What CRA Requires for an HSA to Be a Non-Taxable Benefit

A Health Spending Account only avoids taxation if it clears a specific legal bar: it has to qualify as a Private Health Services Plan under the Income Tax Act. Miss that bar, and the whole arrangement collapses into ordinary taxable income, no different than a bonus paid in cash.

Start with the default rule, because it's stricter than most people assume. If an employer pays or reimburses an employee's medical bills directly, CRA treats that payment as a taxable benefit. Full stop. There's no general allowance in the Act that lets employers hand out tax-free health money just because the money went toward something medical. The only way around that default is subparagraph 6(1)(a)(i), which carves out an exception for benefits received under a PHSP. It's a narrow statutory exception, not a broad principle, and that distinction matters for everything that follows.

Employers who structure things correctly gain a deduction for contributions to a qualifying PHSP, and the payments carry no CPP or EI premiums. Contributions to a qualifying PHSP are deductible as a business expense, making it a tax-efficient way to deliver health coverage. For a small corporation, that's a meaningfully cheaper way to deliver health coverage than raising salary and letting the employee pay out of pocket.

Getting it wrong carries a cost that can be just as large, maybe larger, since a plan that fails to qualify makes the reimbursements taxable to the employee. If a plan fails to qualify, the reimbursements become taxable income to the employee, and the employer loses the deduction on the same dollars. In a shareholder-employee situation, that failure can carry compounding tax consequences. The rest of this piece walks through what CRA actually requires to avoid that outcome, requirement by requirement. None of them are optional.

The statutory definition of a PHSP and what "in the nature of insurance" means

Section 248(1) of the Income Tax Act defines a PHSP as either a contract of insurance covering hospital or medical expenses (or both), or a medical/hospital care insurance plan, or some combination of the two. Provincial and federal government health plans are specifically excluded, since those aren't private arrangements to begin with.

CRA's administrative reading goes further than the bare statutory text. Under Interpretation Bulletin IT-339R2 (still cited despite being archived), the Employers' Guide T4130, and CRA's current webpage on medical expenses and PHSPs, a plan has to be "in the nature of insurance." That phrase carries real weight. It means the plan involves a genuine undertaking to cover another party for a loss where the triggering event is uncertain, not scheduled, not guaranteed to happen.

Calling an arrangement an HSA doesn't make it one. Paying out claims doesn't make it one either. The structure itself has to carry actual risk, with real uncertainty about whether, and how much, will get claimed. A plan set up in a way where there's little realistic chance anyone but the intended recipient will ever use it fails this test outright. CRA doesn't see that as insurance. It sees it as a reimbursement scheme wearing an insurance costume.

That distinction, insurance versus personal reimbursement, is the root of a problem that hits a specific and common type of business owner especially hard.

Why sole shareholder-employees face a structural eligibility problem

One person owns 100% of a corporation, and that same person is also the corporation's only employee. They set up a self-insured HSA for themselves and their family. CRA's position on this is blunt: it likely doesn't qualify as a PHSP.

The logic follows directly from the insurance requirement above. When the only person funding the plan and the only person benefiting from the plan are the same individual, there's no risk transfer happening. The corporation isn't insuring anybody against an uncertain future cost. It's just a pass-through for the owner's own family medical bills, routed through a corporate structure to try to get a tax advantage that the Act never intended for that situation.

Two technical interpretations spell this out directly. Technical Interpretation 2014-0521301E5, issued in June 2014, states that a plan for a sole employee-shareholder would not likely qualify as a PHSP because it lacks the necessary insurance elements. CRA does leave a door open there, though it's a narrow one: the shareholder can try to show that arm's-length employees doing similar work at a comparable corporation receive similar benefits under a similar plan. Then, in 2022, Technical Interpretation 2022-0928901C6 (the CALU Q10 response) reaffirmed the same conclusion. A self-insured HSA for a sole employee-shareholder and family members would likely not constitute a plan in the nature of insurance, and so it would not qualify as a PHSP.

For incorporated businesses that do have arm's-length staff, the practical fix is straightforward. CRA's position is that a plan covering only shareholders is exposed to reclassification, so the covered employee group should include arm's-length workers. A plan that covers only shareholders is exposed to reclassification as a shareholder benefit rather than an employment benefit, which triggers the same double-taxation problem described earlier: taxable to the recipient, non-deductible to the corporation.

