What a CRA Audit of an HSA Looks Like for a Small Business

A CRA audit of a small business Health Spending Account follows the same basic sequence every time: records request, plan structure review, claim-by-claim testing, then a determination on how the owner's own benefits should be treated. The whole exercise turns on one legal question: does the plan actually qualify as a Private Health Services Plan under the Income Tax Act? If it does, reimbursements stay tax-free. If it doesn't, every dollar paid out can become taxable income, retroactively, across every open tax year. That single classification decision is what the entire audit is built around, and knowing what auditors check at each stage is the difference between a quiet file closure and a reassessment that reaches back years.

The statutory hooks are narrow but load-bearing. Section 248(1) of the Income Tax Act defines what a PHSP actually is. Section 118.2 sets out which medical expenses qualify. Section 6(1)(a)(i) is what excludes PHSP benefits from an employee's income in the first place, and section 15(1) is the shareholder-benefit rule that auditors reach for when they suspect an owner is using the plan as a personal expense account rather than an employee benefit. CRA's interpretation bulletin IT-339R2, published in 1989, sets out the foundational guidance on what shape a qualifying arrangement needs to take. Buried in that guidance is a ratio that decides everything: a plan only counts as a PHSP if 90% or more of the premiums paid under it go toward expenses that qualify for the medical expense tax credit. Fall under that line, and the plan's status as a PHSP is in jeopardy.

Which businesses and ownership structures face the most scrutiny before an audit even begins

Any incorporated business can run an HSA, from a one-person professional corporation to a company with two dozen staff. What changes is how hard the compliance bar is to clear, and that depends almost entirely on ownership structure.

Sole proprietors and unincorporated owners without arm's-length employees generally can't use an HSA at all. The Medical Expense Tax Credit is their route, and CRA treats that as the correct one.

The harder cases involve shareholder-employees, and CRA has been direct about its position here. Technical Interpretation 2014-0521301E5 says a plan built around a sole employee-shareholder likely won't qualify as a PHSP, because it's missing the element of insurance. A more recent one, 2022-0928901C6, reinforces the same point: a self-insured HSA covering a sole employee-shareholder and their family probably isn't a plan in the nature of insurance at all. The presumption runs against the owner from the start. CRA assumes benefits paid to a sole employee-shareholder come to them as a shareholder, meaning taxable, unless the facts say otherwise.

That presumption can be rebutted, but only if the owner can show their benefits look comparable, in kind and in size, to what a non-shareholder employee in a similar role at a similarly sized business would get. Absent that comparison, businesses with fewer than two arm's-length employees are capped: $1,500 per adult and $750 per child, per benefit year, for the owner and related family members. Bring on two or more unrelated employees and offer the plan fairly across the team, and that cap disappears.

This is why an auditor's very first move is often to map out who owns what and who's actually on payroll. The ownership and employment structure decides which rulebook applies before a single receipt gets looked at.

What triggers CRA to look at a small business HSA in the first place

CRA leans heavily on data analytics and cross-file comparisons now, so an HSA anomaly can surface through an automated screen well before any human reviewer opens the file.

A handful of patterns show up again and again in flagged files. Ineligible expenses are the most common: gym memberships, vitamins, over-the-counter supplements with no prescription behind them. CRA has disallowed vitamin and supplement claims on exactly this basis. Missing documentation is close behind; there's a documented case of a massage therapy claim getting flagged simply because no medical note supported it, even though massage therapy itself is an eligible expense category.

Beyond individual claims, auditors watch for structural warning signs:

• Claims that don't correlate with the business's revenue or the employee's salary

• No third-party administrator adjudicating claims independently

• No written plan document defining what the arrangement actually is

• Wellness expenses like gym memberships processed through the HSA instead of a separate, properly taxed Wellness Spending Account

• Unlimited or unusually generous benefit ceilings, which start to look more like compensation than insurance

• Cash withdrawals or RRSP transfers from the plan, which disqualify it entirely and make prior reimbursements taxable after the fact

No single item on that list guarantees an audit. But stack three or four together, say no administrator, no plan document, and a run of ineligible claims, and the risk climbs fast.

How an audit starts: the initial CRA contact and what records are requested first

The notice comes by mail, sometimes followed by a call, and it names the tax periods under review along with instructions for submitting documents. The first ask is usually broad: ledgers, journals, invoices, receipts, contracts, bank statements. Personal financial records belonging to the owner can get pulled in too, including personal bank statements, mortgage documents, and credit card statements, along with records tied to related individuals or entities connected to the owner.

For an HSA specifically, expect the request to include the written plan document, the administration agreement with any third-party provider, employment contracts for participating employees (especially shareholder-employees), full claims records with receipts and prescriptions, reimbursement records tied to bank statements, and corporate T4s showing that participating shareholder-employees actually draw employment income rather than dividends alone.

CRA may reach out to the business's accountant or bookkeeper directly for clarification. That's routine, not an escalation. Businesses that keep organized, current records can respond to this stage without much disruption. Businesses that don't tend to scramble, and the scramble itself often introduces new problems.

How auditors evaluate the plan's structure before reviewing a single claim

Before an auditor looks at a single reimbursement, they're checking whether the plan qualifies as a PHSP in the first place. Fail that test, and every claim under the plan gets swept up regardless of how legitimate any individual expense was.

