Reviewed by Mayer Hyman, Payments Specialist | Reviewed for accuracy July 2026
Key Takeaways
- HSA balances reached nearly $174 billion across 41.7 million accounts at the end of 2025, up 19% year-over-year (Devenir, 2025 Year-End HSA Research Report).
- 91% of HSA withdrawals in 2025 were spent using a debit card, with an average card transaction of $123 (Devenir, 2025).
- Roughly 98% of eligible FSA/HRA card purchases are substantiated automatically at the point of sale through IIAS-enabled systems, without requiring a receipt afterward (SIG-IS, 2025).
- Most HSA/FSA declines trace back to missing eligibility data at checkout, not insufficient funds, which is a solvable payment configuration problem, not a cardholder problem.
Why HSA and FSA Cards Get Declined at Checkout
A Health Savings Account (HSA) or Flexible Spending Account (FSA) card looks like an ordinary Visa or Mastercard debit card, but it isn’t processed like one. Every transaction has to carry item-level eligibility data proving the purchase qualifies as a healthcare expense under IRS rules. When that data is missing, the transaction gets declined even if the cardholder has plenty of funds available and the item is genuinely eligible.
By default, only merchants coded under specific healthcare merchant category codes (MCCs), think doctor’s offices, clinics, and pharmacies, can accept these cards without extra steps. Every other retailer selling eligible items, medical supply companies, wellness brands, telehealth platforms, has to build compliance into its payment stack directly. That’s where most of the friction in this market actually lives.
The Two Paths to Compliance
Merchants outside the default healthcare MCCs generally reach compliance one of two ways:
- IIAS (Inventory Information Approval System): A point-of-sale system that tags each item in inventory as eligible or ineligible for HSA/FSA spending. When a certified IIAS is in place, that eligibility flag travels with the transaction and the card network can approve it automatically, no manual review required.
- The IRS 90% Rule: Merchants where more than 90% of gross sales come from healthcare-eligible items can qualify for an IRS exemption from full IIAS certification. This is largely how pharmacies and dedicated wellness retailers accept HSA/FSA cards without building a full inventory-tagging system.
Without one of these two paths in place, a purchase that should qualify gets declined by default. For merchants selling medical devices, wellness products, or telehealth subscriptions where healthcare spend isn’t the entire business, that gap shows up directly as lost revenue and abandoned carts.
Why This Matters More as Digital Health Spending Grows
The stakes here are rising because more healthcare spending is moving to card-based, self-service channels. The North American digital health market was valued at roughly $182 billion in 2025 and continues to expand as patients increasingly expect the same checkout convenience from healthcare providers that they get from any other online retailer (Fortune Business Insights, 2025).
At the same time, HSA balances themselves are growing fast, up to nearly $174 billion by the end of 2025 across 41.7 million accounts, with debit cards now the primary way account holders spend those funds (Devenir, 2025). That combination, more digital health spending and more HSA dollars flowing through card rails, means a declined HSA/FSA transaction isn’t a minor annoyance anymore. It’s a checkout failure at the exact moment a patient is trying to pay.
Where the Revenue Actually Leaks
Declines rarely happen because the cardholder lacks funds. They happen because the transaction never carried the eligibility data the network needed to approve it, or because the merchant’s category code and inventory setup weren’t configured to send it. Each of those declines is a completed sale that didn’t happen: the patient either abandons the purchase, pays out of pocket and loses the tax advantage, or takes their business elsewhere.
What a Compliant Setup Actually Looks Like
Handling this well comes down to a few concrete pieces working together rather than one silver-bullet feature:
- Automatic recognition of healthcare MCCs so eligible transactions route correctly without manual intervention.
- IIAS-compliant item-level eligibility data attached to each transaction at the point of sale.
- Automatic detection of 90% Rule eligibility for merchants that qualify, so they aren’t forced into a full IIAS build-out they don’t need.
- One processing setup across online, in-clinic, and mobile channels, so reconciliation and compliance scope don’t fragment across multiple systems as new sales channels get added.
Cartis Payments processes HSA/FSA transactions through the NMI gateway with this kind of eligibility data built into the transaction flow, which is one option healthcare-adjacent merchants use to reduce declines without maintaining a separate compliance system on top of their existing payment setup.
FAQ
Why does my HSA/FSA card get declined even when I have enough money in the account?
Because HSA/FSA transactions require item-level eligibility data to travel with the purchase. If the merchant isn’t set up to send that data, either through IIAS or the IRS 90% Rule, the transaction is declined regardless of the account balance.
Which merchants can accept HSA/FSA cards without extra certification?
Merchants coded under standard healthcare MCCs, such as doctor’s offices, clinics, and pharmacies, can generally accept these cards without additional setup. Other retailers need a certified IIAS or must qualify under the IRS 90% Rule.
What is the difference between IIAS and the 90% Rule?
IIAS is a point-of-sale system that tags individual items as eligible or ineligible so eligibility data can be sent per transaction. The 90% Rule is an IRS exemption for merchants where over 90% of sales are healthcare-eligible items, letting them skip full IIAS certification.
How common are HSA/FSA card declines for non-medical merchants?
There’s no single industry-wide decline rate, but declines are common enough that payment providers have built dedicated compliance tooling around the problem. Missing eligibility data, not insufficient funds, is consistently the leading cause. Contact Cartis to review your current HSA/FSA setup and identify where transactions are falling through.
