ICHRA Substantiation: The 2026 Proof-of-Coverage Rules

What ICHRA substantiation actually is

An employee submits a receipt for their individual health insurance premium. Your ICHRA is supposed to reimburse it, tax-free. Before that happens, federal rules require your plan to confirm something specific: that the employee actually has individual health coverage, or Medicare, for the month the expense covers. That confirmation step is called substantiation, and it is not optional paperwork bolted onto ICHRA. It is the mechanism that makes the reimbursement tax-free in the first place.

An ICHRA (Individual Coverage Health Reimbursement Arrangement) lets an employer set a fixed monthly reimbursement amount and let each employee buy their own plan on the individual market, then get reimbursed tax-free. That tax-free treatment comes from Internal Revenue Code Sections 105 and 106, the same sections that govern every other account-based health plan, including a traditional HRA or a health flexible spending account (FSA). Those sections do not hand out tax-free treatment automatically. The IRS's own guidance is direct about why: "to provide certainty that a particular expense is for medical care," every claim for reimbursement has to be substantiated, a requirement that traces back to IRS Notice 2002-45 and was confirmed again in Revenue Ruling 2003-43. ICHRA layers a second, coverage-specific version of that same requirement on top, because an ICHRA only works if the person receiving the money actually has individual coverage or Medicare to begin with; without that check, the arrangement functions like an employer just handing out taxable cash.

The rule itself comes from a final regulation issued jointly by the Departments of the Treasury (IRS), Labor, and Health and Human Services, which allows employers to integrate an HRA with individual health coverage subject to specific conditions. Among those conditions, the Departments write, is that "individual coverage HRAs must implement, and comply with, reasonable procedures to satisfy two substantiation requirements." That sentence is the entire subject of this article.

Federal substantiation requirements every ICHRA must satisfy

Pieces of information a claim receipt must show (Rev. Rul. 2003-43)

$36,500

Max IRC §4980D excise exposure per employee, per year, uncorrected

20,000+

US businesses offering ICHRA or QSEHRA, 2026 (HRA Council)

The two rules every ICHRA has to satisfy

Employers researching this usually find the word "substantiation" used loosely, as if it describes one form filled out once. It describes two separate, ongoing requirements, and the federal model-attestation instructions define them precisely. Quoting directly:

"The annual coverage substantiation requirement: The HRA must substantiate that participants and each dependent covered by the HRA are, or will be, enrolled in individual health insurance coverage or Medicare Part A and B or Medicare Part C for the plan year… The ongoing substantiation requirement: The HRA may not reimburse a medical care expense unless, prior to the reimbursement, the participant substantiates that the individual on whose behalf the reimbursement is requested is (or was) enrolled in individual health insurance coverage or Medicare… for the month during which the medical care expense was incurred."

That language comes from the Departments of the Treasury, Labor, and HHS's Individual Coverage HRA Model Attestations guidance, which cites the underlying regulations at 26 CFR 54.9802-4, 29 CFR 2590.702-2, and 45 CFR 146.123. Both requirements can be satisfied "by a participant attestation, among other permissible methods," including a document from a third party (an insurer or the exchange), or, for the ongoing requirement specifically, a record of the participant directly paying their own premium.

The two ICHRA substantiation requirements, side by side (26 CFR 54.9802-4(c))
Requirement	When it applies	What satisfies it
Annual coverage substantiation	Before the plan year begins, and before a new hire's HRA coverage starts	Signed attestation naming the insurer and coverage start date, or a third-party document (insurance card, enrollment confirmation)
Ongoing substantiation	Before every single reimbursement, for the specific month the expense was incurred	Attestation for that month, a third-party document, or (for this requirement only) proof of direct premium payment

Three more terms worth defining once

An attestation is a signed statement, not a notarized legal document; federal guidance treats a properly worded, signed attestation as sufficient on its own. A third-party document is anything issued by someone other than the employee confirming coverage, such as an insurance card or an Explanation of Benefits (EOB) from the carrier. Medical care, for substantiation purposes, is defined by Internal Revenue Code Section 213(d), the same definition used for HSA-eligible and FSA-eligible expenses.

What counts as proof, once a year

The annual requirement is the simpler of the two, and most employers handle it during open enrollment. The plan needs to confirm, before the plan year starts (or before a newly eligible employee's coverage begins), that the employee and every dependent covered by the HRA will have individual health insurance or Medicare for that period. The Departments' model attestation form does this with a short block: the employee's name, the insurer's name (or "Medicare"), and the coverage start date, repeated once per family member if more than one is covered, with a single signature and date line for the employee. Family members do not sign their own line; the employee attests on their behalf.

