Section 504 treats inaccessible digital experiences as disability discrimination. When an organization that receives federal financial assistance runs a website, app, or document library that people with disabilities can't use, it risks an Office for Civil Rights (OCR) complaint, a multi-year resolution agreement, a federal lawsuit, and in the last resort, its federal funding.
Section 504 of the Rehabilitation Act of 1973 has required this since long before the web. The newer piece is a specific technical standard. Under the Department of Health and Human Services (HHS) Section 504 rule, recipients of HHS funding must bring web content and mobile apps to WCAG 2.1 Level AA. A May 2026 interim final rule moved those dates to May 11, 2027, for recipients with 15 or more employees and May 10, 2028, for smaller ones. It didn't pause anything else. The underlying duty, and the right to complain or sue, apply today.
This guide covers digital accessibility obligations for organizations that receive federal funds, such as universities, hospitals, and public agencies. If you're looking for help with a student's 504 plan or an IEP under the Individuals with Disabilities Education Act (IDEA), this isn't that guide.
Who Section 504 covers
Section 504 applies to programs and activities that receive federal financial assistance, and to programs that federal executive agencies run themselves. A federal grant makes you a recipient. A federal contract, on its own, doesn't.
Coverage is usually broader than teams expect. For a college or university, a state agency, or a local government department, the "program or activity" is generally the whole institution, not just the grant-funded project. A corporation is covered in full when it's principally engaged in education, health care, housing, social services, or parks and recreation. For a plain-language definition, see our Section 504 digital accessibility glossary entry.
How Section 504 fits with the ADA and Section 508
Section 504 doesn't work alone. Most recipients sit under at least one other law too:
- ADA Title II covers state and local governments, including public universities and public hospitals. The Department of Justice's Title II rule adopts WCAG 2.1 Level AA.
- ADA Title III covers places of public accommodation, such as private businesses open to the public.
- Section 508 covers the information and communication technology that federal agencies develop, buy, and use. It incorporates WCAG 2.0 Level A and AA by reference.
Meeting one law doesn't discharge another. A public university can owe the same accessible website under both Title II and Section 504.
What counts as a Section 504 digital violation
A violation happens when a person with a disability is excluded from, denied the benefits of, or discriminated against in a covered program, and the barrier is digital. These scenarios show the pattern:
| Scenario | What it breaks |
|---|---|
| An online admissions or job application form can't be completed with a screen reader | Equal access to the program itself, not just the website |
| Course materials in a learning management system can't be navigated by keyboard | Equal opportunity to participate in instruction |
| A patient portal's scheduling or results pages don't work with assistive technology | Equal access to health services and communication with the provider |
| Critical information is published only as scanned, untagged PDFs | Effective communication with people who use screen readers |
| A vendor platform is bought with no accessibility terms and excludes users | The recipient's own duty, which it can't hand off to the vendor |
| A user reports a barrier and nobody responds or offers an alternative | Grievance and reasonable modification duties |
The last row matters more than it looks. Investigators look at how the organization responded to the person who reported a barrier, not only at the barrier itself.
What happens when Section 504 is violated
Section 504 has two enforcement routes: administrative enforcement by the agency that provides the funding, and private lawsuits. Neither one runs on fines.
1. A complaint or a compliance review
Most cases start with a complaint to the funding agency's Office for Civil Rights. That's the Department of Education's OCR for colleges and universities and HHS's OCR for hospitals and health systems. Anyone can file, including someone who wasn't personally affected. The Department of Education generally requires filing within 180 days of the alleged discrimination, with waivers for good cause. Agencies can also open a compliance review on their own.
2. Investigation and a resolution agreement
OCR investigates by requesting documents, reviewing the digital properties at issue, and interviewing staff. Most digital cases end in a resolution agreement. The institution commits to specific fixes, policies, training, and reports, and OCR monitors it until the terms are met. An institution can often resolve a case voluntarily before the investigation concludes. That doesn't end the obligation. It replaces a finding with a monitored plan.
3. Administrative enforcement and federal funding
If a recipient won't agree to remedies or breaks an agreement, the agency can start proceedings to terminate federal financial assistance after a hearing, or refer the case to the Department of Justice for litigation. Funding termination is rare, but it's the leverage behind every resolution agreement. The procedures are set out in the agencies' Section 504 regulations, such as 34 CFR Part 104 for the Department of Education.
4. Private lawsuits
Individuals can sue under Section 504 in federal court without filing with OCR first. The remedies are:
| Remedy | What it means for a recipient |
|---|---|
| Injunctive relief | A court orders specific fixes, often across the whole digital estate, sometimes with outside monitoring |
| Compensatory damages | Generally available only for intentional discrimination. Since Cummings v. Premier Rehab Keller (2022), damages for emotional distress aren't recoverable. |
| Attorney's fees | A prevailing plaintiff can recover fees, which often exceed the cost of the fix |
Whichever route a case takes, the institution ends up rebuilding under someone else's deadline. Investigators also look at what the institution knew and when. An audit that found a barrier nobody fixed becomes a record of what the institution knew.
