Healthcare CMS: Fix or Replace for Section 504 Compliance?
Remediating your website CMS, meaning fixing the site you have, is usually a faster path to the Section 504 deadline of May 11, 2027 than replacing it. Replacement makes sense when the platform itself blocks accessible publishing, or when other reasons already justify it.
This guide is for healthcare CIOs and digital leaders with a patient-facing site on an aging CMS. It sums up public sources and is not legal advice.
Your heading goes here
Key Takeaways
- HHS moved the Section 504 web deadline to May 11, 2027 for providers with 15 or more employees. The standard is still WCAG 2.1 AA.
- Public healthcare providers may also face an earlier ADA Title II date of April 26, 2027.
- The rule covers vendor tools such as patient portals. A new CMS does not fix them.
- Replace the CMS when it blocks accessible publishing or other reasons already justify it.
- Varbase, Vardot’s AI-powered CMS built on Drupal, ships an inline accessibility checker and editorial review from day one.
What Does the Section 504 Web Accessibility Rule Require by 2027?
Section 504 of the Rehabilitation Act bans disability discrimination in programs that get federal funds. Under it, the US Department of Health and Human Services (HHS) requires funded providers to make their web content and mobile apps meet WCAG 2.1 Level AA. WCAG, the Web Content Accessibility Guidelines, is the W3C standard for accessible web content. AA is its middle level.
Providers with 15 or more employees must comply by May 11, 2027, and smaller ones by May 10, 2028. A May 2026 interim final rule moved each date back one year. The delay doesn’t pause other Section 504 duties, such as making reasonable changes when a patient needs access.
The rule reaches most healthcare providers. HHS estimates that about 92% of doctors get federal funds and must follow Section 504, as MGMA reports.
Public healthcare providers can face a second deadline. The Department of Justice (DOJ) ADA Title II web rule covers state and local governments and the services they run. Governments with 50,000 or more residents must meet WCAG 2.1 AA by April 26, 2027, and smaller ones by April 26, 2028.
Why Does the One-Year Extension Change the CMS Decision?
The one-year extension makes a CMS replacement possible before the Section 504 deadline, but only just.
A team that starts on October 1, 2026 has just over seven months until May 11, 2027. Vardot’s published estimate for rebuilding an older Drupal site, rather than an in-place upgrade, is seven to twelve months.
Any later start needs a backup plan: fix the current site in parallel.
How Accessible Are Most Websites Today?
Most websites still fail basic automated checks. The WebAIM Million 2026 report found WCAG failures on 95.9% of the top one million home pages. The average page had 56.1 errors.
Six failure types make up 96% of the errors WebAIM found:
Most common failure (WebAIM Million 2026) | Home pages affected | Who usually fixes it (our view) |
|---|---|---|
Low contrast text | 83.9% | Design system and theme |
Missing alternative text | 53.1% | Editors, when they publish |
Missing form input labels | 51.0% | Templates and form builders |
Empty links | 46.3% | Templates and editors |
Empty buttons | 30.6% | Templates |
Missing document language | 13.5% | Templates |
Alternative (alt) text is a short written description of an image for people who can’t see it. Template failures are usually fixed once. Editors write alt text and link text every day, so those break again unless the CMS makes the accessible choice the default.
Where Does Accessibility Risk Sit on a Healthcare Website?
Accessibility risk on a healthcare website sits in three layers. A CMS decision touches only two:
- Templates and components: layouts, menus, forms, color, and the design system. Developers fix these, usually once.
- Authored content: service line pages, provider profiles, location pages, news, and patient PDFs. Editors across departments create these daily.
- Third-party tools: patient portals, online scheduling, find-a-doctor tools, bill pay, and chat. Vendors supply these, and the site links to them.
As MGMA notes, the HHS rule also covers sites and apps that vendors run for a provider under contract. If a vendor’s portal fails, it's still the provider’s problem, and a new CMS doesn’t fix it.
When Is Replacing the CMS the Wrong Answer?