Nothing about this requires exotic documentation. An insurance card, a policy declaration page, or a confirmation email from the exchange satisfies it just as well as the model attestation, and a plan can combine methods, accepting an attestation from employees who do not have a document handy and a card scan from those who do. What the rule does not allow is skipping the check altogether and assuming enrollment, because the requirement is that the HRA "must substantiate," not that it may ask if convenient.

What counts as proof, every single claim

The ongoing requirement is the one that trips employers up, because it repeats. It is not satisfied once a year; it has to be satisfied before every reimbursement, tied to the specific calendar month the expense was incurred. HealthCare.gov's own model notice, published for employees receiving an ICHRA offer, states the mechanics plainly:

"Also, each time you seek reimbursement of a medical care expense from the HRA, you must substantiate that you had (or have)… individual health insurance coverage or Medicare for the month during which the expense was incurred… If you (or a family member) are no longer enrolled in individual health insurance coverage or Medicare, the HRA won't reimburse you for medical care expenses that were incurred during a month when you (or your family member) did not have individual health insurance coverage or Medicare."

In practice, most employers running an ICHRA through a third-party administrator never see this as a separate step; the platform pairs a short attestation with each claim submission automatically, or checks a premium-payment record on file. Employers running a plan by hand need a real process, because "we assumed our employees still have coverage" is not a substantiation procedure under the rule.

The claim itself also needs its own documentation, separate from the coverage check. IRS Revenue Ruling 2003-43 lays out what a receipt or invoice must show to substantiate a medical expense claim under Section 105(b): "(1) the service or product, (2) the date of the service or sale and, (3) the amount." A credit-card receipt or a bank statement line, by itself, does not include those three elements and does not satisfy the requirement on its own; an itemized receipt, invoice, or insurer Explanation of Benefits does.

Sampling does not satisfy the rule

The same 2003 ruling directly addresses a shortcut some employers try: reviewing only a sample of claims instead of every one. The IRS held that a debit-card program reviewing every transaction, either automatically or through a submitted receipt, satisfied Section 105(b); a program that used statistical sampling and only reviewed a percentage of claims, "by plan design," did not, because it did not "specifically limit reimbursements… to eligible medical expenses." Every claim needs a check. There is no compliant version of checking most of them.

Infographic titled The Two ICHRA Substantiation Requirements. Left panel, Annual Coverage Substantiation: confirms enrollment for the plan year, required before the plan year starts and for new hires before HRA coverage begins, satisfied by a signed attestation or a third-party document such as an insurance card. Right panel, Ongoing Substantiation: confirms coverage for the specific month, required before every reimbursement, satisfied by an attestation, a third-party document, or proof of direct premium payment. Footer credit: source 26 CFR 54.9802-4(c), U.S. Departments of the Treasury, Labor, and Health and Human Services, Individual Coverage HRA Model Attestations.

Here is what the ongoing requirement looks like for one real claim. An employee submits a $612 individual-market premium invoice for April, along with an ongoing-substantiation attestation confirming she had that coverage during April. The invoice shows the insurer's name, the billing period, and the amount, so it clears the three-element test on its own; the attestation confirms the coverage requirement. The claim gets reimbursed. Compare that to an employee who submits a bank statement line reading only "HEALTH INS PREM $612.00," with no service description, no billing period, and no attestation attached. That line fails on documentation grounds even before the coverage question comes up, and a compliant process rejects it and asks for the invoice instead, rather than paying it and hoping nobody asks.

What it costs to get this wrong

There are two distinct failures here, and employers researching this usually only hear about the smaller one. The first is a single bad reimbursement: pay a claim without proper substantiation and that specific payment can lose its tax-free status under Section 105(b), becoming taxable compensation to the employee instead of a tax-free HRA benefit, the same outcome the IRS described in Revenue Ruling 2002-80 for HRA-style "advance reimbursements" paid regardless of whether a real, substantiated expense backed them.

The second failure is bigger and plan-wide. An ICHRA is a self-insured group health plan for federal purposes, and a group health plan that fails to meet applicable requirements can trigger an excise tax under Internal Revenue Code Section 4980D. The IRS states the amount directly: "$100/day excise tax per applicable employee (which is $36,500 per year, per employee)." The statute itself is just as blunt: "the amount of the tax imposed… on any failure shall be $100 for each day in the noncompliance period with respect to each individual to whom such failure relates," per 26 U.S.C. §4980D. A ten-employee company with a plan-wide substantiation failure that runs uncorrected for a full year is looking at a maximum exposure of $365,000, not a single employee's reimbursement.

Illustrative maximum §4980D exposure by team size, one uncorrected year

$100/day, per affected employee = $36,500/employee/year (IRC §4980D; IRS.gov). Worst case, not a prediction — most plans self-correct long before this.

