HSA Audit: Triggers, Records, and IRS Penalties

An HSA audit is almost always a correspondence review the IRS opens after its automated system spots a mismatch between your tax return and what your employer or HSA custodian reported independently. The reviewer is checking three things: whether you were eligible to contribute, whether your contributions stayed within the annual limit, and whether every distribution went to a qualified medical expense. Everything you need to resolve the notice comes down to producing documents that answer those three questions.

What Triggers the Review

The IRS doesn’t pull HSA accounts at random. Automated matching compares the figures on your return against your W-2 (Box 12, code W), your custodian’s Form 5498-SA for contributions, and Form 1099-SA for distributions.¹² When the numbers disagree, the return gets flagged.

The single most common trigger is a problem on Form 8889, which reports your contributions, calculates your deduction, and reports distributions.³ Skip the form or fill it out wrong, and the IRS sees a 1099-SA distribution with no explanation. Its system assumes the entire amount is taxable income and generates a CP2000 notice.

Other patterns that routinely draw a notice:

Contribution totals on your return that don’t match the W-2 and 5498-SA figures.
Contributions that exceed the annual limit, which the IRS can compute directly from the combined employer and employee totals.
Distributions reported on 1099-SA with no corresponding qualified-expense accounting on Form 8889.
Pre-65 distributions, which draw extra scrutiny because non-medical withdrawals before age 65 carry a steep additional tax.⁴

Eligibility the IRS Verifies

Before touching contribution math, the IRS confirms you were eligible to have an HSA in the first place. For each month you contributed, you had to meet every one of these conditions:

Covered under a qualifying High Deductible Health Plan (HDHP).
No other general-purpose health coverage, including a standard Flexible Spending Account. A limited-purpose FSA covering only dental and vision is the one major exception.
Not enrolled in Medicare.
Not claimable as a dependent on someone else’s return, even if that person doesn’t actually claim you.⁴

Mid-year changes are where eligibility quietly breaks. Switching jobs, enrolling in Medicare at 65, or picking up a spouse’s non-HDHP plan all end your eligibility. Contributions after that date become excess contributions, and the IRS will eventually see them.

2026 HDHP and Contribution Limits

For 2026, a plan qualifies as an HDHP only if it meets the minimum deductible and stays within the out-of-pocket ceiling:

Self-only: minimum deductible $1,700; out-of-pocket maximum $8,500.
Family: minimum deductible $3,400; out-of-pocket maximum $17,000.

Annual contribution limits for 2026:

Self-only coverage: $4,400.
Family coverage: $8,750.
Catch-up contribution at age 55 or older: additional $1,000.⁵

These limits include both your contributions and your employer’s. Employer contributions are not extra room on top of the cap; they count against the same number. That single misunderstanding generates a large share of excess-contribution notices.

The Last-Month Rule Trap

If you became HDHP-eligible on December 1, the last-month rule lets you contribute the full annual amount as if you’d been eligible all year. The catch is a 13-month testing period running from that December through December 31 of the following year. Lose eligibility inside that window, say by taking a new job with a non-HDHP plan, and the contributions that exceeded your actual months of eligibility get added back to gross income, plus an additional 10% tax. Death and disability are the only exceptions.⁶ If you used the rule and later changed health plans, expect the IRS math to catch up with you.

What Counts as a Qualified Distribution

HSA distributions stay tax-free only when spent on qualified medical expenses as defined in Section 213(d) of the Internal Revenue Code.⁷ That covers diagnosis, treatment, and prevention of disease, prescription medications, dental and vision care, and since 2020 all over-the-counter medications and menstrual care products without a prescription.⁸ Gym memberships, cosmetic procedures, and general wellness products that don’t treat a specific medical condition do not qualify.

The custodian only reports the total that came out. It doesn’t tell the IRS what you spent on. The entire burden of proving each dollar went to a qualifying expense sits with you.

Records That Decide the Outcome

Audits are won on paperwork. Vague records give you no leverage.

Proof of Eligibility

Keep documentation of your HDHP enrollment for every month you contributed. Plan enrollment summaries, insurance cards showing the deductible, and benefits confirmation letters all work. The IRS wants to see that the plan met the HDHP thresholds for that year.

Proof Each Distribution Was Qualified

You need itemized receipts for every HSA withdrawal, showing:

The date of the service or purchase.
The nature of the service or product.
Who received the care.
The exact amount you paid out of pocket.

Credit card statements and Explanation of Benefits forms are useful backup, but they aren’t enough on their own. A statement showing you paid a medical office $200 doesn’t show what the payment was for. The IRS wants the itemized receipt or invoice that ties the dollars to a specific qualifying expense.

Tax Forms

Hold on to every Form 8889 you’ve filed, along with each year’s Form 5498-SA and Form 1099-SA. The IRS cross-references these across multiple years, and gaps create problems even for years not directly under review.

How Long to Keep Everything

The IRS can generally assess additional tax within three years after the return was due or filed, whichever is later. The window stretches to six years if you underreported gross income by more than 25%, and there’s no time limit at all for fraudulent returns or returns never filed.⁹¹⁰

For HSAs the practical window is longer, because you can reimburse yourself years after incurring the expense with no deadline. Keep medical receipts for as long as you hold the account, and for at least three years after you close it or spend the last dollar. If a 2026 audit questions a distribution you took to reimburse a 2022 bill, you’ll need the 2022 receipt.