Arm's-length employees don't need to make up the majority of the plan. But at least one has to be there, genuinely covered, genuinely eligible. That's a design decision that needs to happen before the plan launches, not a technicality to clean up after CRA asks questions.

The formal plan document and employment relationship requirements

A PHSP has to look, on paper, like an actual contract between the employer and the employee. That means CRA wants to see a defined obligation to reimburse, not a discretionary favor the employer can change on a whim. A written plan document is required, and a plan with no defined structure or limits is unlikely to survive scrutiny.

The document itself needs to spell out a handful of things clearly:

• The extent of coverage, since unlimited HSA maximums for any class of employee are not acceptable under CRA's guidance
• Which employee classes are covered, and what each class's limit is
• Confirmation that employees have been told the plan details and have unrestricted access to review them
• Confirmation that employees aren't giving up other compensation, like salary or bonus, in exchange for the benefit

For a corporation with a single shareholder-employee, best practice runs a bit further. The employment contract itself should be amended to record that the HSA is being offered, that the corporation is obligated to reimburse eligible expenses up to the stated plan limit, and that the corporation can't modify or cancel the plan unilaterally without notice. These provisions matter because they're what turn the arrangement into something that functions like a contract between two separate parties, rather than a personal fund the owner dips into whenever convenient.

Shareholders also need to demonstrate they're genuine employees in substance, not just on paper. That means active, regular involvement in running the business, and it means drawing T4 salary income rather than living exclusively off dividends. The T4 requirement does double duty here: it confirms real employment status, and it gives CRA (and the plan administrator) a number to measure benefit limits against for reasonableness, which comes up again below.

How CRA tests whether a plan's expenses qualify: the 90% METC rule

Since January 1, 2015, CRA has applied what's commonly called the 90% rule. A plan qualifies as a PHSP as long as all or substantially all of what it pays out relates to expenses eligible for the Medical Expense Tax Credit under the Income Tax Act. "All or substantially all" is CRA's standard shorthand across the Act for 90% or more, so that's the working number in practice.

Before 2015, the bar was stricter, leaving no margin for edge cases or borderline claims. The current standard gives plan administrators some room without automatically blowing up the whole plan's status.

The mechanics of the test differ depending on how the plan is funded:

Under CRA's guidance, the 90% threshold is applied to the benefits paid out under the plan, if 90% or more of what employees claimed relates to METC-eligible categories, the plan passes.

One detail trips people up: Each plan arrangement needs to be structured so that the expenses it covers meet the 90% threshold on their own merits.

Genuine interpretive tension exists here that hasn't been fully resolved. Sun Life published an analysis pointing out that ITA subsection 248(1) doesn't, on its plain text, actually restrict PHSP benefits to the METC list. CRA's 90% linkage to METC eligibility may go further than the statute itself requires. Until that gets challenged and tested, though, CRA's administrative position is the one that governs how plans get built and audited in practice. Theory aside, this is the rule to design around.

What expenses qualify under the METC list and where the line is

The eligible expense list for a PHSP mirrors the METC list under section 118.2(2), the same list an individual taxpayer would use claiming medical expenses on a personal return. That overlap is intentional and makes cross-referencing straightforward.

Expenses that typically qualify include prescription medications, dental services, vision care involving an actual prescription (eyeglasses, prescription contacts), services from a licensed medical practitioner, dentist, or nurse, physiotherapy and chiropractic care and certain specialist services where CRA's conditions are met, eligible medical equipment and devices, hospital services, mental health services meeting CRA's criteria, and maternity and reproductive health services that meet CRA's criteria.

What doesn't qualify is just as important to nail down. Over-the-counter vitamins and supplements without a prescription are out. Generic, non-prescription reading glasses are out. Purely cosmetic procedures that aren't medically necessary don't count, and neither do weight loss programs unless a doctor has prescribed one for a specific diagnosed condition. Gym memberships, fitness classes, sports equipment, and personal development spending don't belong in an HSA at all. Those fall under a Wellness Spending Account instead, and a WSA is treated as a taxable benefit from the start, no PHSP protection involved.

This is where a lot of plans actually break down in practice. Employers lump wellness-style spending into the HSA rather than keeping it in a separate WSA bucket, and mixing the categories creates messy tax reporting and puts the entire plan's PHSP status at risk, not just the misclassified expenses. HSAs reimburse expenses that have already happened and have a receipt attached. Cash advances aren't allowed. Reimbursement follows the expense; it never precedes it.

