Health reimbursement arrangements (HRAs) are an increasingly popular option for employers looking to provide affordable healthcare benefits to their employees. In addition to supporting all your employees' needs regardless of location, they’re a great way for employers to offer health coverage without the limitations or costs of traditional group health insurance.
However, HRAs must comply with specific IRS, ERISA, HIPAA, and Affordable Care Act (ACA) regulations. So, if you’re an employer, broker, or HR leader new to HRAs, you need to understand your compliance responsibilities before implementing your benefit to avoid costly non-compliance penalties.
Please note that while this blog is a useful starting point for general information about HRA compliance, it isn't legal or tax advice. Employers should consult qualified tax or legal professionals about their specific circumstances.
In this blog post, you’ll learn:
- What employers must do to establish and administer a compliant HRA.
- How HRA rules apply to substantiation, privacy, eligibility, reimbursements, and employee communications.
- Which compliance requirements employers should review before Open Enrollment.
An HRA is an IRS-approved, employer-funded health benefit. With an HRA, employers can reimburse employees for their eligible medical expenses. Employers set aside a defined amount of money for the HRA each month or year, and employees can use those funds to pay for a wide range of qualified medical services and items.
Eligible healthcare costs include deductibles, copays, and prescription medications, and other IRS Code Section 213(d) expenses outlined in IRS Publication 5021 and the CARES Act2. Depending on the type of HRA, health insurance premiums may also be eligible for reimbursement.
There are several different types of HRAs, each with its own compliance requirements:
Because each type of HRA has different regulations regarding eligibility, annual contribution limits, and the reimbursement process, employers should confirm which rules apply to their specific benefit before designing or renewing their plan.
HRA plan documents should clearly explain how the plan operates, who is eligible, what benefits are available, and how employees can receive reimbursements. Creating formal plan documents is one of the first steps in establishing a compliant HRA.
A complete plan document should include the following:
In addition to the plan documents, you must have a summary plan description (SPD) that you can make available to participating employees. The SPD is a simplified version of the complex language included in the main plan documents. Its purpose is to provide employees with an accurate, easy-to-understand description of the plan structure, rules, and procedures while also informing participants of their rights and responsibilities under the plan.
Without properly drafted plan documents, your HRA is legally invalid, and you may be subject to costly ERISA and ACA non-compliance penalties. The IRS may also reclassify reimbursed HRA funds as taxable income for your employees, leading to back payroll taxes, interest, and penalties for your business.
An employer can create plan documents on their own, but it can be difficult to ensure accuracy, and a mistake can cost you financially. For example, plan administrators can face civil penalties of up to $110 per day if they fail to provide required plan documents when a participant requests them in writing3.
Alternatively, a business can work with a lawyer to draft the documents. Employers can also work with a third-party benefits administrator (TPA), who may be able to help draft plan documents, but this means giving up control of your health benefits to someone else.
As a fourth option, an employer can work with an HRA administrator, like PeopleKeep by Remodel Health, to administer the benefit. We provide the documents and assist the business in implementing the formal plan. This is the best option for most companies as it removes the burden of creating complex legal documents and provides employers with a supportive resource regarding compliance issues.
The HRA notice informs eligible employees about how their HRA benefit works. QSEHRA and ICHRA notices should include basic information such as how an employee can obtain individual health insurance, how the HRA coordinates with premium tax credits, how to qualify for a special enrollment period, and contact information for individuals with questions about their HRA.
HRA notice requirements vary by type of HRA. For example, if you offer an ICHRA, your notice must include a statement explaining employees' right to opt out of the benefit. A QSEHRA notice would include the annual maximum contribution limits.
Generally speaking, you must provide written notice to all eligible employees at least 90 days before the beginning of the plan year or before the date the employee becomes eligible.
HIPAA privacy rules dictate the circumstances under which an employer or administrator can disclose an employee's PHI, regardless of the organization’s size. The rules state employers offering an HRA must adopt certain written PHI privacy procedures.
The written privacy procedures must include:
Employers must take all necessary measures to ensure they don’t use PHI to make employment or employee benefits decisions. An employer administering its own HRA can follow these rules. Still, like other aspects of compliance, they can be difficult to adhere to without assistance from an HRA benefits advisor or software administrator.
Yes, if the employer is self-administering their HRA. Employers should limit access to employees' medical information to what is necessary for plan administration. Using a third-party HRA administrator, like PeopleKeep, can help separate sensitive health information from the employer's normal HR processes.
Even when partnering with an HRA vendor, employers must still understand their responsibilities and make sure their plan has proper privacy and security procedures in place.
The IRS requires employees who receive reimbursements through an HRA to submit proper documentation for their eligible expenses, known as substantiation. This supporting documentation must remain on file for at least seven years.
Employees can provide this documentation directly to the company's designated privacy officers or through a third party. Those using PeopleKeep by Remodel Health can upload their documentation through their PeopleKeep account. One of our documentation review specialists will then review the documents.
Examples of documentation used to substantiate healthcare expenses are:
Depending on the item or service the employee requests a reimbursement for, they may also need to submit a doctor’s note to prove medical necessity.
Because HRA records can include sensitive health information, employers should also have appropriate safeguards for storing and accessing them. Failure to substantiate an expense or to keep the required documentation on file could result in a negative outcome during an IRS audit.
No. An HRA can only reimburse qualified medical expenses and services approved by the IRS in Section 213(d) and outlined in the employer’s HRA plan document.
For instance, an expense may be a qualified medical expense under federal tax rules but excluded from the employer’s plan. To prevent payment errors, employers should review both applicable IRS regulations and their plan terms before approving a reimbursement.
