How to Accept HSA Payments: MCC Codes, IIAS, and Setup

To accept HSA payments, your business needs a merchant account coded under a healthcare Merchant Category Code (MCC) with your payment processor, and if you sell a mix of medical and non-medical products, you’ll also need Inventory Information Approval System (IIAS) certification. Everything else — the receipts, the documentation, the troubleshooting — flows from getting those two pieces right. Most licensed healthcare providers can be up and running within a week.

The MCC Is the Gatekeeper

Every card-accepting business is assigned a four-digit Merchant Category Code by its processor. Card networks use that code to sort transactions by industry, and HSA card issuers use it to decide, in the first fraction of a second, whether a charge even looks like a medical expense. If your business carries a retail or general-services code, an HSA card declines before the transaction reaches the cardholder’s account. Nothing else you do matters until the code is right.

The reason sits in tax law. Under Section 223 of the Internal Revenue Code, qualified medical expenses are defined by reference to Section 213(d), which covers amounts paid for the diagnosis, treatment, mitigation, or prevention of disease, along with care that affects any structure or function of the body.1Office of the Law Revision Counsel. 26 USC 223 – Health Savings Accounts2Office of the Law Revision Counsel. 26 USC 213 – Medical, Dental, Etc., Expenses Cosmetic procedures are excluded unless they correct a deformity from a congenital condition, accident, or disease. Issuers can’t inspect every purchase, so they use the MCC as a rough proxy.

Healthcare Codes That Trigger Automatic Acceptance

Businesses assigned one of the recognized healthcare MCCs can generally accept HSA debit cards without any additional inventory system. The common ones:

  • 8011: Doctors and physicians
  • 8021: Dentists and orthodontists
  • 8041: Chiropractors
  • 8042: Optometrists and ophthalmologists
  • 8049: Podiatrists
  • 8050: Nursing and personal care facilities
  • 8062: Hospitals
  • 8099: Medical services and health practitioners (a broad catch-all)

MCC 8099 is worth knowing about. It’s the code most payment platforms assign to health practitioners who don’t fit the specialty codes above: acupuncturists, physical therapists, licensed counselors, and similar providers.

What a Wrong Code Looks Like

A miscoded business is effectively invisible to HSA cards. A common version: a licensed massage therapist coded under a “massage parlor” category rather than a medical services code. The issuer sees a non-healthcare MCC and blocks the transaction instantly. The cardholder can’t override it at the terminal, and neither can you. The fix has to happen at the processor level as a code change, which can take several business days to propagate.

Setting Up the Merchant Account

There’s no separate “HSA merchant account.” What you need is for your regular merchant account to carry the correct healthcare MCC. Your processor will ask for documentation confirming that your business legitimately provides healthcare services. Have these ready:

  • Your federal Employer Identification Number (EIN), which ties the business to its IRS filings.3Internal Revenue Service. Employer Identification Number
  • A copy of your state medical, dental, chiropractic, or other professional healthcare license.
  • A clear written description of the services you provide, specific enough that the processor can pick the right MCC.
  • Current processing statements if you’re switching from another processor, which speeds up underwriting.

Get the business description right the first time. A vague description leads to a generic MCC, which leads to declined transactions from every HSA cardholder you see. Fixing a misassigned code after the fact means contacting support, resubmitting documents, and waiting again for the change to move through the networks.

On Square and Stripe

On Square, licensed healthcare providers and pharmacies are eligible to accept HSA and FSA cards. If your category isn’t already set correctly, you have to contact Square’s customer success team; there’s no self-service toggle, and the change happens on their end after they verify your credentials.4Square. Accept Payment Cards With Square

On Stripe, the process is similar. You contact support and request that your account be configured with a healthcare MCC such as 8099, 8011, or 8021. Once the code is in place, HSA and FSA debit cards process like any other Visa or Mastercard payment. There’s no separate healthcare module to install.

Once your processor confirms the update, run a small live transaction with an actual HSA card. That’s the only reliable way to confirm the change has propagated through the network. Most processors finish the integration within three to seven business days, though some updates take effect within 24 hours.

