Responding to a CRA Request for PHSP Documentation

A CRA request for PHSP documentation isn't a paperwork exercise. The auditor is checking whether the arrangement actually qualifies as the specific tax-advantaged plan structure defined under subsection 248(1) of the Income Tax Act, and if it doesn't, every reimbursement the plan ever paid out becomes taxable income to the employee. That is the stake, since if the plan does not meet the subsection 248(1) definition, every reimbursement it ever paid out becomes taxable income to the employee. Get the response wrong, or don't respond at all, and a documentation request turns into a reassessment with years of back taxes attached.

The legal foundation goes back to Interpretation Bulletin IT-339R2, issued August 8, 1989, which sets out the test CRA still applies today. A plan has to be "in the nature of insurance." Paragraph 3 of that bulletin breaks the test into five parts: an undertaking by one person, to indemnify another, for an agreed consideration, against a loss tied to a specific event, where that event's happening is genuinely uncertain. Every one of those five elements has to be present. Miss one, and the arrangement isn't insurance, it's just an employer handing money to an employee for medical bills, and CRA will tax it accordingly.

Four things get scrutinized in a PHSP review: plan structure and the insurance element, whether the expenses claimed were eligible, whether the person receiving benefits was really an employee, and whether the paper trail backs all of it up. Each one gets its own section below, because each one can independently sink a plan.

The insurance element that many arrangements fall short on

Risk is the whole ballgame here. CRA's stated position is blunt: if an employee is going to get reimbursed for the full amount allocated to them every single year, with no real chance the money goes unclaimed, there's no risk. And without risk, there's no insurance, no matter what the plan documents call themselves.

Termination clauses matter too. If an employer can shut the plan down whenever it wants, for any reason, without notice, CRA reads that as more proof the "insurance" was never real insurance to begin with. An undertaking that can be cancelled on a whim isn't much of an undertaking.

This is where the 2022 CALU ruling changed the conversation for a lot of small incorporated businesses. CRA's position, laid out in that ruling, is that a particular kind of medical reimbursement arrangement set up for a single shareholder-employee and their family probably doesn't qualify as that structure at all. The logic: that person is just running their own medical bills through their own corporation. There's no third party bearing risk, no pooling, nothing indemnified. It's a checking account with a different label on it. It sits front and center in CRA's own guidance, not tucked away in some obscure footnote. It's CRA's stated policy position, and it comes up constantly in reviews of owner-operated corporations.

So what does a compliant plan actually need? A formal plan document, first: annual benefit amounts spelled out by employee category, a clear list of who's covered, defined eligible expenses. Second, a third-party administrator agreement that builds in the risk element along with claims processing. Third, terms that the employer can't unilaterally cancel or retroactively rewrite whenever it's convenient.

Sole proprietors face a related wall. A sole proprietor can't set up a self-insured HSA covering only themselves, because indemnifying yourself isn't a thing. The math doesn't work, legally speaking, for the same reason one hand can't shake itself. For the insurance element to hold up, the plan needs at least one arm's-length employee in it.

Once the insurance element checks out, CRA moves to the next question: were the expenses actually the kind the plan is allowed to cover?

Which expenses qualify under the 90% rule

The eligibility standard changed on January 1, 2015. Before that date, CRA required every single expense reimbursed under a PHSP to qualify for the Medical Expense Tax Credit (METC). After that date, the rule loosened slightly to "all or substantially all," which CRA has interpreted as a 90% threshold. In practice: at least 90% of what the plan pays out has to go toward METC-eligible expenses.

The core categories haven't moved: prescriptions, medical and dental care, vision care, hospital expenses. Eligible expenses still track the METC list directly, and anything that isn't clearly listed needs to be checked against current CRA guidance before it gets submitted as a claim. Don't assume it's covered just because it feels medical.

Some things are flatly excluded, full stop. Purely cosmetic procedures, surgical or not, are excluded from qualifying expenses. Procedures undertaken purely for cosmetic reasons don't count, regardless of what the receipt says or how the claim gets coded.

What surprises people is that this is not a claim-by-claim problem. If an auditor finds that cosmetic or otherwise non-eligible expenses make up more than 10% of total reimbursements, the entire plan's PHSP status is at risk, not just the offending claims. One bad category of spending can undo the tax treatment of the whole arrangement for that year.

Which means documentation can't just be a shoebox of receipts. Every claim needs to be categorized against the METC list at the time it's submitted, not reconstructed after the fact. That categorization record, the note showing someone actually checked the claim against the list before paying it, is itself evidence CRA will ask for.

Proving the employment relationship, the shareholder-employee question

Every person collecting PHSP benefits has to have an employment connection to the business paying them. T4 income is a key piece of evidence CRA looks to when assessing the employment relationship.

For incorporated businesses, the auditor's job includes figuring out something specific: did this person get the benefit because they're an employee, or because they're a shareholder? That distinction decides whether the money is sheltered or taxable, and it's a live enforcement focus right now.

Three things drive that determination. Was the benefit offered to all employees, or a defined class of them, or only to people who happen to hold shares? Is the benefit reasonable compared to what an arm's-length employee doing similar work would get?

CRA's published guidance on shareholder-employees sets out what they need to show: real, active involvement in running the business, an actual employment contract with the corporation, and benefits sized reasonably against what a stranger doing the same job would receive. A shareholder who only collects dividends isn't automatically shut out of a plan, but the burden of proof gets heavier, and the quality of the supporting documentation carries real weight.

