Does the IRS Audit HSA Withdrawals? Triggers, Proof, Penalties

The IRS does not audit every HSA withdrawal, but it has an automated system that can flag them. Your HSA custodian reports every dollar you take out on Form 1099-SA, and you self-report on Form 8889 how much of that went to qualified medical expenses. When those two numbers don’t line up, the return gets flagged. Even when they do line up, a large tax-free distribution can prompt the IRS to ask for receipts proving each expense was medical. The burden of proof is entirely yours.

How the IRS Sees Your Withdrawals in the First Place

Two documents create the paper trail. Your HSA custodian files Form 1099-SA with the IRS and sends you a copy. Box 1 shows the total gross amount distributed from your account, and Box 3 contains a code identifying the type of withdrawal.¹ The custodian has no idea whether the money paid for surgery or a vacation. They just report the total.

You then file Form 8889 with your return. Line 14a captures the total distribution from the 1099-SA. Line 15 is where you report the amount spent on qualified medical expenses.² The difference determines what gets taxed. If Line 14a equals Line 15, nothing is owed. If distributions exceed qualified expenses, the gap becomes taxable income with an additional 20% tax on top.

The IRS receives both documents independently. The 1099-SA tells the agency what left your account. Form 8889 tells them what you claim it was used for. That two-source comparison is the main audit mechanism for HSA withdrawals, and it runs automatically on every return.

What Actually Triggers a Closer Look

The most reliable trigger is a mismatch between the two forms. If your 1099-SA shows $15,000 in distributions and your Form 8889 claims only $5,000 in qualified expenses, the IRS sees $10,000 in taxable income and a $2,000 penalty already. That gap generates a notice with almost no discretion involved.

Failing to file Form 8889 at all is faster still. When a 1099-SA arrives at the IRS with no corresponding Form 8889 on your return, the system treats the entire distribution as taxable and sends a bill.

A large distribution claimed as entirely tax-free is a subtler flag. The IRS uses automated screening that looks for improbable data points across the return as a whole. Claiming $25,000 in tax-free medical spending against an income and filing history that doesn’t suggest that level of care is the kind of pattern the algorithm catches. Certain categories of expense also attract closer attention because they’re exceptions to a general rule. Long-term care insurance premiums, Medicare premiums paid from an HSA, and COBRA coverage costs all require detailed substantiation, since the default rule is that insurance premiums don’t qualify at all.

What You Have to Prove If They Ask

The substantive question in any HSA review is whether the money went to a qualified medical expense. Federal law defines that by reference to the broad definition of “medical care” in the tax code: amounts paid for the diagnosis, cure, treatment, or prevention of disease, or for treatment affecting any structure or function of the body.³ IRS Publication 502 lists what falls inside and outside that definition.⁴

The expense must be for you, your spouse, or a dependent, and it must have been incurred after your HSA was established. Deductibles, copayments, prescription drugs, dental work, vision care, medical equipment like crutches or blood-sugar monitors, and menstrual care products all qualify. Vitamins, supplements, and gym memberships do not, unless a physician diagnoses a specific condition and prescribes them as treatment. Cosmetic procedures do not qualify unless they address a deformity from a congenital condition, injury, or disease.

Insurance premiums are the area most likely to be challenged. The default rule is that you cannot use HSA funds to pay premiums.⁵ Four exceptions exist:

COBRA continuation coverage premiums.
Qualified long-term care insurance premiums, subject to annual age-based limits.
Health insurance premiums while you are collecting unemployment benefits under federal or state law.
Medicare Parts A, B, and D premiums and most other health coverage premiums once you have reached 65. Medicare supplemental (Medigap) policies are the exclusion within this exception and do not qualify.

The unemployment exception is the one most often missed. The COBRA and long-term care exceptions can also cover a spouse or dependent who meets the eligibility requirements for that coverage.

Documentation That Survives an IRS Challenge

A bank statement or credit card receipt showing that money changed hands is not enough by itself. Those records prove you paid something, not what it was for. You have to prove the expense was medical in nature and that you were the one responsible for paying it.

