First published: February 10, 2026 / Last updated: February 28, 2026

HSA audit risk and documentation guide

Most people do not think about an HSA audit until they are about to file taxes, get a letter from the IRS, or realize they paid for something questionable with their HSA card.

This guide is designed to do two things:

• Calm the panic: explain what the IRS actually looks for with HSA distributions (and what they do not).
• Give you a repeatable system: a simple framework for documentation, Letters of Medical Necessity (LMNs), and reimbursement habits that stand up to scrutiny.

---

The bottom line on HSA audit risk

Using an HSA is not about getting "approval" at checkout. It is about whether your HSA distributions were used to pay or reimburse qualified medical expenses under IRS rules.

If you take one idea from this page, let it be this:

Most HSA issues are not dramatic. They are simple documentation problems:

• Receipts that are not itemized (just a total)
• No clear link between a distribution and a specific qualified expense
• Wellness or dual-use purchases without medical documentation
• Double-dipping (reimbursed by insurance/employer and also reimbursed from the HSA)

Related guides:

• What is an HSA?
• What makes an expense HSA eligible?
• What is a Letter of Medical Necessity (LMN)?

---

The "administrator is not the IRS" distinction

HSA administrators and card systems are not making IRS eligibility determinations in real time. If your HSA card works at a merchant, that does not automatically mean the expense is qualified. Similarly, if your HSA card does not work, the expense could still be qualified (you may just need to pay out of pocket and reimburse yourself properly).

This matters most for gray-area expenses like wellness tech, fitness-related costs, and dual-use items.

---

What the IRS actually cares about with HSAs

In practice, HSA compliance comes down to whether you can substantiate three things if asked. Think of it as a three-part test.

The three-part test

1. Amount and date: A distribution occurred (how much, when).
2. Eligibility: The distribution was used exclusively to pay or reimburse qualified medical expenses for the account holder (and, in many cases, eligible family members).
3. No double-dipping: Those expenses were not reimbursed elsewhere (insurance, employer plan, HRA) and were not used to claim a separate tax benefit that would conflict with HSA treatment.

That is it. If your records prove these three parts, most audit-risk anxiety disappears.

---

How HSA distributions are reported (high-level)

You generally report HSA contributions and distributions on an IRS tax form dedicated to HSAs. The key concept is simple: qualified distributions are generally tax-free, and non-qualified distributions are generally taxable (and may be subject to an additional penalty depending on your age and circumstances).

For most taxpayers, the forms referenced are Form 8889 (reported with your tax return), supported by Form 1099-SA (distributions) and Form 5498-SA (contributions).

You typically do not submit your receipts with your tax return. But you should assume you may need to produce documentation later if the IRS asks how a distribution was used.

---

What can trigger IRS scrutiny (and how to reduce risk)

No one outside the IRS can tell you exactly what triggers scrutiny for a specific taxpayer, but you can identify situations that are harder to substantiate. The theme is always the same: ambiguity.

For examples of commonly misunderstood expenses, see:

• Common expenses that are not HSA eligible

---

The documentation you should keep (what "good proof" looks like)

Good documentation is not about volume. It is about clarity. Your goal is to preserve enough information that someone else could understand what you bought, when you bought it, and why it was qualified.

Minimum documentation for most expenses

For most qualified expenses, keep records that show:

• Merchant or provider name
• Date of purchase or date of service
• Description of the item/service (ideally itemized)
• Amount paid
• Proof of payment if the receipt does not show it

When an Explanation of Benefits (EOB) helps

If insurance is involved, an EOB can be the cleanest way to show:

• What was billed
• What insurance paid
• What you owed (your out-of-pocket amount)

This is especially useful when you reimburse yourself later and need to prove you did not double-dip.

When a Letter of Medical Necessity (LMN) matters most

LMNs matter most when an item could be either personal/wellness or medical, depending on the facts. These are often called "dual-use" or "gray-area" expenses.

Examples (depending on your circumstances):

• Fitness trackers and wellness tech
• Gym memberships or exercise programs
• Massage therapy or massage devices
• Supplements, nutrition products, or special foods
• Ergonomic or home-environment items (standing desks, air purifiers, etc.)

Related guide: What is a Letter of Medical Necessity (LMN)?

---

Audit risk spectrum (a simple way to prioritize documentation)

Not every expense carries the same practical risk. Use this spectrum to decide how much documentation to keep, and when an LMN is worth the effort.

---

Letter of Medical Necessity (LMN): how to do it right

An LMN is not magic. It is medical documentation that connects a specific product or service to the treatment, management, or monitoring of a diagnosed condition.

What a strong LMN should include

• Patient name (or another clear patient reference)
• Diagnosed medical condition or medical need
• What the item/service is for and how it treats, manages, or mitigates the condition
• Duration or timeframe (for ongoing needs)
• Provider signature, credentials, and date

What an LMN cannot do

• It cannot turn a personal expense into a qualified expense just because it promotes "general health."
• It is weakest when the item looks like a personal convenience purchase without a clear medical purpose.

The "but for" test (the line between medical and cosmetic/wellness)

If you are unsure whether something is likely to hold up as a qualified expense, ask:

If the honest answer is "I probably would have bought this anyway because it is cool, fun, or generally healthy," you should treat it as higher risk. If the answer is "No, I am buying this specifically because I am treating or managing a diagnosed condition," the case for eligibility is stronger (especially with an LMN and itemized proof).

Related: What makes an expense HSA eligible?

