Your HSA card uses two layers of filtering to determine what you’re buying: the type of store you’re shopping at and, in many cases, the specific items in your cart. The system isn’t reading your mind or scanning your receipt after the fact. It’s making real-time decisions at the point of sale, before the transaction goes through.
Layer One: Merchant Category Codes
Every business that accepts credit or debit cards is assigned a four-digit Merchant Category Code (MCC) by the card network. When you swipe your HSA card, the payment network checks this code first. Doctors’ offices, hospitals, dentists, pharmacies, optometrists, and medical supply stores all carry MCCs that are automatically approved for HSA transactions. Your card goes through without any item-level screening because the assumption is that nearly everything sold at these locations qualifies as a medical expense.
On the flip side, certain MCCs are outright blocked. You physically cannot complete an HSA transaction at a bar, liquor store, pawn shop, jewelry store, gambling establishment, or financial institution. The card network rejects the transaction before it even reaches your HSA administrator. Restaurants, cosmetic stores, beauty shops, and spas are also restricted, which is why your HSA card won’t work at those locations even if you believe the purchase is medically related.
Layer Two: Item-Level Screening at Retail Stores
The more interesting question is what happens at a store like Walmart, Target, or CVS, where you can buy bandages and candy bars in the same trip. These retailers use a system called the Inventory Information Approval System (IIAS), which checks every individual item in your cart against a pre-approved list of eligible products.
Here’s how it works: a trade group called SIGIS (Special Interest Group for IIAS Standards) maintains a master list of eligible healthcare products, organized by UPC and SKU numbers. Participating retailers load this list into their point-of-sale systems. When you scan a bottle of ibuprofen, the register checks its UPC against the eligible product list. When you scan a bag of chips, it finds no match. The system then totals only the eligible items and sends that specific dollar amount to your HSA card issuer for approval. The remaining balance for ineligible items gets charged to a second form of payment, like a personal debit or credit card.
Retailers that haven’t implemented IIAS generally cannot accept HSA or FSA cards at all. The card network blocks the transaction entirely rather than risk funds being spent on ineligible items.
What Counts as an Eligible Purchase
The IRS defines eligible medical expenses as costs related to the diagnosis, cure, treatment, or prevention of disease, or expenses that affect any structure or function of the body. This includes prescription medications, medical equipment, diagnostic devices, and supplies. It does not include items that are “merely beneficial to general health,” like general vitamins or wellness retreats.
Since the CARES Act passed in 2020, over-the-counter medications like pain relievers, allergy pills, and antacids are eligible without a prescription. Menstrual care products, including tampons, pads, liners, and cups, also qualify. This was a significant expansion. Before 2020, most OTC medications required a doctor’s prescription to be HSA-eligible.
How Mixed Carts Are Handled
If you’re buying a mix of eligible and ineligible items, the experience depends on where you’re shopping. At a brick-and-mortar store with IIAS, the register automatically splits your purchase. Your HSA card is charged only for the qualifying items, and you pay for everything else separately. Some online retailers use third-party payment tools that do the same thing digitally, separating your cart into two subtotals at checkout and letting you assign different payment methods to each.
The key thing to understand: your HSA card won’t just approve the full amount of a mixed purchase. The system is designed to isolate the eligible portion and reject the rest. If a store can’t do that separation, it typically won’t accept the card at all.
When You Need to Prove It Yourself
Automated screening catches most transactions, but it’s not perfect. Your HSA administrator may flag a purchase and ask you to substantiate it, meaning you need to prove the expense was medically eligible. This commonly happens with online purchases, transactions at providers that use generic MCCs, or expenses that could be either medical or personal (like a massage from a licensed therapist).
When substantiation is required, you’ll need a receipt or documentation that includes five specific pieces of information: the name of the person who received the service, the provider or merchant’s name and address, the date the expense was incurred, a description of the service or product, and the amount charged. A credit card statement or canceled check won’t satisfy this requirement. You need an itemized receipt that shows what was actually purchased.
For over-the-counter items, the receipt doesn’t need to include the patient’s name, but it does need to display the item name. A receipt that just says “merchandise” or shows only a total won’t work.
Why Your Card Sometimes Gets Declined
If your HSA card is declined for something you believe is eligible, a few things could be happening. The merchant’s MCC might not be on the approved list, even if the business provides medical services. The store might not have IIAS set up, so the card network blocks the transaction as a precaution. Or the specific product’s UPC might not be on the SIGIS eligible product list, which can happen with newer items or store-brand products that haven’t been categorized yet.
In these cases, you can pay out of pocket and submit a reimbursement claim to your HSA administrator with proper documentation. The money still comes from your HSA, tax-free. You just handle the paperwork yourself instead of the system doing it automatically at the register.