Common CRA Audit Triggers for Small Business PHSPs

Small businesses face familiar PHSP audit risks when they fail the eligibility rules, have a weak plan structure or lack records. A private health services plan can offer valuable tax treatment, but calling an arrangement a PHSP does not make it one. A defensible plan must qualify in substance, pay eligible expenses and have records that prove it meets the rules.

Why CRA scrutinizes small business PHSPs more than other benefit deductions

A PHSP brings together the rules for employee benefits, the structure of the corporation and medical expenses. That makes the claim more complex than a deduction supported mainly by a receipt and a business purpose. The expense must qualify, but so must the plan and the relationship between the business and the person receiving the benefit.

A corporation paying eligible medical expenses through a qualifying PHSP can cost materially less in total tax than an owner withdrawing personal income to pay the same bills. CRA has issued a formal consumer warning about businesses improperly claiming health spending account deductions that contravene the Income Tax Act. That warning identifies HSA claims specifically, rather than treating them as another general deduction risk. The scrutiny follows predictable patterns, starting with whether the business can qualify at all.

The foundational eligibility rule that disqualifies many small business plans before they start

A sole proprietorship with no arm's-length employees cannot claim an HSA as a PHSP deduction under the Income Tax Act. CRA does not consider an HSA in that situation to be a private health services plan, and the costs incurred are not deductible business expenses. The problem exists before any question about receipts, reimbursement amounts or administration.

Section 248(1) of the Income Tax Act contains the PHSP definition, and CRA's published administrative requirements set out its position. For this category of sole proprietor, the arrangement must meet the requirements for the deduction. The absence of arm's-length employees is therefore not a minor detail to sort out after the plan starts. It determines whether this HSA arrangement qualifies in the first place.

CRA has also explicitly rejected the claim that buying another insurance product, such as critical illness insurance, makes such an arrangement compliant. Some insurance agents, brokers and financial planners have marketed HSAs to sole proprietors on that basis. Incorporation changes the analysis because it introduces a corporation and a possible employment relationship.

Why incorporation alone does not guarantee PHSP eligibility for a one-person business

A one-person corporation presents a harder question than a sole proprietorship with no arm's-length employees. A shareholder may actively work in the business and receive benefits because of that work. But a plan covering only the sole shareholder-employee and their family members may still lack the necessary elements of insurance. The distinction matters because corporate status and PHSP eligibility are separate tests.

CRA Technical Interpretation 2014-0521301E5, issued June 25, 2014, states that such a plan would not likely qualify because “effectively, the sole employee-shareholder is paying for the personal hospital and medical expenses for themselves and their family members through their solely owned corporation without any risks being assumed by the corporation.” CRA reinforced that position at the May 3, 2022 CALU Roundtable in document 2022-0928901C6. A medical professional, consultant or tradesperson who incorporates solely to obtain PHSP benefits has therefore not necessarily established a plan with the necessary elements of insurance.

At the same time, whether the person receives benefits for their work depends on the facts. CRA's stated standard allows qualification where it can be demonstrated that “employees, who are not shareholders, with similar duties and responsibilities to another corporation of a similar size receive similar benefits under a similar plan.” That comparison helps show whether the person gets the benefit for their work or because they own the business. A shareholder who works in the corporation's day-to-day operations may have a basis for that characterization. But this area is still disputed, so it would be wrong to say that all one-person corporations qualify or that all of them fail to qualify.

How receiving benefits as a shareholder rather than as an employee triggers reclassification

When the connection is primarily share ownership rather than employment, CRA can reclassify PHSP reimbursements as a taxable shareholder benefit. That removes both the personal tax exemption and the corporate deduction. The medical nature of the expense does not protect the claim if the benefit flows through the wrong relationship.

Dividend-only compensation makes the distinction concrete. An owner who receives compensation exclusively through dividends has a harder employment characterization to defend than one receiving T4 employment income. Dividends-only compensation is a strong signal that the benefit flows from ownership, but it is not a definitive answer by itself. CRA has not given a definitive answer on whether salary must be paid or whether dividends alone can support an employment characterization. The conservative position is for the shareholder to receive at least part of their compensation as salary.

The records should back up that position by showing why the owner qualifies as an employee. An employment contract should document the relationship with the corporation, and a board resolution should record the PHSP's terms. Those documents help explain the corporation's obligation to provide the benefit as part of employment. Without them, the owner has less support for the distinction on which the tax treatment depends.

