HSA Audit: Triggers, Records, and Penalties

An HSA audit is the IRS’s review of whether your Health Savings Account activity actually qualified for the tax breaks you claimed. The review almost always arrives by mail after an automated system spots a mismatch between your return and what your employer or HSA custodian reported, and it focuses on three questions: were you eligible to contribute, did you stay within the limits, and did every distribution go to a qualified medical expense. Getting through it cleanly comes down to the records you kept before the notice ever arrived.

Why the IRS Flagged Your Return

The IRS doesn’t pick HSA accounts at random. Automated matching compares your Form 8889 against the numbers your employer put in Box 12 (code W) of your W-2 and the amounts your custodian reported on Form 5498-SA and Form 1099-SA.¹ When those numbers disagree, your return gets flagged.

The single most common trigger is a Form 8889 problem.² Skip the form or fill it out wrong, and the IRS sees a distribution on Form 1099-SA with no explanation attached. Its default assumption is that the entire distribution is taxable income.³

Other frequent triggers:

Contribution totals on Form 8889 that don’t match what your W-2 and Form 5498-SA report.
Contributions that exceed the annual limit, which the IRS can calculate from the same forms.
Distributions with no documentation showing they were medical.
Pre-65 distributions, which get closer attention because non-medical withdrawals before 65 carry an additional penalty.⁴

The Eligibility Check

Before it looks at any dollar figures, the IRS confirms you were allowed to have an HSA in the first place. For every month you contributed, you had to meet all of these conditions:

Coverage under a qualifying High Deductible Health Plan (HDHP).
No other general-purpose health coverage, including a standard Flexible Spending Account. A limited-purpose FSA covering only dental and vision is the one major exception.
Not enrolled in Medicare.
Not claimable as a dependent on someone else’s return, whether or not that person actually claims you.

Lose any one of these mid-year and contributions must stop that month.⁴ Switching jobs, aging into Medicare at 65, or joining a spouse’s non-HDHP plan all end eligibility. Contributions made after that date are excess contributions the IRS will eventually flag.

Contribution Limits and the Last-Month Rule

The 2026 annual limits are $4,400 for self-only HDHP coverage and $8,750 for family coverage, plus a $1,000 catch-up if you’re 55 or older.⁵ Those limits include employer contributions. That’s the detail people miss most often. Employer money isn’t additional room; it counts against the same cap you do.

Your health plan also has to actually qualify as an HDHP. For 2026, that means a minimum annual deductible of $1,700 (self-only) or $3,400 (family), and out-of-pocket maximums of $8,500 and $17,000 respectively. A plan outside those boundaries isn’t an HDHP, which means your contributions weren’t valid to begin with.

The Last-Month Rule Trap

If you became HDHP-eligible on December 1, the last-month rule lets you contribute the full annual amount as if you had been eligible all twelve months. The catch is a testing period that runs from that December through December 31 of the following year — 13 months of continuous eligibility. Lose eligibility inside that window and the contributions that exceeded your actual months of eligibility get added back to gross income, with an additional 10% tax on top.⁶ Death and disability are the only exceptions.

This trap is invisible until it isn’t. If you used the last-month rule and later changed health plans, expect the IRS to notice.

What Counts as a Qualified Distribution

HSA distributions stay tax-free only when spent on qualified medical expenses. The definition comes from Section 213(d) of the Internal Revenue Code and covers diagnosis, treatment, and prevention of disease, prescription medications, dental and vision care, and, since the CARES Act, all over-the-counter medications and menstrual care products without a prescription.⁷⁸

Here’s the key point. The IRS doesn’t know what you spent HSA money on. Your custodian reports the total distribution on Form 1099-SA, and proving each dollar went somewhere qualifying is entirely on you. Gym memberships, cosmetic procedures, and general wellness products that aren’t treating a specific condition don’t qualify.

The Records That Actually Work

An HSA audit comes down to paperwork. Vague records give you almost no leverage.

Eligibility Records

Keep proof of HDHP enrollment for every month you contributed: plan enrollment summaries, insurance cards showing your deductible, benefits confirmation letters. The IRS wants to see your plan met the HDHP thresholds for the year in question.

Distribution Records

This is where most people fall short. You need an itemized receipt for every HSA withdrawal showing:

Date of the service or purchase
Nature of the service or product
Who received the care
Amount you paid out of pocket

Credit card statements and Explanation of Benefits forms are useful supporting evidence, but they aren’t enough on their own. A card statement showing $200 to a medical office doesn’t tell the IRS what was paid for. The itemized receipt or invoice does.

Tax Forms

Keep copies of every Form 8889 you’ve filed, along with each year’s Form 5498-SA and Form 1099-SA from your custodian. The IRS cross-references across years, so gaps create problems even for tax years that aren’t directly under review.

How Long to Keep HSA Records

The IRS can assess additional tax within three years after your return was due or filed, whichever is later. That window extends to six years if you underreported gross income by more than 25%, and there’s no time limit at all for fraudulent returns or unfiled ones.⁹¹⁰

HSAs need a longer horizon than most tax records. Because you can reimburse yourself from your HSA for a qualified expense incurred years earlier (there’s no deadline), you should keep medical receipts for as long as you hold the account, plus at least three years after you close it or spend the last dollar. If a 2026 distribution reimbursed a 2022 medical bill, you’ll need the 2022 receipt in an audit.