The questions are consistent. Is there a written plan document laying out eligibility, benefit categories, annual limits, and the plan period? Is there real risk in the arrangement, meaning employees might or might not incur eligible expenses in a given year, with unused balances forfeited rather than cashed out? Does the plan run at arm's length from the employer, or is the owner deciding individual claims themselves? Is it offered consistently across eligible staff, or does it exist mainly for the owner and family?

The insurance-element test is where a lot of owner-only plans run into trouble. If the structure guarantees the owner will use the full allocation every single year, particularly in a sole employee-shareholder setup, CRA can conclude there's no real element of risk at all, just disguised compensation wearing a PHSP label. A third-party administrator adjudicating claims independently is the strongest evidence against that conclusion; a self-administered plan carries a much heavier burden of proof.

For shareholder-employees, auditors also check whether there's an employment contract in place and whether the owner could unilaterally change or cancel the plan whenever they wanted. If the corporation can rewrite the terms on a whim, the independence the plan needs to qualify starts to look thin. A plan that clears this stage still faces expense-level review. One that doesn't gets reassessed in full, regardless of how clean the individual claims were.

How auditors review individual claims: eligible expenses, documentation, and the reasonableness test

Every reimbursed expense gets checked against the eligible medical expense list in section 118.2(2). Dental care, vision care, prescription drugs, registered practitioners like physiotherapists and chiropractors, massage therapy with a prescription or referral, psychotherapy, medical devices, orthotics, and hearing aids all qualify. CRA has periodically updated that list, and certain mental health services and telemedicine consultations may also qualify. Gym memberships, unprescribed vitamins and supplements, and general wellness products don't make the cut, no matter how the claim gets labeled.

Documentation has to name the provider, describe the service, and show the date and amount. Where eligibility depends on a medical recommendation, massage therapy for a specific condition, say, there needs to be a supporting note or prescription behind it. CRA's own audit examples make the consequence plain: a massage therapy claim was disallowed for lack of a medical note, and OTC vitamin claims were disallowed because no prescription existed. The expense category being technically eligible doesn't save a claim with no paper behind it.

Then there's the reasonableness test. HSAs don't have a hard statutory cap, but CRA applies its own sense of proportion. One benchmark used across the industry caps annual HSA credits at a fraction of an employee's gross T4 salary, so someone earning a moderate income would top out at a proportional ceiling in credits. Departures from that kind of ratio draw attention even when every individual expense claimed is technically valid, because the size of the benefit relative to income is itself a signal. Auditors also check that wellness-type spending, fitness classes, lifestyle products, hasn't been quietly routed through the HSA instead of a taxable Wellness Spending Account. That's treated as a structural problem, not a minor line-item error.

How employee classification is reviewed and what the shareholder-employee determination looks like in practice

For any owner who's also a shareholder, the audit comes down to one question: did they receive this benefit as an employee, which is non-taxable, or as a shareholder, which is taxable under section 15(1)? CRA treats this strictly as a question of fact, decided on the specific circumstances of the person and the business, not on how the paperwork is labeled.

The default runs against the owner. Where a sole employee-shareholder has significant say over company policy, CRA starts from the assumption that any benefit flows to them because they own the business, not because they're on payroll, unless the record clearly shows otherwise.

Rebutting that takes real evidence: an employment contract that spells out the owner's role and names the HSA as part of their compensation, T4 income from the corporation rather than dividends alone, and proof that non-shareholder employees in similar roles, at this business or comparable ones, get similar benefits. A plan document that treats the owner the same as everyone else eligible carries more weight than one that reads like it was custom-built around one person's health costs.

The $1,500/$750 cap exists precisely because smaller businesses often can't produce that comparator evidence. With fewer than two arm's-length employees, there's no one to point to as a benchmark, so CRA limits the benefit instead of throwing the whole plan out. Auditors reviewing this question will typically ask for T4s across the whole payroll and an organizational chart, to see whether the benefit structure is genuinely tied to employment or functions as a personal health fund for the person who owns the place.

What happens after the audit review: reassessment, penalties, and the options available to the business

If the plan holds up, CRA closes the file and nothing changes. If specific claims get disallowed, those amounts become taxable benefits to the employee or owner for that tax year, and interest starts accruing on the outstanding amounts.

The bigger exposure comes if the plan itself fails the PHSP test. At that point, everything paid out under the plan, not just the claims that triggered the review, can be reclassified as taxable employment income or a shareholder benefit. The business loses its deduction for those payments, and CRA can reassess every open tax year the audit touches. Cash payouts of unused balances or RRSP transfers carry the same consequence: they disqualify the plan retroactively, and reimbursements that were perfectly eligible on their own terms become taxable simply because the plan around them no longer qualifies.

Once a reassessment lands, the business has real options. Pay the amount plus interest and move on. File a Notice of Objection within the required deadline, which starts a formal dispute review process. If that goes nowhere, further legal avenues may be available.

How much room a business has to fight any of this comes down almost entirely to what was in place before the audit started. Complete records, a written plan document, a third-party administrator handling claims independently, and real employment contracts for participating shareholder-employees give a business far more to work with when disputing a finding. A third-party administrator in particular does double duty here: it's structural evidence the plan operates at arm's length, and it leaves behind the organized paper trail that makes responding to a records request a formality instead of a scramble.