IRS Enforcement and Audit Risks for Health Accounts
IRS enforcement activity related to HSAs, FSAs, and HRAs focuses on the gap between tax-preferred treatment claimed and actual qualified use of funds. Misuse of these accounts — through non-qualified withdrawals, excess contributions, or inadequate recordkeeping — can trigger additional tax, statutory penalties, and interest under the Internal Revenue Code. Understanding how the IRS identifies, examines, and resolves these issues is essential for both account holders and employers who sponsor health benefit plans.
Definition and scope
IRS enforcement over tax-advantaged health accounts operates under several provisions of the Internal Revenue Code. HSAs are governed primarily by IRC § 223, FSAs fall under IRC § 125 (cafeteria plan rules), and HRAs are governed by guidance including IRS Notice 2002-45. Enforcement "scope" refers to the range of taxpayer conduct the IRS can examine — from individual Form 8889 filings to employer plan documents and third-party administrator records.
The IRS does not maintain a publicly disclosed audit rate specific to health accounts. Enforcement exposure arises from three distinct sources:
- Automated matching — the IRS matches Form 1099-SA (distributions reported by trustees) against Form 8889 (filed by the account holder) to identify unreported or mischaracterized withdrawals.
- Schedule A and Form 8889 cross-referencing — claiming medical expense deductions while also excluding HSA-funded expenses is a known consistency error the IRS flags through document matching programs.
- Employer plan examinations — IRS Employment Tax examinations and Employee Plans audits can include review of Section 125 cafeteria plan documents, FSA administration, and ERISA plan compliance for HRAs.
The detailed regulatory framing for these accounts is covered at /regulatory-context-for-health-savings.
How it works
When the IRS identifies a potential discrepancy in a health account filing, the process typically proceeds through identifiable stages:
- Automated notice issuance — CP2000 notices are generated when income or distribution figures reported by trustees (Form 1099-SA) do not match the taxpayer's Form 8889 or Form 1040. The CP2000 proposes additional tax and requests a response within 60 days (IRS CP2000 Notice Guidance).
- Correspondence examination — The IRS requests substantiation of qualified medical expenses through a written examination, without an in-person audit. The account holder must produce receipts, Explanation of Benefits (EOB) documents, or provider statements matching each HSA distribution.
- Field examination — In employer-focused audits, an IRS revenue agent may review plan documents, enrollment records, and reimbursement substantiation for FSAs and HRAs on-site or through document submission.
- Assessment and appeal — If the IRS concludes a distribution was non-qualified or a contribution exceeded statutory limits, it issues a Notice of Deficiency. Taxpayers have 90 days to petition the U.S. Tax Court before the deficiency becomes final (IRS Notice of Deficiency, IRC § 6212).
Penalty exposure for non-qualified HSA withdrawals is governed by IRC § 223(f)(4): a 20% excise tax applies to distributions not used for qualified medical expenses, in addition to ordinary income tax on the withdrawn amount. This 20% rate applies to account holders under age 65 who are not disabled or deceased (IRS Publication 969).
Common scenarios
Three fact patterns account for the majority of IRS attention on health accounts:
Non-qualified distributions. An account holder withdraws HSA funds for expenses that do not qualify under IRC § 213(d) — gym memberships, cosmetic procedures, or general wellness products not recommended by a physician. The trustee reports the full distribution on Form 1099-SA; if the account holder fails to report the non-qualified portion on Form 8889 line 17a, automated matching generates a discrepancy.
Excess contributions. Contributions above the annual IRS limit (IRS Revenue Procedure setting annual HSA limits) that are not withdrawn by the tax filing deadline (plus extensions) are subject to a 6% excise tax per year under IRC § 4973 for each year the excess remains in the account. For 2024, the contribution limit is $4,150 for self-only HDHP coverage and $8,300 for family coverage (IRS Rev. Proc. 2023-23). Procedures for correcting excess contributions are addressed at /excess-contribution-correction-procedures.
FSA substantiation failures. Under Treasury Regulation § 1.125-6, FSA reimbursements require third-party substantiation for every expense. Debit card transactions auto-adjudicated without proper substantiation (such as at non-IIAS merchants) can jeopardize the entire cafeteria plan's tax-preferred status for all employees if identified in an employer plan examination.
Double-dipping. Deducting an expense as an itemized medical deduction on Schedule A while also reimbursing the same expense through an HSA or FSA violates the general rule against double tax benefit. IRS document matching between Schedule A and Form 8889 is a standard detection mechanism.
Decision boundaries
The primary analytical distinction in IRS enforcement is between qualified and non-qualified use of funds, which determines whether income tax, excise tax, or both apply.
| Scenario | Tax consequence |
|---|---|
| Qualified medical expense (IRC § 213(d)) paid with HSA funds | No income tax; no excise tax |
| Non-qualified HSA distribution, account holder under 65 | Ordinary income tax + 20% excise tax (IRC § 223(f)(4)) |
| Non-qualified HSA distribution, account holder 65 or older | Ordinary income tax only; 20% excise does not apply |
| Excess HSA contribution not corrected | 6% excise tax per year under IRC § 4973 |
| FSA reimbursement without substantiation | Entire plan payment may be treated as taxable compensation |
A second boundary concerns recordkeeping adequacy. IRS Publication 969 states that account holders should keep records sufficient to show distributions were made exclusively for qualified medical expenses. No specific retention period for health account records is codified in IRC § 223, but the general three-year statute of limitations under IRC § 6501 applies to most income tax returns — extended to six years if income is understated by more than 25%.
The National Health Savings Authority home resource provides structured access to the full body of guidance on these account types, including contribution limits, qualifying expense definitions, and employer plan requirements that directly inform audit risk management.
References
- IRS Publication 969 — Health Savings Accounts and Other Tax-Favored Health Plans
- IRS Form 8889 and Instructions — Health Savings Accounts
- IRS Form 1099-SA — Distributions from an HSA, Archer MSA, or Medicare Advantage MSA
- IRC § 223 — Health Savings Accounts (via eCFR)
- IRC § 125 — Cafeteria Plans (IRS overview)
- IRS Rev. Proc. 2023-23 — 2024 HSA Contribution Limits
- IRS CP2000 Notice Guidance
- Treasury Regulation § 1.125-6 — Substantiation Requirements for FSAs
- IRS Notice 2002-45 — Health Reimbursement Arrangements
The law belongs to the people. Georgia v. Public.Resource.Org, 590 U.S. (2020)