Responding to the Notice

Almost all HSA audits are correspondence audits. You’ll receive a notice — most often a CP2000 — identifying the tax year and the specific discrepancy. The CP2000 is technically a proposed adjustment rather than a formal audit, but the response is the same: gather evidence and prove the IRS’s proposed change is wrong.¹¹

You have 30 days to respond (60 if you live outside the United States). Miss that deadline and the IRS sends a Statutory Notice of Deficiency and assesses the tax automatically.¹² At that point you’ve lost your chance to submit evidence before the bill becomes final.

A response should include:

A cover letter referencing the notice number and tax year
A completed or corrected Form 8889 if the original was missing or wrong
Proof of HDHP enrollment for the months in question
Itemized receipts matching each disputed distribution to a qualified medical expense

Send copies, never originals. The IRS accepts responses through the Document Upload Tool listed on the notice, by fax, or by mail with proof of delivery.¹³

The IRS will then issue either a “no change” letter or a “proposed changes” letter with an adjusted tax amount. If you disagree, you can request a review by the IRS Office of Appeals with a formal protest letter.

What Non-Compliance Costs

The financial consequences stack up fast.

Non-qualified distributions. Any distribution you can’t tie to a qualified medical expense gets added to your gross income, and if you’re under 65 and not disabled, there’s an additional 20% penalty.⁶ A $5,000 distribution reclassified as non-qualified costs you income tax at your marginal rate plus a flat $1,000 penalty, before interest. After 65 the 20% penalty disappears, but income tax on non-medical distributions still applies.

Excess contributions. Contributions above the annual limit trigger a 6% excise tax for each year the excess stays in the account.¹⁴ It’s not a one-time hit; it recurs annually until you fix the problem. You report it on Form 5329.¹⁵

Last-month rule failures. Excess contributions from a failed testing period get included in gross income plus a 10% additional tax.

Interest runs on any underpayment from the original due date of the return.

Fixing Mistakes Before They Compound

Withdrawing Excess Contributions

Contributed too much? The fastest fix is withdrawing the excess (plus any earnings on it) before your return’s due date, including extensions. You don’t claim a deduction for the withdrawn amount, and you include the earnings in income for the year of withdrawal. That avoids the 6% excise tax entirely.¹⁶

If you already filed without catching it, you get a second chance: withdraw the excess within six months of the original due date (not counting extensions), file an amended return, and write “Filed pursuant to section 301.9100-2” at the top.

Repaying Mistaken Distributions

The IRS allows repayment of a mistaken distribution under narrow circumstances. If you accidentally used HSA funds for a non-qualified expense and have clear evidence the mistake was made for reasonable cause, you can return the money to the HSA to avoid both the income tax and the 20% penalty. The Form 8889 instructions call these “very limited and unusual circumstances,” and point to Notice 2004-50 (Q&A 37 and 76) for the specific rules. Working with a tax professional is worth the cost here; the IRS doesn’t grant these corrections generously.

Two Situations That Aren’t Typical Audits but Generate the Same Notices

Prohibited transactions. If your HSA engages in a prohibited transaction under Section 4975 — for instance, an overdraft the custodian covers, which counts as an extension of credit — the account loses its tax-exempt status entirely. It stops being an HSA as of January 1 of the year the transaction occurred, and the full fair market value is treated as a taxable distribution. Under 65, the 20% additional tax applies to the whole balance, not just one withdrawal. Rare, but the worst-case scenario. Address any unusual custodian transaction immediately rather than waiting for the IRS to find it.

Inherited HSAs. When a non-spouse inherits an HSA, the account stops being an HSA on the date of death and the full value must be included in the beneficiary’s gross income for that year. The beneficiary can reduce the taxable amount by paying the deceased owner’s outstanding medical bills within 12 months of death. Unreported inherited HSA income triggers the same automated matching that catches every other HSA discrepancy.

1
Internal Revenue Service. Form 5498-SA – HSA, Archer MSA, or Medicare Advantage MSA Information
2
Internal Revenue Service. Instructions for Form 8889
3
Internal Revenue Service. Form 1099-SA – Distributions From an HSA, Archer MSA, or Medicare Advantage MSA
4
Internal Revenue Service. Publication 969 – Health Savings Accounts and Other Tax-Favored Health Plans
5
Internal Revenue Service. Rev. Proc. 2025-19 – 2026 Inflation Adjusted Amounts for Health Savings Accounts
6
Office of the Law Revision Counsel. 26 USC 223 – Health Savings Accounts
7
Internal Revenue Service. IRS Outlines Changes to Health Care Spending Available Under CARES Act
8
Office of the Law Revision Counsel. 26 U.S. Code 213 – Medical, Dental, Etc., Expenses
9
Internal Revenue Service. Topic No. 305, Recordkeeping
10
Internal Revenue Service. Time IRS Can Assess Tax
11
Internal Revenue Service. Topic No. 652, Notice of Underreported Income – CP2000
12
Internal Revenue Service. Understanding Your CP2000 Series Notice
13
Taxpayer Advocate Service. Audits by Mail
14
Office of the Law Revision Counsel. 26 USC 4973 – Tax on Excess Contributions to Certain Tax-Favored Accounts
15
Internal Revenue Service. About Form 5329
16
Internal Revenue Service. Instructions for Form 8889