA. The W3C notes that content meeting WCAG 2.2 also meets 2.1, so a new build aimed at 2.2 AA should cover this standard too.

Common failures are a good place to begin. WebAIM’s 2026 analysis of a million home pages found low-contrast text on 83.9% and missing form labels on 51%. For a clinic, we would give priority to the places where a barrier can stop care:

  • Appointment requests and intake forms
  • Patient portal login and bill payment
  • Provider directories and location search
  • Pre-visit instructions, consent forms and PDFs
  • Pop-ups and chat widgets that block the keyboard

Automated tools won’t finish the job. WebAIM warns that not all failures can be detected automatically. Also remember that an FTC order against one accessibility overlay vendor arose from claims about automatic WCAG compliance that the agency alleged were unsupported.

Can a clinic use Google Analytics or a Meta pixel?

This is where many healthcare marketing setups run into trouble, and the answer needs nuance.

In July 2023, the FTC and the HHS Office for Civil Rights sent about 130 letters to hospital systems and telehealth providers. They warned that tools such as the Meta pixel and Google Analytics may send sensitive information to third parties, including conditions, diagnoses, medications and where someone seeks care.

What did the court decide?

In June 2024, a federal court in Texas ruled on part of the HHS guidance. It vacated the “Proscribed Combination”: the idea that HIPAA duties arise when technology connects an individual’s IP address with a visit to an unauthenticated public page about specific health conditions or providers. The court also noted that the ruling should not be read as limiting other guidance in the document. HHS later withdrew its appeal. Our source for this is the opinion hosted by the American Hospital Association, which was a plaintiff.

So this was a narrow win. It does not make logged-in portals, appointment flows or forms safe for tracking.

What if HIPAA doesn’t apply to me?

Then the FTC may. The agency says companies not covered by HIPAA must still guard against unauthorized disclosure of health information, even when a third party built their website or app. In its GoodRx case, the FTC alleged the company shared medication and health data with platforms such as Facebook and Google despite promising not to. GoodRx agreed to a $1.5 million civil penalty, subject to court approval.

The FTC’s updated Health Breach Notification Rule also treats an unauthorized disclosure as a possible breach of security for covered vendors of personal health records and related entities.

What should you check on your website?

We recommend this review. Have your counsel sign off on the conclusions.

  1. List every tag and script. Use your tag manager plus a browser check. Include what plugins and vendors add. Marketing tools are often forgotten after a campaign ends.
  2. Map where each one fires. Pay particular attention to condition pages, symptom checkers, provider search, booking forms, thank-you pages and anything behind a login.
  3. See what is sent. Check the page URL, form fields and event names. A URL or an event like “cancer-appointment-booked” can reveal plenty by itself.
  4. Remove what you can’t justify. Keep trackers off forms and logged-in areas unless counsel approves the arrangement and any needed agreements are in place.
  5. Align your privacy policy. GoodRx’s case turned partly on broken promises, so what you say must match what the site does.
  6. Set a review schedule. Recheck after a redesign and after any new marketing vendor.

Can you still advertise a medical practice?

Yes, but plan the measurement first. Ask counsel about privacy-focused analytics, server-side setups with appropriate agreements and measuring campaign results without sending patient-level data to ad platforms. Check each ad platform’s current policies on health advertising before launching. Be careful as well with retargeting based on what condition page somebody read. That is exactly the sensitive inference regulators have warned about.

Frequently asked questions

Is the May 2026 deadline still in effect?

No. For recipients with 15 or more employees, the date moved to May 11, 2027. Earlier obligations under Section 504 still apply.

Does this cover my mobile app?

Yes, if you are a covered recipient. The rule addresses web content and mobile apps you provide directly or through others.

Is Google Analytics banned for healthcare websites?

We did not find a blanket ban in the sources reviewed. The risk depends on what data is sent, from which pages and under what agreements. Get legal review for your setup.

Can my web designer make this decision?

A designer can find tags and fix accessibility issues, but legal conclusions belong to your compliance lead and counsel. In its warning, the FTC made clear that using a third-party builder does not remove your responsibility.

Running a clinic or health practice?

JONTI Code Design works with health and sports professionals on websites, branding and marketing, from San José, Costa Rica, in English and Spanish and in GMT-6. If you need help auditing accessibility and mapping the scripts on your site for your legal team, email info@jonti.co.cr.

Sources