The accessibility deadline moved. Your risk didn't.
Most of what gets sold to eyecare practices talks about one law. There are four, they arrived at different times, and only one of them has a date on it. Here is the whole picture in plain English — including the parts nobody selling you a button wants to explain.
Which laws apply to an eyecare practice website?
Four of them, and they work differently. The ADA has covered doctors' offices for years and has no deadline — it starts the day somebody complains. Section 504 now sets a dated standard for practices that take federal health care money: May 11, 2027 if you have 15 or more employees, May 10, 2028 if you have fewer. Section 1557 covers the same practices for communicating with patients who have a disability. HIPAA covers what your website does with patient information. Which ones reach your particular practice is a legal question for your own lawyer, not for a scanner and not for us.
Book A 30-Minute Call- ADA — already live, no deadline, starts with a complaint
- Section 504 — May 11, 2027 or May 10, 2028, by headcount
- Section 1557 — already live for most practices billing Medicare
- HIPAA — already live, and your website is part of it
What each rule actually says.
None of these are new laws. What changed is that three of them now point at websites specifically, and one of them finally named a technical standard you can be measured against.
The ADA
The Americans with Disabilities Act names "the professional office of a health care provider" as a place that has to be open to everybody. Courts have applied that to websites. There is no small-practice exemption and there is no grace period, because there was never a start date to begin with.
- 8,667 ADA lawsuits were filed in federal court in 2025. More than 5,000 of them were about a website or an app.
- 64% of those cases hit businesses making under $25 million a year
- Nobody inspects you first. One person complains, and a letter arrives at your front desk.
Live now · with a date attached
Section 504
Health and Human Services published this rule in May 2024. It took effect that July. For the first time it named an actual technical standard — WCAG 2.1 level AA — for the websites and apps of anyone taking federal health care money.
- HHS's own analysis of the rule estimates 92% of doctors receive federal health care money — which is what pulls a private practice in
- May 11, 2027 if you have 15 or more employees
- May 10, 2028 if you have fewer than 15
- Your headcount sets your date. It does not decide whether you are covered.
- The government can open an investigation without waiting for a complaint. A patient can also sue you directly.
Live now · this one is new for practices
Section 1557
This is the health care anti-discrimination rule. For about forty years the government said that being paid through Medicare Part B did not count as taking federal money. In 2024 it changed its mind and said it does.
- That single change pulled ordinary physician practices in for the first time
- It is why the Section 504 deadline reaches so much further than it used to
- It covers communicating with patients who have a disability — including on a screen
- Practices whose only federal money is Part B were given until July 5, 2025
Live now · a different kind of exposure
HIPAA
An appointment request, a contact form asking why a patient is coming in, a link into the portal — that is a HIPAA surface, and the tracking code sitting on those same pages is where practices get into trouble.
- Tracking pixel cases against health care providers have run past $100 million in settlements since 2023
- 2025 set a record for large health care data breaches — 772 reported
- Most of this is decided by how the site is built, before a patient types a single character
What moved, and what didn't.
Four days before the first deadline landed, the government pushed both dates back a year. Providers had said they could not make them. It was a real reprieve on the calendar and nothing else — and it did nothing at all about the ADA lawsuits, which is where almost every health care web accessibility case actually comes from.
The date moved.
May 11, 2026 became May 11, 2027. May 10, 2027 became May 10, 2028. Exactly one year, for every size of practice.
The duty didn't.
The rule has been in effect since July 2024. The deadline is the date the government starts measuring you against a specific technical standard — not the date your obligation begins.
The standard didn't.
It is still WCAG 2.1 level AA. Nothing was relaxed, no checks were carved out, no easier version was swapped in.
There is no fine the day after the deadline.
That is worth saying plainly, because a lot of people selling accessibility imply otherwise. Nothing switches on at midnight. What happens instead is slower, and it starts with one patient who could not do something on your website.
What can follow.
- A complaint, or a demand letter from a lawyer you have never heard of
- An investigation by the HHS Office for Civil Rights
- Attorney fees and remediation you did not budget for
- A corrective-action agreement that puts you under monitoring for years
- Patients who quietly go elsewhere, and a story you have to explain
It is not just picture descriptions.
- Your scheduler and patient portal are usually somebody else's software. Those take the longest to sort out and you cannot fix them yourself.
- PDFs — intake packets, insurance lists, post-op instructions — each one is its own job
- Payment tools, video, navigation and every plug-in on the page get tested too
- Fixing an old site means paying to keep its worst decisions. Building a new one does not.
"My web company said they handle all that."
This is the most common thing we hear, and it is the one that should worry you most. Under the federal rule, the practice is responsible for the accessibility of everything it puts in front of patients — including the parts somebody else built and runs.
You cannot hand this to a vendor.
- The rule covers web content the practice provides directly or through a contract, licence or other arrangement. That is the language.
- Your scheduler, patient portal, bill-pay and telehealth screens are all inside that sentence, even though you did not build any of them.
- If the site fails, the practice answers for it — not the host, not the agency, not the booking widget.
- Pointing a patient to a phone line instead is not treated as an acceptable substitute.
So don't take our word for it either.
- The same rule that stops your last web company from absorbing this stops us from absorbing it. Anyone who tells you otherwise is selling something.
- What we can do is build it right and show you the evidence — the standard, the checks, the result, page by page.
- You keep the report whether or not you build with us. If you would rather hand it to your current web company, that is a fine outcome.
- If you have 15 or more staff, the rule also expects a named person and a complaints process — and that part applies now, not in 2027.
An overlay is not compliance, and now there is a federal order saying so.
You have seen it — the little wheelchair or eye icon that opens a panel of settings. It is sold as one line of code that makes a website compliant. It does not fix the code underneath, which is the only thing a blind patient's software actually reads.
The practice in our audit was paying for a name-brand overlay on all 478 of its pages. See what was underneath it →
What we say, and what we won't.
Accessibility is a field with a lot of confident promises in it. Here is the line we hold, so you can hold us to it.
Measurable things.
We build every page to WCAG 2.2 level AA. That is the newer version of the standard, and it contains every check in the 2.1 AA that the federal rule names — so meeting ours meets theirs, and you are not redoing the work when the reference gets updated. The rule names 50 testable success criteria across WCAG levels A and AA — that is the legal yardstick, and we audit against every one of them. Our own register runs to 244 separate items, because a real check also covers the things that break accessibility in practice rather than only on paper. Every page goes through it before launch and again every month. Access is written into the code, so nobody can switch it off. That lowers your risk.
Things nobody can promise.
We will not tell you that you are permanently "ADA compliant," because conformance is measured on a date and a site changes. We will not tell you that you cannot be sued — anyone can be sued for anything, and building to the standard reduces that risk without removing it. We will not tell you we make you HIPAA compliant; we build the website carefully, and your compliance program is bigger than a website. And we will not tell you which of these four rules applies to your practice. Ask a health care lawyer. That is a real question with a real answer, and it is not ours to give.
More on this page's topic
Does the ADA really apply to a small optometry practice website?
The deadline moved to 2027. Can I wait?
Why did Medicare Part B suddenly matter?
Isn't an accessibility widget enough to cover me?
Which standard should my practice build to, 2.1 or 2.2?
My web company says they handle accessibility. Isn't that enough?
Is the 2027 deadline definitely going to hold?
Can OptiSite tell me whether these rules cover my practice?
Built for all four from the first line of code.
Independent practices only · $0 until you're live · no contract · re-checked every month