Sometimes. The answer depends on the type of HRA you want to offer. ICHRA regulations allow employers to vary allowances by age, family status, and legitimate employee classes, such as hourly vs. salaried workers. Employers with a GCHRA can also offer different allowance amounts using specific employee classes.
QSEHRAs have more restrictive rules regarding contributions and eligibility, such as allowing variations only by age and family status.
In all cases, employers must ensure compliance with nondiscrimination rules, which prohibit favoring highly compensated employees or otherwise discriminating in the availability or use of benefits.
What happens to unused HRA funds depends on the benefit’s plan design. Annual and monthly rollovers of unused allowance amounts depend on the type of HRA and the terms of the employer's plan. Some employers may allow rollovers, while others may not. Employers should clearly state their carryover rules in the plan documents and employee communications.
Unlike health savings accounts (HSAs), if an employer doesn’t allow annual rollovers, unused HRA funds stay with the employer at the end of the plan year.
With PeopleKeep, we only permit monthly rollover of HRA funds until the end of the plan year. All unused funds stay with the employer.
HRAs are tax-free if you design and administer your HRA properly. HRA contributions are tax-deductible for employers, and reimbursements are exempt from payroll taxes. Additionally, reimbursements are free from income taxes for employees as long as they have qualifying ACA-compliant coverage that provides MEC.
With a QSEHRA, reimbursements for employer-sponsored premiums through a spouse’s group coverage are generally taxable. This is because most group premiums are paid pre-tax through payroll.
No. HRAs require employees to have qualifying health coverage to participate.
Employees must have a health plan with MEC to participate in a QSEHRA. Participating in an ICHRA requires a qualified individual health insurance plan. With a GCHRA, only employees with a group health plan can use the benefit. Employers must verify that employees have proper coverage before paying out HRA reimbursements.
According to the ACA's employer mandate, employers with 50 or more FTEs — also called applicable large employers (ALEs) — must offer a health plan with MEC to at least 95% of FTEs and their dependents. The coverage must also meet the ACA's minimum value and affordability requirements.
Historically, HRAs have been primarily utilized by small businesses exempt from the employer mandate. But that has since changed with the creation of the ICHRA.
Unlike other HRAs, the ICHRA, when implemented correctly, can satisfy the employer mandate for large employers. Employees participating in the ICHRA must have individual health insurance coverage with MEC. This satisfies the MEC and minimum value standards.
For an employer to fully meet the employer mandate with an ICHRA, they must ensure their contributions are affordable. In 2026, an affordable ICHRA contribution ensures that an employee's health insurance doesn’t cost more than 9.96% of their monthly household income, using the lowest-cost silver plan on their local exchange as the standard.
If an ALE's ICHRA isn't affordable for an employee, the employer may be subject to ACA employer mandate penalties. According to IRS guidelines, a penalty applies only when a full-time employee obtains subsidized health coverage through the Health Insurance Marketplace or a state-based exchange and receives a premium tax credit.
Below are the 2026 ACA employer mandate penalties:
The IRS calculates these penalties based on an employer's number of full-time employees, not its number of FTEs. Employers can also exclude their first 30 full-time employees when calculating the potential penalty. This means an employer can qualify as an ALE by having more than 50 FTEs but won't necessarily face a financial penalty unless it has more than 30 full-time employees.
Employers can ensure compliance with the employer mandate and avoid penalties by offering an ICHRA with affordable employee contributions, provided they also meet other aspects of HRA compliance.
Yes. An HRA can affect premium tax credit eligibility through the ACA Marketplace. However, if an employee qualifies, they may be able to coordinate the subsidy with their benefit.
Here’s how it works:
Because the interaction between an HRA and premium tax credits can be tricky, employers should provide employees with clear information on how the process works before Open Enrollment and direct employees to qualified benefits advisors for individual advice.
Generally, employer-sponsored HRAs are employee welfare benefit plans subject to ERISA unless an exemption applies. This means employers may have responsibilities involving plan documents, disclosures, fiduciary duties, and other ERISA requirements.
Employers should review the ERISA requirements applicable to their HRA to ensure they’re maintaining the required documents and disclosures.
It depends on the type of HRA and the size of the organization. For example, ICHRAs are subject to COBRA like all group health plans. Some federal employees, churches, and religious tax-exempt organizations may not be subject to federal and state COBRA. And while businesses with fewer than 20 employees aren’t subject to federal COBRA laws, 40 states have their own “mini-COBRA” laws that may require them to provide COBRA benefits4.
Businesses that must comply with COBRA regulations must provide employees and their eligible spouses with a general notice describing their COBRA rights under the benefit plan.
QSEHRAs aren’t subject to COBRA because the federal government doesn’t consider them group health plans.
Before Open Enrollment, employers should review their HRA plan documents and complete other compliance tasks to ensure any changes for the upcoming plan year are properly implemented, so there’s no confusion for their participating employees.
As part of your Open Enrollment checklist, you should:
Knowing the best ways to keep your HRA compliant will save you from many headaches and pitfalls. Ensuring that tasks such as maintaining accurate plan documents, protecting employee health information, and communicating required notices are completed accurately can help you offer the best possible employee benefits and avoid pesky penalties.
While it's possible for a business to administer an HRA on its own, self-administration comes with inherent difficulties and risks. Partnering with us at PeopleKeep and leveraging our HRA administration puts employers in a more risk-free position by eliminating the administrative burden associated with compliance.
PeopleKeep doesn’t provide legal advice. This article is for informational purposes only. To ensure compliance with the law, you should seek professional assistance from tax experts.
This article was originally published on January 10, 2020. It was last updated on August 17, 2026. The article was also reviewed by the PeopleKeep by Remodel Health compliance team in August 2026.