Replacing a legacy CMS is the wrong answer for many healthcare organizations facing the 2027 deadline. Fix the current site first if any of these apply:
- Most failures sit in third-party tools. If an audit finds serious barriers in portal, scheduling, or bill pay flows, spend the budget on vendor fixes.
- You can’t finish by May 11, 2027, and can’t fix the old site in parallel. A half-built new site next to an unfixed old one leaves two failing sites on the compliance date.
- The deadline is the only reason. A deadline-driven replacement risks being scoped too narrowly to pay for itself.
When Does Replacing a Legacy Healthcare CMS Make Sense?
Replacing the CMS makes sense when the platform itself keeps creating barriers, or when you have other reasons to replace it:
- The CMS can’t require alt text, and staff can paste raw code into pages.
- The vendor has ended support, or your version gets no security updates.
- Your main site, microsites, and acquired practices run on different platforms.
- Patient information sits in PDFs because the CMS can’t structure it as web pages.
- A redesign is already funded, so templates will be rebuilt anyway.
Why Is Healthcare Website Accessibility an Authoring Problem First?
Our view: templates get fixed once, but content breaks every day. The right test for a healthcare CMS isn’t whether it can pass by May 2027. It’s whether it keeps itself compliant with the editors you actually have.
Many hands publish a healthcare website, from service line marketers to HR and foundation staff. Pages fixed without changing how staff write them start to decay with the next provider profile.
That is why we build healthcare sites on Varbase, Vardot’s AI-powered CMS built on Drupal, and build their components to WCAG 2.2 AA. Its default site template includes each of these authoring defaults:
Authoring default | How Varbase provides it |
|---|---|
A checker editors see as they work | Editoria11y flags issues such as missing alt text and empty links inline. |
Review before anything goes live. | Content moves through roles and approvals before publishing, with a full change history. |
Structured page templates instead of free-form HTML | Pages built from ready-made components in Drupal Canvas. |
An optional AI feature can write alt text when an image is uploaded, and editors review every change before it publishes. Your team picks the AI provider and can keep AI away from sensitive content.
WebAIM’s 2026 data found that Drupal home pages averaged 41.2 errors, 26.5% below the average page. That shows a pattern, not proof: governance still matters more than platform.
How Do You Decide Between Fixing and Replacing Your CMS?
Six yes-or-no statements give a quick first read on the remediate-or-replace choice, using facts you already have.
- Your CMS version still gets security updates, with support promised beyond 2027.
- Your CMS can require alt text and stop editors from pasting unstructured code.
- An audit shows most serious barriers sit in templates you control, not in third-party patient tools.
- You can fix contrast, forms, and menus in your theme without a redesign.
- You run one platform, not several inherited through mergers.
- Patient-facing information lives mostly in web pages, not PDFs.
Your yes count suggests a path, and your audit confirms it:
Yes answers | Path | What to do before May 11, 2027 |
|---|---|---|
Five or six | Remediate | Fix templates now, train editors, add authoring checks, and add accessibility terms to vendor contracts. |
Three or four | Remediate first | Fix the current site for May 2027. Weigh replacement on its own business case for 2027 to 2028. |
Two or fewer | Consider replacement | Decide by the end of 2026 and choose a platform with accessible authoring built in, such as Varbase. Fix the old site in parallel. |
On any path, start on vendor tools now. Ask each patient-facing vendor for an Accessibility Conformance Report (ACR), a formal report on how well its product meets WCAG 2.1 AA, and a date to close any gaps.
What Does Each Path Cost to Run?
Accessibility has an ongoing cost that no platform removes. Content decays with every new page, so both paths need regular checks, editor training, and new tests after each release.
Replacement adds one-time costs on top: moving content, running two sites at once, retraining every editor, and redirect and search work at launch.
Where Should a Healthcare Organization Start Before the 2027 Deadline?
Start with an accessibility audit against WCAG 2.1 AA or later before the end of 2026. It shows which path the May 11, 2027 date allows. For vendor tools such as patient portals, use each vendor’s conformance report.
Vardot, a Drupal Diamond Certified Partner, helps healthcare organizations fix Drupal sites in place or move from other platforms onto Varbase.