Sole proprietors have their own version of this. They can offer a qualifying plan to arm's-length employees. But if fewer than half the covered employees are arm's-length, a cap kicks in: $1,500 per year for the proprietor, spouse, or dependants over 18, and $750 for dependants under 18. Add a spouse and two younger kids to the mix, and the combined ceiling is $4,500.

Expect a CRA information request to dig into corporate structure specifically because of this. The auditor wants to know whether PHSP dollars flowed on an employment basis or a shareholder basis, and the org chart often answers that faster than any receipt does.

The documents CRA typically requests and what each one must show

Start with the plan document itself. It needs to state, in writing, the annual benefit per employee category, who's covered, what expense types qualify, and the actual terms of the plan, including provisions that protect against retroactive changes that would undermine the insurance element. It should also reference the third-party administrator agreement that carries the insurance element. A plan that was never formally written down, or exists only as an internal memo somebody typed up once, is a serious gap. Auditors notice its absence immediately.

Employment records come next. T4 slips are the strongest single piece of proof of an employment relationship. Beyond that: an actual employment contract between the corporation and the shareholder-employee, evidence of real operational involvement (a role description, payroll history), and records establishing the plan for employees in the first place.

Then the medical receipts and claim records: original receipts from providers, pharmacies, and equipment suppliers, prescriptions where relevant, invoices that clearly show provider name, date, and amount, and proof of payment, whether that's an EFT confirmation, a bank record, or a credit card statement. CRA expects detailed, accurate records to be kept covering every claim, every receipt, every payment confirmation.

Claim adjudication records matter separately from the receipts themselves. CRA wants to see that each claim was actually reviewed against the METC list before it got paid, not rubber-stamped. Any record showing that each claim was reviewed and that ineligible expenses got flagged and excluded helps here.

Finally, annual reporting: EFT confirmations that match up against approved claims, and a yearly summary showing total premiums, total claims paid, and reimbursements broken out by employee.

Keep all of it for at least six years. That's the standard CRA retention period for income tax records generally, and PHSP documentation is no exception.

How a CRA review escalates under the new enforcement rules on non-response

CRA doesn't review a PHSP in isolation. The process follows a chain: tax return, then financial statements, then general ledger, then source documents. Any break in that chain, per ConnectCPA's description of the process, triggers a follow-up request, and every unanswered request gives the auditor grounds to widen the scope of the review. A documentation gap in one place invites scrutiny everywhere else.

CRA now also uses AI-driven systems to flag files before a human auditor even opens them, looking for unusual deductions, odd income patterns, or documentation gaps. Shareholder benefits at incorporated businesses sit squarely inside current enforcement priorities, and PHSP reviews fall directly into that lane.

Then there's the Notice of Non-Compliance, powers introduced in Budget 2024 and reintroduced in August 2025. An NNC gets triggered when a taxpayer fails to adequately respond to an information request during an audit. The penalty runs $50 a day while it stays outstanding, capped at $25,000, and the normal reassessment period gets extended for as long as the NNC remains open. If a taxpayer requests a CRA review and that review is prolonged significantly, the NNC may be deemed vacated. Taxpayers should seek legal advice promptly if they believe privilege applies to any withheld material.

Beyond that sits the compliance order penalty. If a Federal Court issues a compliance order, a penalty of 10% of aggregate tax payable applies for each affected year. That only kicks in when the tax owed for at least one of the affected years tops $50,000.

A PHSP review that starts as a simple document request can turn into a reassessment with an extended limitation period and daily penalties stacking up, purely from silence. Non-response isn't a neutral choice. It has a price tag, and that price tag is calculable in advance.

Assembling and submitting a response that resolves the review cleanly

Read the request letter first, all the way through, before pulling a single document. Figure out exactly which of the four areas CRA is questioning: plan structure, the insurance element, expense eligibility, or the employment relationship. Then answer that. Don't under-deliver, but don't bury the auditor in extra material they never asked for, either. Unrequested documents tend to generate new questions, not fewer.

Organize the response around CRA's four verification areas, not by date stamp or file type. The first section covers the plan document and administrator agreement, addressing the insurance element. Section two: employment records, T4s, the employment contract, the corporate resolution, addressing the employment relationship. Section three: claim records, receipts, prescriptions, invoices, proof of payment, addressing expense eligibility. Section four: adjudication records and the annual summary, tying the whole plan's compliance together.

Attach a short cover letter. State the taxation years under review, list what's enclosed by category, and flag anything not yet available along with a realistic date for producing it.

Meet the deadline in the letter. If more time is genuinely needed, ask for an extension in writing before the deadline passes, not after. Missing the deadline outright is exactly what triggers a Notice of Non-Compliance, and there's no upside to finding that out the hard way.

Where records are genuinely missing, reconstruct what's reconstructable: bank statements, provider records, anything that fills the gap honestly. Document how the reconstruction was done. Don't fabricate anything, and don't backdate a document to make it look like it existed when it didn't. That's a different category of problem entirely, and a far worse one.

Bring in a tax professional when the request specifically targets the shareholder-employee question, when the plan was never formally documented in the first place, or when a Notice of Non-Compliance has already landed, or multiple years of records are being demanded at once. These situations move fast and the stakes compound quickly.

Businesses that run their PHSP through a qualified third-party administrator, one that keeps digital records of every submission, every adjudication decision, and every reimbursement, tend to handle these reviews faster and more completely. The evidentiary chain already exists before the request ever arrives. That's the real argument for structured administration over an informal reimbursement arrangement cobbled together in-house: not convenience, but readiness.

The point of a well-organized response is to give the auditor grounds to close the file cleanly. It's to hand the auditor everything needed to close the file the first time, without a second or third round of requests dragging the review out for months.