The strongest documentation combines two things: the provider’s itemized invoice describing the service and the amount charged, and the Explanation of Benefits from your insurance company showing what was covered, what applied to your deductible, and what remained your responsibility. Together, these establish both the medical nature of the expense and that you actually owed the amount you paid from the HSA.

Publication 969 requires records showing three things: distributions went exclusively toward qualified medical expenses, those expenses were not reimbursed from another source, and you did not also claim them as an itemized deduction in any year.⁵

Keep those records indefinitely. The general IRS audit window is three years from the date a return is filed, but that clock runs from the return where the distribution appears, not from when the medical expense occurred. Because there is no deadline for reimbursing yourself for a past qualified expense, a distribution in 2035 might rely on a 2026 receipt. If you have thrown the 2026 paperwork away by then, you cannot substantiate the withdrawal.

What It Costs If You Cannot Substantiate

Any distribution the IRS treats as non-qualified triggers two separate costs. The amount is added to your gross income and taxed at your ordinary income rate.³ On top of that, you owe an additional 20% tax.²

On a $1,000 non-qualified withdrawal, that means $1,000 added to taxable income plus a $200 penalty. In the 22% bracket, the combined hit is $420 on $1,000. The 20% penalty is calculated on Line 17b of Form 8889 and flows through to Schedule 2 of Form 1040.⁶

Three situations eliminate the 20% additional tax, though ordinary income tax still applies. Once you reach age 65, non-qualified withdrawals are taxed as ordinary income with no penalty.³ Disability, as defined under the tax code, also waives the penalty. So does death: distributions from a deceased account holder’s HSA are not subject to the additional tax.

One boundary worth flagging, because it sits next to the withdrawal rules but works very differently: using your HSA as collateral for a loan, selling property to the account, or borrowing from it are prohibited transactions.⁷ If one occurs, the account stops being an HSA as of January 1 of that year, and the entire fair market value is treated as distributed to you on that date.³ The whole balance becomes taxable income, potentially with the 20% tax on top.

Undoing a Withdrawal Before It Becomes a Problem

If you took a distribution believing an expense was qualified and later realized it wasn’t, you can return the money to the HSA and undo the tax consequences. The IRS calls this a mistaken distribution. The deadline for returning it is the due date of your return, not counting extensions, for the first year you knew or should have known the distribution was a mistake.¹ For most people that means April 15 of the following year.

When the funds are returned properly, the distribution is not included in gross income, the 20% additional tax does not apply, and the repayment is not treated as an excess contribution. The requirement is that the original withdrawal resulted from a reasonable, good-faith mistake. This is not a way to retroactively recharacterize a deliberate non-medical withdrawal.

The Long-Tail Audit Risk From Delayed Reimbursement

There is no deadline for reimbursing yourself from an HSA for a qualified medical expense, so long as the expense was incurred after the account was established.⁵ A bill paid out of pocket in 2026 can be reimbursed from the HSA a decade later, still tax-free, because the underlying expense was qualified.

The audit exposure that comes with this is documentation. If the IRS questions a 2036 distribution and you claim it reimburses a 2026 dental bill, you need the 2026 provider invoice, the EOB, and proof you never deducted or reimbursed that expense from another source. Losing the paperwork turns what was a tax-free withdrawal into taxable income plus the 20% penalty. The longer the gap between the expense and the reimbursement, the more the audit risk depends on records you may have stopped thinking about years earlier.

1
Internal Revenue Service. Instructions for Forms 1099-SA and 5498-SA
2
Internal Revenue Service. Instructions for Form 8889
3
Office of the Law Revision Counsel. 26 U.S. Code 223 – Health Savings Accounts
4
Internal Revenue Service. Publication 502 – Medical and Dental Expenses
5
Internal Revenue Service. Publication 969 – Health Savings Accounts and Other Tax-Favored Health Plans
6
Internal Revenue Service. Form 8889 – Health Savings Accounts
7
Office of the Law Revision Counsel. 26 U.S. Code 4975 – Tax on Prohibited Transactions