Contribution limits, employee classes, and the reasonableness standard

There's no fixed dollar cap on PHSP contributions written into the Act, unlike certain registered savings accounts where the ceiling is a known number every year. Instead, CRA leans on a reasonableness standard. If a benefit limit looks wildly out of proportion to what the employee earns or does, or if it looks like it's really just a vehicle for pulling money out of the corporation rather than funding genuine health coverage, it risks getting reclassified as taxable compensation.

Industry practice has settled on a rough guideline here, even though it's not written into the statute anywhere: capping HSA credits around 20% of an employee's gross T4 salary. It's not a legal ceiling. It reflects what plan administrators consider a defensible reading of CRA's reasonableness expectation.

Employers can set up different classes of employees with different benefit limits, but the classes have to be genuine. A few rules apply here. Class definitions can't be drawn artificially narrow just to exclude people who'd otherwise qualify for the benefit. Everyone inside a given class has to get the same offer; arbitrary carve-outs within a class aren't allowed. And the gap between the richest class and the leanest class needs to stay defensible, with guidance from easyhsa.ca suggesting the highest limit should not exceed ten times the lowest limit across employee classes.

For shareholder-employees, the benchmark gets more specific still: the limit chosen has to be something a non-shareholder employee doing similar work at a similar company would plausibly receive. That ties directly back to CRA's broader position on what constitutes a genuine arm's-length employment relationship for PHSP purposes. And regardless of class structure, a plan with an unlimited maximum for any employee group is difficult to defend under CRA's reasonableness standard.

How unincorporated businesses and sole proprietors are treated differently

Sole proprietors and partnerships can access a self-insured PHSP too, but the eligibility path looks different from the incorporated version, and one rule here is absolute. A sole proprietor with no employees at all cannot set up an HSA for themselves. CRA won't accept it, because there's no legal separation between the individual and the business in that structure, so there's nothing for the insurance element to attach to.

The minimum condition to unlock a PHSP as an unincorporated business is at least one arm's-length employee. Without one, any reimbursements get treated as personal income to whoever received them, and they're not deductible against business income at all.

Where there is at least one arm's-length employee, the Income Tax Act sets a deduction cap that scales with how the workforce is composed:

• If there are no arm's-length employees, or fewer than 50% of the workforce is arm's-length, the maximum deductible amount for the owner and dependants is set as a flat annual figure per covered person, with a lower figure for dependants under 18 than for adults.
• If 50% or more of the workforce is arm's-length and full-time, the deduction cap rises to match whatever coverage those arm's-length employees actually receive. The owner's plan has to mirror staff coverage, not exceed it.

The owner also has to be actively and continuously engaged in running the business, the same active-involvement standard that applies to incorporated shareholder-employees. For unincorporated businesses, the arm's-length employee count does two jobs at once: it's the gate that determines whether a PHSP is even possible, and it's the yardstick that sets how much the owner can actually deduct.

The cash-out and transfer prohibitions that can retroactively void a plan

A few design mistakes don't just cause problems going forward, they can unwind everything that already happened under the plan.

Allowing an employee to withdraw cash from an HSA, taking money out directly rather than submitting it against an actual eligible expense, kills the plan's PHSP status immediately. And the consequence isn't limited to that one withdrawal. CRA's position is that once a plan fails this way, every benefit paid under it, including earlier reimbursements that were legitimately for eligible medical expenses, becomes taxable income to the employee retroactively.

The same logic applies to transfers. If unused HSA credits can be moved into something outside the health category, an RRSP, for instance, the plan loses PHSP status for the identical reason: the money is no longer restricted to medical purposes, so the insurance character disintegrates. One exception applies. Moving unused credits into another PHSP, or into a different health benefit class, is fine, since the funds stay inside the health-spending purpose the whole time.

Cash advances carry the same prohibition mentioned earlier. The plan has to reimburse expenses that already happened and already have a receipt, never fund something anticipated down the road.

The design implication is simple, even if it's easy to overlook when a plan first gets built. Any flexibility that lets an employee redirect HSA balances outside of actual health spending has to come out before the plan launches. Patching it in after the fact doesn't undo the exposure that already accrued.