---

How long to keep HSA records (the statute of limitations question)

People often hear a simple rule: "Keep tax records for three years." The nuance with HSAs is that reimbursements can happen long after the original expense, which changes how long you should keep receipts.

A practical rule that works for most people

Keep your HSA records for at least three years after the year you claim the distribution on your tax return. That is the period most people are thinking of when they reference the IRS statute of limitations.

If you have large discrepancies, unusual situations, or delayed reimbursements, keeping records longer is a safer default.

The "shoebox risk" with delayed reimbursement

If you pay out of pocket this year but reimburse yourself from your HSA 10 years from now, you may need to keep that original receipt for a decade (or more) so you can substantiate the later distribution.

A simple durability-friendly storage system

You do not need fancy software. A basic folder structure like this works:

2026/
├── Receipts/
├── EOBs/
├── LMNs/
└── HSA-distributions-log.xlsx

---

Gray-area expenses: how to think about "medical" vs "general wellness"

The hardest HSA questions are not about obvious medical bills. They are about products that could be medical in one situation and personal in another.

The primary purpose test (common-sense version)

• If the primary purpose is general wellness, lifestyle, or convenience, it is typically not a qualified medical expense.
• If the primary purpose is to treat, manage, or monitor a diagnosed medical condition, the case for eligibility is typically stronger (often with documentation, and sometimes with an LMN).

Common dual-use categories (where people get burned)

• Fitness and wearables (smart rings, watches, recovery trackers)
• Massage devices and "recovery" tools
• Supplements and "performance" nutrition
• Ergonomic equipment and work-from-home setups
• Home environment products (air, light, sleep)

When you see these categories, think "documentation and context," not "checkout approval."

---

Reimbursing yourself: timing, matching, and systems that hold up

Many HSA owners pay out of pocket today and reimburse themselves later. That can be a smart strategy, but it increases the importance of organization.

Match distributions to expenses (do not rely on memory)

Best practice is to maintain a simple log that ties each distribution to one or more receipts. Your log can be a spreadsheet with columns like:

• Date of expense
• Provider/merchant
• Description
• Amount
• Date reimbursed
• Distribution amount
• Folder link or receipt filename

Paying out of pocket vs using your HSA card

• Using an HSA card does not guarantee eligibility.
• Paying out of pocket does not hurt eligibility.
• Documentation is what matters either way.

---

What happens if you are wrong (and what you can do about it)

If an HSA distribution is not for qualified medical expenses, it is generally treated as taxable income and may be subject to an additional penalty depending on your circumstances.

The good news is that most "problems" are avoidable with documentation. And in some cases, mistakes can be corrected.

Fixing a mistaken HSA distribution (the correction window)

If you discover you took an HSA distribution for something that turns out to be non-qualified, you may be able to correct it by returning the amount to your HSA as a "mistaken distribution," depending on your custodian's procedures.

• This concept is generally intended for situations where you reasonably believed the expense was qualified but later learned it was not.
• Timing matters. IRS rules and custodian procedures both matter, and the correction window is tied to a tax return due date concept.
• Your HSA custodian may have specific requirements (forms, coding, documentation) and may not support every type of correction, so contact them quickly.

If you lost receipts

If you are missing documentation, the cleanest path is to reconstruct what you can (provider invoices, pharmacy history, EOBs, order confirmations). Going forward, move to a scan-and-store system so you are not relying on paper.

---

FAQ: common audit-risk questions

Do I need to send receipts with my taxes for HSA expenses?

Not usually, but you should keep receipts and supporting documentation in case the IRS asks you to substantiate distributions later.

If my HSA card works at checkout, is it automatically eligible?

No, card approval is not the same as IRS eligibility. Eligibility depends on the nature of the expense and your documentation.

How long should I keep HSA receipts?

A practical rule is at least three years after the year you report the distribution. If you reimburse yourself years later, you should keep receipts long enough to substantiate that later distribution.

Do I always need an LMN for dual-use or wellness items?

Not always, but LMNs are most useful for gray-area expenses where the medical purpose is not obvious. If you are relying on medical necessity to make a borderline expense eligible, an LMN and detailed documentation can significantly reduce risk.

Can I reimburse myself years later?

Many people do. The key is record durability and organization: you should be able to prove the expense was qualified and match it to the later distribution.

---

What to do next

If you want to reduce audit risk going forward, take these three practical steps:

• Set up a simple HSA folder system today. Create yearly folders for receipts, EOBs, LMNs, and a basic reimbursement log. Future-you will thank you.
• For gray-area purchases, pause and document first. If an item looks like wellness, fitness, or lifestyle, review what makes an expense HSA eligible and obtain a Letter of Medical Necessity before reimbursing yourself.
• Review your largest distributions each year. Make sure every significant HSA withdrawal has matching documentation and was not reimbursed elsewhere.

HSAs are powerful tax tools. With a simple documentation system and thoughtful reimbursement habits, you can use yours confidently without unnecessary audit anxiety.

---

Sources

• Publication 969 - IRS
• Publication 502 - IRS
• Notice 2004-50 - IRS
• Instructions for Forms 1099-SA and 5498-SA - IRS
• Treasury, IRS provide guidance on new tax benefits for health savings account participants - IRS
• Internal Revenue Code § 213(d) - Cornell Law School

Disclaimer

This page is for educational purposes only and is not tax or legal advice. Check with your HSA administrator or a qualified tax or legal professional if you have questions about your specific situation.