Why cost-plus plan structure for sole operators fails the insurance element test

Even where the employment relationship can be supported, the plan mechanics need their own examination. A pure cost-plus arrangement reimburses a sole employee-shareholder for actual expenses and adds an administration fee. In that arrangement, the administrator processes the payment, but no risk is assumed. CRA's objection is that this does not constitute a plan “in the nature of insurance.”

The insurance element is not supplied simply by putting an intermediary between the corporation and the medical bill. In a true insurance arrangement, the insurer assumes risk. In the sole shareholder-employee cost-plus arrangement described here, the corporation instead routes personal medical payments through an administrator. A reimbursement service and an insurance arrangement are not the same thing.

This trigger is distinct from the prohibition affecting sole proprietors with no arm's-length employees. It can catch an incorporated operator who has focused on corporate status without examining what the plan actually does. If the arrangement fails, the corporate deduction can be denied and the contributions treated as a taxable shareholder or employment benefit.

How the "all or substantially all" test catches plans that reimburse non-eligible expenses

A plan that passes the structural tests can still fail because of what it pays for. CRA's standard requires that all or substantially all of the premiums paid be for medical expenses eligible for the Medical Expense Tax Credit. A properly established PHSP can lose that status in a given year if too much of its funding goes toward non-eligible expenses.

A general wellness allowance is not interchangeable with a PHSP. Coverage for gym memberships, purely cosmetic treatments or other non-eligible items can cause the plan to fail the test. Broadening coverage over time without anyone monitoring the eligible proportion of actual claims makes this risk especially clear.

Each separate plan must meet the “all or substantially all” requirement independently, even when ineligible coverage is moved into a second plan. The business must therefore check each year that claims meet the rules for the Medical Expense Tax Credit.

Documentation and plan structure failures that turn an eligible plan into an indefensible one

Once the substantive requirements are met, the business still needs records that show what it promised and how it administered the promise. CRA requires a document outlining employee coverage under the PHSP. A plan with no coverage limits is unlikely to qualify. An unlimited, undocumented arrangement looks too much like a personal expense account routed through the corporation.

Administration matters for the same reason. A business can run a self-administered plan, but it will face much closer scrutiny in an audit. CRA strongly prefers, and in practice expects, a qualified third-party administrator to handle claim adjudication and reimbursement. Hiring an administrator addresses the separate need for sound administration of a plan that otherwise qualifies.

Where a business has multiple employees, it must apply coverage consistently within employee classes. An owner who provides a PHSP to themselves while excluding other employees in the same class directly violates the eligibility requirements. For shareholder-employees, all employment agreements should record the corporation's obligation to reimburse qualifying expenses, and the board should pass a resolution recording the terms and limits. Those records must match how the business runs the plan.

What happens when CRA does challenge a PHSP, and how long the exposure window lasts

A successful CRA challenge creates more than a lost deduction. The business can lose the corporate deduction while the owner owes personal income tax on contributions reclassified as a shareholder or employment benefit. The money has already been spent, but the expected tax treatment disappears. The business faces a reassessment liability, potentially with penalties.

The exposure also extends beyond the year of reimbursement. CRA generally has up to three years from the date of a Notice of Assessment to conduct a standard audit. That period can extend indefinitely in cases of suspected fraud or misrepresentation. The passage of time does not necessarily make an unsupported claim safe.

Budget 2024 proposed stronger tools to enforce the rules, including a penalty of 10% of tax payable for failing to comply with a Federal Court compliance order. It also introduced Notices of Non-Compliance with substantial daily penalties for delayed or incomplete responses. The proposed power to compel interviews and sworn statements was not yet law as of the research date, so it should not be treated as an existing power. A major overhaul of the Voluntary Disclosures Program took effect October 1, 2025. These developments make it important to distinguish a plan's tax eligibility from the separate consequences of failing to respond properly when CRA challenges it.

A qualified third-party pay-as-you-go HSA administrator can help fix weaknesses in how a plan is documented and run by providing digital submission, CRA-eligible expense filtering, EFT reimbursements and annual reporting. Those services help the owner administer an eligible plan without developing insurance or tax expertise. The order matters. The business and employment relationship must qualify, the plan must meet the insurance and expense rules, and the records must support how it operates. A defensible PHSP rests on all of those conditions.