HSA Annual Reporting and CRA Compliance for Small Businesses

A Health Spending Account is not a personal bank account, and that single fact drives almost every rule the CRA applies to it. In Canada, what people call an HSA is legally a Private Health Services Plan (PHSP), defined under section 248(1) of the Income Tax Act. The business funds it, the employee submits eligible medical expenses, and the reimbursement comes back tax-free, provided the structure is built correctly from the start. Get the structure wrong, and that same reimbursement turns into a taxable benefit, retroactively, with penalties attached. The businesses that get burned almost always made the mistake early, at setup, not at claim time.

The CRA lays out the rules in key technical documents that advisors and auditors repeatedly return to. These do not read easily, but together they explain nearly every dispute that comes up around these plans. What follows walks through the mechanics: who qualifies, how much a business can put in, what counts as an eligible expense, and the paperwork that keeps a plan standing when the CRA comes asking.

The PHSP qualification test and "all or substantially all" in practice

Every PHSP has to pass one core test: all or substantially all of the premiums paid under the plan have to cover expenses eligible for the Medical Expense Tax Credit. The CRA reads "substantially all" as 90% or more. Fall short of that number and the plan does not qualify. Full stop, no partial credit.

This is where a lot of well-meaning plans go sideways, and the mistake is almost always the same one: a business reimburses gym memberships or personal development courses alongside prescription drugs and dental work, and that mix quietly drags the ratio below 90%. Those lifestyle expenses belong in a separate Wellness Spending Account, which carries different tax treatment. Mixing the two under one HSA umbrella does not just risk the individual claim. It puts the whole plan's qualification on the line.

A second part of the test gets missed even more often, and it has nothing to do with expense categories. The plan has to function like insurance. Claims and reimbursements get handled at arm's length from the employer. An owner who reviews and approves their own claims, with no outside check, is self-adjudicating, and self-adjudication contradicts the CRA's definition of an insurance arrangement. The plan also has to exist on paper. A handshake agreement between an owner and a bookkeeper does not make a PHSP, no matter how consistently it has been followed for years. And reimbursements have to flow through the proper corporate structure, not through informal or personal channels. Mixing personal and corporate funds on the payout side is a structural flaw, and the CRA treats it as disqualifying, not correctable.

Which businesses and owners can participate, and where eligibility gets complicated

Incorporated businesses can bring shareholders into a plan, but only as T4 employees, and the benefit has to attach to the job itself, not to ownership. If a shareholder-employee gets a materially larger credit than an arm's-length employee doing comparable work, that gap tells the CRA the benefit tracks equity, not employment. Employees in similar roles, with similar tenure, need the same annual credit. That gap is disqualifying.

Sole shareholders hit a wall that no amount of paperwork moves. CRA Technical Interpretation 2014-0521301E5, from June 2014, states that a plan built for a sole employee-shareholder likely will not qualify as a PHSP, because it lacks the necessary elements of insurance. A later interpretation, 2022-0928901C6 CALU Q10, reaches the same conclusion for a self-insured HSA covering a sole employee-shareholder and their family. A contract between a person and themselves cannot be insurance. There is no arm's-length party on the other side of the claim, and a PHSP structurally needs one to exist.

Sole proprietors and unincorporated businesses face a different gate. They can join only if they employ at least one arm's-length employee, someone employed continuously for more than three months at arm's length from the owner. The CRA calls this a Qualified Employee. The owner also has to clear an income test: either 50% of total personal income for the current or previous year comes from the business, or income from other sources stays under $10,000. If the owner wants in, every Qualified Employee has to be included too, and the owner's own benefit is capped at $1,500 a year, or $750 with no dependants. That cap applies to the owner specifically; arm's-length employees are not bound by it.

A sole proprietor with no qualifying arm's-length employees and no incorporation is largely out of luck, and no clever plan design changes that. Amounts paid into a self-insured HSA in that situation generally are not deductible as business expenses. Eligibility has to get sorted before the plan runs, because no amount of clean recordkeeping fixes a plan built on a foundation that never qualified.

