This Scenario Plays Out More Often Than You Think
Here is what an HSA audit looks like in practice. The person below is a hypothetical example. The details are illustrative. The math is real. The IRS rules are real. The penalties are real.
I am not a tax professional. I built a receipt tracker because the IRS rules around HSA documentation are poorly understood and almost nobody follows them correctly.
A Normal Tuesday in March
A woman opens her mailbox on a Tuesday. Between a credit card offer and a dental reminder is a letter from the IRS. The return address alone makes her stomach drop.
The letter is one page. Polite, even. It says the IRS is reviewing her tax return from two years ago. Specifically, her HSA distributions.
They want "substantiation" for $11,400. That is about $5,700 per year across two tax years. Normal family spending. Doctor visits, prescriptions, a couple of ER trips, dental work, contacts. Nothing weird.
She used her HSA debit card for all of it. She assumed the card was the paper trail. Most people assume the same thing.
What "Substantiation" Means
The IRS uses that word a lot. It means: prove it.
Prove each distribution went to a qualified medical expense. Not "I went to CVS." Prove what you bought at CVS. Not "I paid my doctor." Prove the visit fits the IRS definition of a qualified medical expense.
For each distribution, they want three things:
- ●The date of the expense
- ●The amount you paid
- ●A description of what it was for
Your HSA card statement gives them #1 and #2. It never gives them #3. That gap is the entire problem. Most people do not realize how big that gap is until it matters.
What She Has
She logs into her HSA provider's website and pulls her transaction history.
| Date | Vendor | Amount |
|---|---|---|
| 03/15/2024 | CVS Pharmacy | $47.63 |
| 04/02/2024 | Main Street Medical | $150.00 |
| 05/18/2024 | Walgreens | $23.41 |
| 06/30/2024 | Children's Hospital | $875.00 |
Dates. Vendors. Amounts. No description of services. The IRS already has this from the 1099-SA. They are not asking her to repeat it. They want the part that is missing.
If you pull up your own HSA statement right now, it probably looks identical. Same format. Same gap.
What She Does Not Have
No receipts. None. Two years of HSA card swipes and she assumed the card was the documentation. Nobody told her otherwise. Not her HSA provider. Not her employer during open enrollment. The card worked at CVS, so she figured it was tracked somewhere.
It was not tracked anywhere. Not by CVS. Not by her provider. Not by the IRS. The only place it could have been tracked was her phone, a folder, a shoebox. Anywhere she chose to put it.
She chose not to put it anywhere. Most people do not.
The Recovery Attempt
She spends three weekends trying to piece things together.
Her CVS account shows 18 months of purchase history. That gets her about $800 in pharmacy receipts. Her insurance portal has EOBs for most doctor visits, which covers another $4,200. Her dentist reprints two invoices totaling $1,600.
But about $4,800 has no paper trail. Small pharmacy purchases from more than 18 months ago. Copays at an urgent care that had closed. One ER visit where the hospital could only find the insurance side, not what she actually paid out of pocket.
Three weekends of clicking through old portals, calling billing departments, being on hold. All to prove she bought prescription medicine and not sunglasses.
The Math on What It Costs
The IRS gives her 30 days to respond. She sends everything she found. They accept the $6,600 she can document. They disallow the $4,800 she cannot.
| Item | Amount |
|---|---|
| Disallowed distributions | $4,800 |
| Reclassified as ordinary income (22% bracket) | $1,056 |
| 20% additional penalty (under 65) | $960 |
| Interest on underpayment | ~$180 |
| Total owed | ~$2,196 |
$2,196 for expenses she actually had. She was not cheating. She was buying copays and prescriptions. She just could not prove it.
Add a $600 CPA bill. Total damage: roughly $2,800.
That kind of number is why I take receipts seriously. Not the IRS rules in the abstract. The concrete cost of not having a phone photo of a pharmacy printout.
The Part That Stings
Every one of those $4,800 in expenses was probably legitimate. She was not gaming the system. But "probably legitimate" does not satisfy the IRS.
They do not assume your distributions were qualified. You have to show them. The burden of proof is on you. If you cannot show it, the distribution is treated as non-medical. Income tax plus penalty.
She paid for real medical care. The money went where it was supposed to go. But without a receipt, the IRS treats it like she bought a TV.
Why the Credit Card Statement Is Not Enough
People ask this a lot. "I have my credit card statement. Is that enough?"
No. A credit card statement shows the same thing as the HSA card statement. Date, vendor, amount. "CVS Pharmacy, $47.63" could be prescriptions or toothpaste. The statement cannot tell the difference.
The documents that actually prove a medical expense:
- ●An itemized receipt from the store or pharmacy
- ●An explanation of benefits from your insurance
- ●An itemized bill from your doctor, dentist, or hospital
- ●A prescription printout from your pharmacy
Your card statement is not on that list.
The 7-Year Window
The IRS can look back 7 years on HSA distributions. The standard audit window is 3 years, but HSA distributions have a longer tail. They can challenge whether a distribution was "qualified" separately from the rest of your return.
If you have been swiping for 5 years with no receipts, that is $15,000 in exposure at $3,000/year. At a 22% bracket plus the 20% penalty, the potential hit is $6,300. Before interest. Before the CPA.
The 10-Second Habit
Save every receipt. Takes 10 seconds. Phone photo, upload, done.
The delayed reimbursement approach builds this in naturally. Pay out of pocket, save the receipt, let your HSA stay invested. But even when you use the card for a bigger bill, still save the receipt. The card is the payment. The receipt is the proof.
The cost of saving a receipt is 10 seconds. The cost of not saving one, as this scenario shows, is $2,800.
What You Can Do Right Now
If you have been swiping without saving receipts, do not panic. Start today.
- ●Log into your pharmacy accounts. CVS, Walgreens, Amazon Pharmacy. Pull the last 12 to 24 months.
- ●Log into your health insurance portal. Download every EOB you can find.
- ●Search your email for "receipt," "copay," "payment confirmation," and your provider names.
- ●Call your doctor and dentist. Ask billing for a summary of charges from the last 2 years.
You will not recover everything. But partial records are better than nothing. Going forward, the fix is simple. Save the receipt. Every time. It takes 10 seconds and it protects you for 7 years.
Questions People Ask
How likely is an HSA audit?
Most people will never get one. But your HSA distributions show up in a broader tax audit if one happens for any reason. The IRS gets your 1099-SA and can cross-reference it any time within the window.
What if I accidentally used my HSA for something non-qualified?
You can return the money before your tax filing deadline. Miss the deadline and you owe income tax plus 20%. Report it on your return and pay what you owe.
Can I repay the money after an audit to avoid the penalty?
No. Once the IRS disallows it, the tax and penalty stick. That is why documentation matters from the start. There is no undo button.
Is there a dollar amount the IRS ignores?
No official minimum. They can audit any distribution regardless of size. Smaller accounts are lower priority, but there is no safe harbor.
This is educational content, not financial or tax advice. Consult a qualified professional before making decisions about your HSA.