Responding to the Notice

HSA audits are almost always handled by mail. The notice itself is usually a CP2000, which identifies the tax year and the specific discrepancy. A CP2000 is technically a proposed adjustment rather than a formal audit, but you respond the same way: gather evidence and show the IRS’s proposed change is wrong.¹¹

You have 30 days to respond (60 days if you live outside the United States). Miss that deadline and the IRS sends a Statutory Notice of Deficiency and assesses the proposed tax automatically.¹² At that point you’ve lost the chance to present evidence before the bill becomes official.

A complete response package includes:

A cover letter referencing the notice number and tax year.
A completed or corrected Form 8889 if the original was missing or wrong.
Proof of HDHP enrollment for the months in question.
Itemized receipts tying each disputed distribution to a qualified medical expense.

Send copies, never originals. You can submit through the Document Upload Tool listed on the notice, by fax, or by mail. If you mail it, use a method that gives you proof of delivery.¹³ After review, the IRS issues either a no-change letter or a proposed-changes letter with an adjusted tax amount. You can request a review by the IRS Office of Appeals if you disagree.

Penalties If You Can’t Prove Your Case

The dollar consequences add up quickly.

Non-qualified distributions. Anything you can’t document gets added to gross income for the year of the withdrawal. If you’re under 65 and not disabled, you also owe a 20% additional tax on top of the regular income tax.⁶ A $5,000 distribution reclassified as non-qualified costs income tax at your marginal rate plus a flat $1,000 penalty, before interest. After 65 the 20% penalty disappears, but income tax on non-medical withdrawals remains.

Excess contributions. Amounts over the annual limit carry a 6% excise tax, reported on Form 5329, for each year the excess stays in the account.¹⁴¹⁵ The tax recurs annually until you clean it up.

Last-month rule failures. Excess contributions created by failing the testing period are included in gross income and hit with a 10% additional tax.⁶

Interest runs on any underpayment from the original due date of the return.

Fixing a Mistake Before the IRS Finds It

Pulling Out Excess Contributions

If you contributed too much, withdraw the excess plus any earnings on it before your return’s due date, including extensions. You don’t claim a deduction for the withdrawn amount, and you include the earnings in income for the year of withdrawal. This avoids the 6% excise tax entirely.¹⁶

If you’ve already filed without catching the excess, you get a second window: withdraw the excess within six months after the original due date (not counting extensions), file an amended return, and write “Filed pursuant to section 301.9100-2” at the top.

Returning a Mistaken Distribution

Under limited circumstances the IRS lets you repay a mistaken distribution. If you accidentally used HSA funds for a non-qualified expense and have clear evidence of a reasonable-cause mistake, you can put the money back and avoid both income tax and the 20% penalty. The Form 8889 instructions describe these as “very limited and unusual circumstances” and point to Notice 2004-50 (Q&A 37 and 76) for the rules. If you’re relying on this provision, a tax professional is worth the fee; the IRS does not grant these corrections generously.

One Worst-Case Boundary: Prohibited Transactions

Most HSA audit issues involve the contribution and distribution questions above. Prohibited transactions under Internal Revenue Code Section 4975 are a different category, and the consequences are far worse. If your HSA engages in one, say by extending credit to you through an overdraft the custodian covers, the account loses its tax-exempt status entirely. It ceases to be an HSA as of January 1 of the year the prohibited transaction occurred, and the full fair market value of the account is treated as a taxable distribution.⁶ If you’re under 65, the 20% additional tax applies to the entire balance, not just one withdrawal. These situations are rare, but if your account had an overdraft or an unusual custodian transaction, address it before the IRS does.

1
Internal Revenue Service. Form 5498-SA – HSA, Archer MSA, or Medicare Advantage MSA Information
2
Internal Revenue Service. Form 1099-SA – Distributions From an HSA, Archer MSA, or Medicare Advantage MSA
3
Internal Revenue Service. Instructions for Form 8889
4
Internal Revenue Service. Publication 969 – Health Savings Accounts and Other Tax-Favored Health Plans
5
Internal Revenue Service. Rev. Proc. 2025-19 – 2026 Inflation Adjusted Amounts for Health Savings Accounts
6
Office of the Law Revision Counsel. 26 USC 223 – Health Savings Accounts
7
Office of the Law Revision Counsel. 26 U.S. Code 213 – Medical, Dental, Etc., Expenses
8
Internal Revenue Service. IRS Outlines Changes to Health Care Spending Available Under CARES Act
9
Internal Revenue Service. Topic No. 305, Recordkeeping
10
Internal Revenue Service. Time IRS Can Assess Tax
11
Internal Revenue Service. Topic No. 652, Notice of Underreported Income – CP2000
12
Internal Revenue Service. Understanding Your CP2000 Series Notice
13
Taxpayer Advocate Service. Audits by Mail
14
Office of the Law Revision Counsel. 26 USC 4973 – Tax on Excess Contributions to Certain Tax-Favored Accounts
15
Internal Revenue Service. About Form 5329
16
Internal Revenue Service. Instructions for Form 8889