Setting contribution limits without a CRA-published cap

Unlike other registered savings accounts, there is no statutory dollar limit on HSA contributions. Instead, the CRA runs a reasonableness test, which is exactly as fuzzy as it sounds and exactly as enforceable as a hard number.

Reasonableness means the contribution connects to expected eligible medical expenses, the plan's design, and a documented rationale behind the figure chosen. It cannot be a round number picked because it sounds generous. A common guideline used by many providers is to keep HSA contributions under 25% of an employee's gross annual salary, a convention rather than a figure written in the Income Tax Act. Some administrators run tighter, capping annual credits closer to 20% of gross T4 salary, which on a $60,000 salary works out to a $12,000 maximum credit.

Contributions that look oversized for the business, given the practitioner's income, the size of the practice, or plausible expense patterns, draw scrutiny fast. So does a structure where shareholder-employees get dramatically bigger credits than arm's-length staff in similar roles. One rule governs all of this without exception: no cash-out, ever. A compliant HSA cannot let participants convert unused credits into cash or redirect them toward non-medical spending. The plan runs on fixed, predefined limits, period. For most small businesses, the workable move is setting the reimbursement allowance against actual expected eligible expenses and the structure of employee classes, then writing that rationale down on paper. That documentation is what an audit goes looking for first, before anything else.

Eligible expenses: what the CRA list covers, recent expansions, and the most common misuse

The list of eligible HSA expenses mirrors the CRA's medical expense list for the Medical Expense Tax Credit. Same list, same boundaries, no separate standard invented for HSAs. It covers a lot of ground: prescription drugs, dental services, vision care, physiotherapy, chiropractic care, ambulance services, certain medical devices and supplies, and visits to licensed health practitioners. The list has expanded in recent years to reach certain mental health services and home health care, provided the CRA's specific requirements for those categories get met. Telemedicine sits in murkier territory. It is not broadly eligible unless current CRA guidance specifically backs it, so check the latest rules before assuming a virtual visit counts.

What gets excluded matters just as much as what gets included. Cosmetic procedures, over-the-counter items without a prescription, and general lifestyle spending all fall outside the list. The single most common compliance failure happens when employers fold gym memberships or personal development costs into HSA claims. Those expenses have a legitimate home, a Wellness Spending Account, but that account carries different tax treatment. Running both types of spending through one HSA is a direct hit on the 90% PHSP qualification test, and consistent reimbursement of ineligible expenses can jeopardize the plan's qualified status, not just for the individual expense in question but for the plan more broadly.

The CRA revises this list periodically, so treating it as a static checklist set once at plan launch is a mistake plenty of businesses make and later regret. Regular review keeps the plan aligned with current rules instead of last year's version of them.

Documentation and record-keeping requirements that support every claim

Every receipt submitted for reimbursement needs the service provider's name, the date of service, a description of the expense, and the amount paid. Incomplete receipts are one of the most common weak points an audit finds, and they are entirely avoidable with a basic intake standard set at the start, before the first claim ever comes in.

Arm's-length adjudication is structural. Claims need processing independent of the employer's direct say-so on individual expenses. An employer reviewing and approving their own claims, with no external check, risks having the whole arrangement reclassified as something other than insurance. This is why most compliant plans run through a third-party administrator. A TPA verifies receipts, processes reimbursements on its own judgment, and creates the documentary separation the CRA looks for. Digital claims systems fit naturally here: a system that tracks claims, stores receipts, and generates reports puts a business in a stronger position if questions come up later.

Regardless of who administers the plan, the employer has to hold onto records of every reimbursement, every supporting receipt, the written plan document itself, and proof that contribution limits and employee classes got applied consistently across the board. Since the eligible expense list shifts over time, internal documentation should get updated to match it, rather than sit frozen as a snapshot from the year the plan launched. The written plan document deserves particular attention, spelling out the nominal value, the annual benefit limit for each employee class, the categories of expenses covered, and how claims get processed. A plan document that is vague, undated, or unsigned is a red flag the moment an auditor opens the file.