Mixed-Inventory Retailers: IIAS and the 90% Rule

Dedicated medical offices have a simple path: right MCC, done. Retailers that sell a mix of medical and non-medical goods face a harder problem. A pharmacy that also sells snacks, greeting cards, and household goods can’t charge the whole basket to an HSA card. That’s what the Inventory Information Approval System is for.

IIAS checks each product’s stock-keeping unit against a database of eligible healthcare items and splits the transaction at the point of sale so that only qualified amounts are charged to the HSA or FSA card.5SIGIS. Merchants Without IIAS, card issuers decline transactions at retailers that don’t already carry a healthcare MCC.

Certification runs through SIGIS, the industry standards body. You contact your payment processor or point-of-sale software provider to confirm the system can support IIAS processing, then submit a Merchant Certification Self-Assessment Form through SIGIS. The certified merchant list updates daily.6SIGIS. IIAS Certification

The 90% Rule

Pharmacies and similar stores where nearly all sales are already healthcare-related can skip IIAS through the IRS 90% rule. If 90% or more of a specific store location’s gross sales come from prescriptions and qualified over-the-counter healthcare products, that location can register through SIGIS in place of full IIAS certification.7SIGIS. 90% Registration Registration requires annual re-attestation of the sales figures.

One caveat: even with 90% rule registration, some third-party plan administrators still decline transactions at stores that lack full IIAS certification. The 90% rule is an IRS-level exemption; individual benefit plans can set stricter requirements.

Wellness and Non-Traditional Providers

Massage therapists, yoga instructors, nutritionists, and other wellness providers can accept HSA payments, but the setup involves an extra layer. The IRS draws a line between medical treatment and general wellness. A massage prescribed to treat chronic back pain qualifies under Section 213(d). A relaxation massage does not.2Office of the Law Revision Counsel. 26 USC 213 – Medical, Dental, Etc., Expenses

For services in this gray zone, the cardholder typically needs a Letter of Medical Necessity from a licensed healthcare provider. The letter should name the diagnosis, explain why the service is medically necessary for treatment, and state the recommended frequency and duration. It should also confirm that the service is not for general wellness. Without that letter, the HSA administrator will likely deny the expense on review.

From your side as the merchant, two things matter. Make sure your MCC is 8099 (medical services and health practitioners) rather than a spa or recreation code, because a spa MCC blocks the card automatically regardless of the individual service. And produce receipts that describe the specific treatment, not just “massage” or “session.”

What Every HSA Receipt Should Include

Clean receipts protect both you and your customers. HSA account holders must keep records proving their distributions went toward qualified medical expenses, and those records need to hold up if the IRS asks.8Internal Revenue Service. Publication 969 – Health Savings Accounts and Other Tax-Favored Health Plans Generating good documentation at the point of sale makes their record-keeping easy and reduces disputes coming back to you.

Every HSA receipt should show:

  • The date of service.
  • A description of the service or product specific enough that a reviewer can tell it qualifies under Section 213(d). “Office visit for lower back pain evaluation” works. “Medical services” does not.
  • The patient’s name.
  • Your business name and professional credentials.
  • The total amount charged to the HSA card.

Publication 969 doesn’t set a specific retention period for HSA records, but the general statute of limitations for tax returns is three years from filing. Keeping your transaction records for at least that long is reasonable practice.

When an HSA Card Still Gets Declined

Even after correct setup, HSA cards decline for a handful of predictable reasons. The most common merchant-side cause is a wrong MCC; if a card consistently fails for multiple customers, check the code with your processor. Other causes are on the cardholder’s side: the account doesn’t have enough funds to cover the charge, the card was never activated, or the cardholder’s specific benefit plan imposes rules stricter than the IRS baseline.

A retailer without IIAS also runs into declines when non-medical items sit in the same transaction as medical ones. Ring up medical and non-medical items separately if your system can’t split them automatically.

When a card is declined, the cardholder needs to contact their HSA card issuer directly. Merchants generally can’t see the specific decline reason and can’t communicate with the issuer on the customer’s behalf. Offering to split payment between the HSA card and another method usually salvages the sale.