A resolution agreement in practice
Framingham State University in Massachusetts shows what a digital case looks like after the complaint. Following an OCR complaint about the accessibility of its website, the university signed a resolution agreement with the Department of Education's OCR on April 13, 2018, replacing an earlier agreement. The university agreed to report to OCR by January 6, 2020, showing it had met the terms. In the meantime, OCR could visit the campus, interview staff and students, and request more data. The agreement wasn't an admission of wrongdoing, but OCR kept the right to start enforcement proceedings if the university fell short.
The work behind it ran across the institution. The university had an outside firm audit its website, assigned remediation to its web team, trained content editors, and adopted a plan for keeping new content accessible. That's the typical shape of a Section 504 remedy: an institution-wide program with deadlines, not a single fix.
The barriers behind most violations
Large organizations often struggle with scale. One error on a template can repeat across thousands of pages. Many organizations fail in the same areas:
- Informative images with no text alternative (decorative images should be hidden from screen readers instead)
- Online forms that don't work with screen readers and other assistive technology
- Videos that lack captions or transcripts
- PDFs and documents that aren't tagged for accessibility
- Buttons and menus that you can't use without a mouse
These aren't minor bugs. They're digital walls. If a student can't read a syllabus because the PDF is just an image, the university hasn't provided equal access to the course. The same is true of a patient portal a screen reader can't get through, or an enrollment system on a university website that only works with a mouse.
What resolution agreements require you to build
Resolution agreements in digital cases tend to require the same elements. An organization that builds them before a complaint has something to show when one arrives:
- A coordinator and a grievance procedure: Section 504 regulations require larger recipients to designate a responsible employee and adopt grievance procedures. Keep a clear way to report barriers and a record of how each report was handled, because investigators will ask for both.
- A written policy and standard: Name the technical standard (WCAG 2.1 Level AA) and assign owners for each digital property.
- An audit of existing content: A repeatable accessibility audit that combines automated and manual testing across websites, apps, and documents.
- A prioritized remediation plan: Rank fixes by user impact, legal risk, and effort, and track them like any other defect, with deadlines.
- Controls on new content and procurement: Require an up-to-date Accessibility Conformance Report from vendors and write accessibility terms into contracts. You can't hand your Section 504 duty to a vendor.
- Training: Training for the designers, developers, and content editors who publish, matched to their role.
- Ongoing monitoring and reporting: Evidence of progress over time, not a one-off snapshot.
For how these duties apply to websites specifically, see Section 504 website compliance.
Frequently asked questions
Can you be fined for a Section 504 violation?
Not in the usual sense. Section 504 has no civil fine schedule. The financial exposure comes from remediation costs under a resolution agreement or court order, compensatory damages for intentional discrimination, the other side's attorney's fees, and in the last resort, the loss of federal funding.
Can an individual employee be personally fined or sued?
Generally, no. Section 504 obligations attach to the program or activity that receives federal financial assistance, and federal courts have generally held that individual employees can't be sued in their personal capacity under Section 504. An inaccessible course file or form is still the institution's violation, and the institution answers for it.
Can individuals sue under Section 504?
Yes. Section 504 is privately enforceable in federal court, and a person doesn't need to file with OCR first. Remedies include court-ordered fixes, compensatory damages for intentional discrimination, and attorney's fees.
Does the HHS deadline extension pause enforcement?
No. The interim final rule moved only the dates for meeting WCAG 2.1 Level AA. It doesn't relieve HHS recipients of their other Section 504 obligations, including the duty to make reasonable modifications. Complaints and lawsuits remain available now.
How long does a Section 504 complaint take to resolve?
Filing deadlines are short and resolution is slow. Department of Education complaints are generally due within 180 days of the alleged discrimination, or within 60 days after an institution's own grievance process ends. Once a resolution agreement is signed, monitoring often runs for a year or more. Framingham State's final report was due about 21 months after it signed.
What should you do when an OCR complaint arrives?
Involve counsel early and meet every deadline OCR sets. Gather the records investigators will ask for: your accessibility policy, coordinator, audit results, remediation tickets, and how you handled the complainant's report. If the barrier is real, fix it for the complainant now and look at whether resolving the case voluntarily makes sense before the investigation concludes.
Next steps
A Section 504 case almost always ends with the same program in place: an owner, a policy, an audit, a remediation plan, procurement controls, and a way for users to report barriers. The organizations that fare best build that program before a complaint, not under an agreement.
- Appoint a champion: Name an executive to lead accessibility across all teams.
- Audit your assets: Check your top websites, apps, and document libraries against WCAG 2.1 Level AA.
- Update your contracts: Add accessibility terms to all new vendor agreements and renewals.
- Train your talent: Provide role-specific training for designers, developers, and content editors.
To see how continuous monitoring supports that program, explore Siteimprove.ai Accessibility.
This content is for informational purposes only and does not constitute legal advice. WCAG is a technical standard, and legal obligations vary by funding source and context. Consult qualified counsel for legal guidance.