Annual reporting obligations for employers

T4 slips are due to employees by the end of February following the tax year, and the T4 Summary, which rolls up all the individual slips, goes to the CRA on that same schedule. Employers issuing six or more T4 slips have to file electronically, not on paper.

Reimbursed medical expenses generally do not appear as a taxable benefit on the employee's T4 when the plan is properly structured as a PHSP. That is the whole point of setting one up correctly: the reimbursement never touches the employee's tax return as income. But that treatment is contingent on the plan meeting PHSP requirements. A plan that fails qualification sends the employer back into those T4s, potentially refiling them with the benefits now counted as taxable income.

None of this cuts the paperwork burden. If anything, it raises the stakes on it. Even when HSA reimbursements never touch a T4, employers still need precise records of every reimbursement and every supporting receipt, ready for CRA review on demand. The benefit's absence from the T4 raises the stakes on scrutiny. The business has to be able to prove why the amount was left off. On the corporate side, HSA contributions get claimed as a deductible business expense, and that deduction needs the same backup as any other, including the written plan, the receipts, and proof of arm's-length administration.

Quebec runs its own rules here, and businesses with staff in the province cannot treat it as an afterthought. Employer HSA credits count as taxable income provincially, and they show up on the RL-1 slip, in Box J. That is a genuinely different reporting structure than the rest of the country runs, not a minor variation on the federal one.

Annual reporting, at the end of the day, is the visible tip of a year's worth of recordkeeping. Employers who keep clean records as they go do not face a scramble every February. Employers who try to reconstruct a year of claims at filing time are the ones who build their own audit exposure, one missing receipt at a time.

The compliance failures that most commonly trigger CRA scrutiny

Some failures are fatal from day one, and no fix applied later changes the outcome. A plan built for a sole employee-shareholder with no arm's-length employees fails the insurance-nature test at the structural level, and no volume of documentation repairs that. Ownership-linked benefit design hits the same wall from a different angle: giving shareholder-employees noticeably richer credits than arm's-length staff in comparable roles signals that the benefit tracks equity rather than employment, which is exactly the distinction the CRA tests for.

Reimbursing ineligible expenses, lifestyle items dressed up as medical ones, undermines the 90% threshold directly and opens up both disqualification risk and penalties on the claims that get reprocessed. Self-adjudication does similar damage from the process side. An employer approving its own claims without an arm's-length administrator looks nothing like an insurance arrangement to the CRA, and the plan risks reclassification because of it.

Contributions that run large relative to the business, with no documented rationale tying them to expected expenses or compensation levels, draw attention under the reasonableness test. Any plan feature that lets unused credits get cashed out or redirected to non-medical spending also disqualifies the arrangement. A plan running on informal or verbal terms, with no written document in place before claims start, is not something retroactive paperwork can rescue either.

The consequence chain, when a plan fails, runs in one direction, and it is not gentle. Reimbursements become taxable benefits to employees. Amended T4s follow. Employer deductions get denied, and penalties and interest start accruing on top of both. That two-sided cost, hitting the employer's deduction and the employee's tax-free status at the same time, is why getting the structure right at the outset beats patching it after the fact.

Running a compliant HSA year-round: the operational habits that protect the plan

Compliance holds up through consistent habits: applying contribution limits the same way across each employee class, running every claim through arm's-length adjudication, and keeping receipts from day one instead of chasing them down months later.

The written plan document deserves an annual look. Eligible expense categories shift, employee classes change as a business grows or restructures, and contribution levels should get re-evaluated against what the business actually expects to spend that year. A plan document still reflecting last year's headcount or last year's expense list may not hold up against this year's claims.

For small businesses without a dedicated HR or finance function, a third-party administrator resolves several of the most common failure points at once. It supplies the arm's-length adjudication the CRA requires, it generates independent records, and it builds the audit trail that makes a plan defensible under review. Digital claim submission paired with electronic reimbursement tightens that trail further, since every claim gets timestamped and receipted as it happens rather than reconstructed months later from memory. None of this is complicated in concept. It just has to happen consistently, claim by claim, year after year, because the CRA judges the paper trail a plan leaves behind, not the intentions behind it.