What Section 1557 covers

Section 1557 is the non-discrimination provision of the Affordable Care Act. It bars healthcare programs that receive federal funding from discriminating on the basis of race, color, national origin, sex, age, or disability.

The disability piece is what's relevant here. HHS finalized a rule in 2024 that says websites and mobile apps used to provide healthcare are subject to Section 1557, and they have to be accessible to people with disabilities. The rule sets a specific technical standard — WCAG 2.1 Level AA — and a specific compliance deadline.

Who's covered

The rule applies to "covered entities" under Section 1557, which is broader than the HIPAA definition. It covers:

  • Any health program or activity that receives federal financial assistance from HHS
  • Any program administered by HHS
  • Any health insurance marketplace and any plan offered through one

In practice, that's nearly every U.S. hospital, most physician practices that bill Medicare or Medicaid, every Medicare Advantage plan, most Medicaid managed-care plans, and most federally-qualified health centers. If your practice files a Medicare claim, you're probably covered.

What WCAG 2.1 Level AA actually requires

WCAG (Web Content Accessibility Guidelines) is a technical standard published by the World Wide Web Consortium. Level AA is the middle of three levels. The 2.1 version was published in 2018.

Level AA requires, among many things:

  • Text alternatives for non-text content (alt text on images, captions on videos)
  • Sufficient color contrast (4.5:1 for normal text, 3:1 for large text)
  • Keyboard navigation for everything that works with a mouse
  • Predictable, consistent navigation patterns
  • Forms that are usable with screen readers
  • Time limits that can be extended or turned off
  • No content that flashes more than three times per second (seizure risk)
  • Reading level appropriate for the audience (lower secondary education, ~8th grade, where possible)

Most healthcare websites built before 2020 fail multiple criteria. The most common failures we see: missing alt text, inadequate color contrast on call-to-action buttons, forms that aren't screen-reader compatible, and PDF documents that aren't tagged for accessibility.

Why this is separate from the ADA Title III wave

ADA Title III bars discrimination by "places of public accommodation," and federal courts have been litigating since the 2010s whether websites count as places of public accommodation. The Ninth Circuit said yes in Robles v. Domino's (2019), and the Supreme Court declined to take the appeal. UsableNet tracked roughly 4,600 ADA Title III website lawsuits in 2023, with healthcare as the second-most-targeted sector after retail.

Section 1557 is its own regulatory regime, enforced by HHS. The two overlap but aren't the same. A practice can be sued under ADA Title III by a private plaintiff and separately investigated by HHS under Section 1557. The ADA suits typically settle for $25K-$75K plus attorneys' fees plus a remediation commitment. Section 1557 enforcement can include funding consequences.

What "small entity" means

The rule has a delayed deadline (May 11, 2027) for "small entities," defined as those with fewer than 15 employees. Most independent physician practices qualify. Hospitals, multi-physician groups, health systems, and large telehealth platforms do not.

Even small entities should plan to comply earlier. The ADA Title III suits don't recognize the small-entity carve-out, and most practices that fix their site for ADA will be fine for Section 1557 too.

How to actually check your site

Three free tools for a first pass.

axe DevTools is a browser extension from Deque. Run it on your homepage, your scheduling page, and your patient portal login page. It will list the issues by severity.

WAVE is a browser-based scanner from WebAIM. Paste in any URL. It produces a visual report showing where the accessibility issues are on the page.

Lighthouse is built into Chrome's developer tools. It produces an accessibility score from 0 to 100 along with specific recommendations.

If you fail any of these, you'll fail a Section 1557 audit too. Get a developer who's done WCAG remediation before — this is specialized work and the wrong fix can introduce new problems.

Why this is on a HIPAA blog

Because the same scan that tells you where your tracking pixels are also tells you whether you'll pass a Section 1557 audit. Both are externally observable from your public site. Both have federal deadlines. Both have a class-action plaintiffs' bar building cases. Treat them as one project.