Yes, HSA accounts can get audited, but almost never on their own. Health Savings Account activity gets reviewed as part of a broader look at your individual tax return, and most of what people call an “HSA audit” is actually an automated notice flagging a mismatch between what your trustee reported and what you claimed. The stakes still matter: a distribution you can’t tie to a qualified medical expense picks up income tax plus a 20% additional tax.
How the IRS Actually Watches Your HSA
The agency doesn’t wait for an audit to see what’s happening in your account. Your HSA trustee files two information returns every year. Form 1099-SA reports total distributions, including whether the money went to a medical provider or to you.1Internal Revenue Service. Form 1099-SA (Rev. April 2025) – Distributions From an HSA, Archer MSA, or Medicare Advantage MSA Form 5498-SA reports your contributions and the account’s fair market value at year end.2Internal Revenue Service. About Form 5498-SA, HSA, Archer MSA, or Medicare Advantage MSA
You then file Form 8889 with your return, reporting contributions, distributions, and how much of the distributions paid for qualified medical expenses.1Internal Revenue Service. Form 1099-SA (Rev. April 2025) – Distributions From an HSA, Archer MSA, or Medicare Advantage MSA The IRS runs those three forms through its Automated Underreporter system. When the numbers don’t line up, the system generates a CP2000 notice proposing adjustments.3Internal Revenue Service. Topic No. 652, Notice of Underreported Income – CP2000
A CP2000 is not technically an audit. It’s a letter saying the math doesn’t add up and proposing additional tax. You generally have 30 days to respond if you live in the United States, or 60 days if you’re abroad, and paying the proposed amount within 30 days stops interest and penalties from piling up.3Internal Revenue Service. Topic No. 652, Notice of Underreported Income – CP2000 Many “HSA audits” are this kind of automated correspondence rather than a full examination.
What Triggers a Closer Look
The most common trigger is a plain mismatch: the distribution total on your 1099-SA doesn’t match your Form 8889. This happens when people forget to file Form 8889 altogether, report the wrong distribution total, or fail to indicate how much went toward qualified medical expenses. The automated system doesn’t know why the numbers differ. It just flags the gap.
Large distributions relative to your reported income also draw attention, especially a lump sum that looks more like a personal withdrawal than a medical payment. Contributions over the annual limit are another red flag, since your trustee’s report will show the excess and the 6% excise tax follows automatically.
Eligibility issues are harder for the system to catch on its own but come up during full examinations. If you contributed while not enrolled in a qualifying High Deductible Health Plan, or during months you had disqualifying coverage like Medicare or a general-purpose Flexible Spending Account, an auditor reviewing your insurance records will notice.
What a Non-Qualified Distribution Costs
Money that comes out of an HSA and isn’t used for qualified medical expenses is treated as regular taxable income. On top of the income tax, there’s a 20% additional tax on the amount.4Office of the Law Revision Counsel. 26 USC 223 – Health Savings Accounts Withdraw $5,000 for something that doesn’t qualify and you owe income tax at your marginal rate plus another $1,000 in penalty tax, along with interest running back to the original filing deadline.
The burden of proof sits with you. Trustees report totals; they don’t verify whether individual purchases were medically necessary. If the IRS questions a distribution and you can’t produce documentation showing a qualifying expense, the money gets reclassified as taxable income.4Office of the Law Revision Counsel. 26 USC 223 – Health Savings Accounts
Qualified expenses generally include doctor visits, hospital services, prescription drugs, dental and vision care, and mental health services. Cosmetic procedures, gym memberships, nutritional supplements, and over-the-counter medicines not prescribed by a doctor typically don’t qualify.5Internal Revenue Service. Publication 502, Medical and Dental Expenses The line isn’t always obvious. A weight-loss program prescribed for a specific condition qualifies; a general wellness program doesn’t. When in doubt, keep the receipt and the doctor’s recommendation.
Prohibited Transactions: The Worst-Case Outcome
Beyond routine distribution and contribution rules, HSAs are subject to the prohibited transaction rules. That covers things like using your HSA to buy property from yourself, pledging the account as loan collateral, or using account assets for personal benefit outside qualified medical expenses.6Office of the Law Revision Counsel. 26 USC 4975 – Tax on Prohibited Transactions
The consequence is severe. The account stops being an HSA, and the entire fair market value is treated as distributed to you. The full balance becomes taxable income for that year, and if you’re under 65, the 20% additional tax applies to the whole amount.4Office of the Law Revision Counsel. 26 USC 223 – Health Savings Accounts On a $50,000 balance, that’s $10,000 in penalty tax alone before income tax. These situations are rare, but they’re the most catastrophic HSA audit outcome.
Records That Protect You
Itemized receipts are the primary defense. Each should show the date of service, the provider’s name, a description of the service or product, and the amount charged. Credit card statements by themselves aren’t enough because they show you paid a medical office but not what the payment was for. Pairing receipts with an Explanation of Benefits from your insurer creates a much stronger paper trail.
Keep records for at least three years after your tax filing deadline. That’s the standard window the IRS has to assess additional tax on a return.7Internal Revenue Service. How Long Should I Keep Records If the agency believes you omitted more than 25% of your gross income, the window stretches to six years.8Office of the Law Revision Counsel. 26 USC 6501 – Limitations on Assessment and Collection A large unreported HSA distribution could push you over that threshold, so keeping records longer is the safer play.
Digital copies work if they’re legible and retrievable. The IRS requires electronically stored records to be accurate, complete, and reproducible as hard copies on request.9Internal Revenue Service. Revenue Procedure 97-22 In practice, that means clear scans organized by year. Thermal receipts fade fast; scan those sooner rather than later. Every record should also show the expense wasn’t reimbursed by another source, like a secondary insurance plan.
Fixing Mistakes Before They Escalate
If you accidentally used HSA funds for a non-medical expense, you may be able to return the money and avoid the tax hit. The IRS allows repayment of mistaken distributions made due to a mistake of fact and reasonable cause. The deadline is April 15 following the first year you knew or should have known the distribution was a mistake.10Internal Revenue Service. Distributions From an HSA
This isn’t a way to spend HSA money freely and repay it if you get caught. You need clear and convincing evidence of an actual error. Using your HSA debit card at a retailer for what you thought was an eligible item, only to learn it wasn’t, is a plausible mistake of fact. Pulling money out for a vacation and trying to recharacterize it months later is not.
For excess contributions, the fix is simpler: withdraw the excess plus any earnings on it before your tax filing deadline, including extensions. Miss that deadline and the 6% excise tax applies for every year the excess stays in the account.11Internal Revenue Service. Publication 969 (2025), Health Savings Accounts and Other Tax-Favored Health Plans
How Far Back the IRS Can Look
The standard statute of limitations to assess additional tax is three years from the date you filed the return.7Internal Revenue Service. How Long Should I Keep Records For most HSA holders, that’s the relevant window. Two situations extend it.
If you omit from gross income an amount exceeding 25% of what you reported, the IRS gets six years. Unreported HSA distributions count as omitted gross income, so a large unaccounted-for withdrawal can trigger the longer period.8Office of the Law Revision Counsel. 26 USC 6501 – Limitations on Assessment and Collection If you file a fraudulent return or don’t file at all, there’s no statute of limitations, and the agency can come after you indefinitely.
The practical takeaway: keep HSA records for at least six years, even though three is the minimum. Storage is cheap. Explaining a five-year-old distribution without a receipt is not a spot to end up in.