5-employee team $182,500

10-employee team $365,000

25-employee team $912,500

50-employee team $1,825,000

Illustrative maximum exposure only. Most compliance failures are corrected long before a full year elapses, and relief provisions exist for some small-employer situations. Not tax or legal advice.

Here's the math

Say a 15-employee company runs its ICHRA without a real ongoing-substantiation process for two months before catching the gap during an internal review. If that lapse counts as a compliance failure under Section 4980D for those two employees whose claims were paid without proper documentation, the maximum exposure is 2 employees × 60 days × $100/day, or $12,000. Catch it after one week instead of two months and the same math produces $1,400. The dollar amount scales directly with how long a real gap goes unnoticed, which is the entire argument for a process that checks every claim as it comes in rather than one that gets audited once a year.

Worth saying plainly: this is not the normal outcome of running an ICHRA. It is the outcome of running one with no substantiation process at all, for long enough that nobody catches it. The overwhelming majority of the more than 20,000 US businesses now offering an ICHRA or QSEHRA, per the HRA Council's 2026 industry report, never come near this number, because a working substantiation process is a solved administrative problem, not a legal gray area. The number exists to explain why "we'll figure out the paperwork later" is a bad plan, not to suggest ICHRA carries some unusual risk that group coverage does not.

A workflow that actually holds up

None of this requires inventing a process. It requires running the same short sequence, consistently, for every employee and every claim.

Before the plan year starts, collect the annual attestation. Use the federal model form or an equivalent; get the insurer name and coverage start date for the employee and every covered dependent.
For a new hire, collect it before their HRA coverage begins, not before their start date generally; the timing is tied to when HRA coverage actually starts, which can be mid-year.
Attach a short ongoing attestation to every reimbursement request, covering the specific month the expense was incurred, or accept an equivalent third-party document.
Require the three documentation elements on every receipt: the service or product, the date, and the amount. Reject anything missing one of them, such as a bare credit-card statement line.
Review every claim, not a sample. A spot-check design does not satisfy the rule, per Revenue Ruling 2003-43.
Ask employees to report a retroactive loss of coverage. If someone's individual policy lapses mid-year, expenses incurred after that lapse cannot be reimbursed, and the plan needs to know before it pays a claim, not after.
Keep records for at least as long as the plan year plus any applicable statute of limitations, the same retention discipline used for any other tax-favored benefit.

This is what a third-party administrator is actually for

The ongoing requirement repeats every claim, every month, for as long as the plan runs, which is why most first-time ICHRA employers hand this specific workflow to a third-party administrator rather than tracking it in a spreadsheet. Our guide to ICHRA administration cost in 2026 covers what that runs and what it includes.

How this fits your notice and enrollment calendar

Substantiation is easy to treat as a separate project from the rest of an ICHRA rollout, but the two run on the same calendar. Eligible employees generally need the required written notice at least 90 calendar days before the plan year begins, per HealthCare.gov's employer guidance, and that same notice is what tells an employee they need individual coverage or Medicare in place before their HRA coverage starts. An employer that sends the notice late and then also has no annual substantiation process is compounding one problem with another: employees enrolling in individual coverage at the last minute are exactly the group most likely to show up without a signed attestation or a coverage document on file when the plan year opens. Our guide to the ICHRA notice deadline covers the 90-day calendar in full; the substantiation form is one more thing to build into that same timeline, not a separate task to remember later.

The practical fix is to collect the annual attestation as part of enrollment itself, rather than as a follow-up step after employees have already started using their HRA. Most third-party administrator platforms bundle the two: an employee cannot finish enrolling without also confirming the coverage they are enrolling to pair with the HRA. Running it by hand, the sequence is the same, just manual: send the notice, collect the attestation before the plan year opens, and do not activate reimbursements for anyone whose attestation is missing.

The four mistakes that create real exposure

Where a substantiation process actually fails

Treating the annual attestation as the only check. It confirms coverage for the year; it does not substitute for the separate, per-claim ongoing requirement.
Reimbursing from a credit-card statement alone. A statement line shows an amount and sometimes a merchant name; it does not show the service and often not the date of service, so it fails the three-element test on its own.
Sampling claims instead of reviewing every one. The IRS drew this line explicitly in Rev. Rul. 2003-43; a design that only checks some claims does not meet the requirement, regardless of how small the unchecked share is.
Paying reimbursements that do not depend on a substantiated expense at all, such as automatic monthly payments unconnected to an actual claim. Rev. Rul. 2002-80 treats those as taxable, because Section 105(b) only excludes amounts "paid specifically to reimburse… expenses incurred," not payments owed regardless of whether an expense exists.

Substantiation isn't the fine print under ICHRA. It's the mechanism that makes the reimbursement tax-free at all. Get it right and it's a two-minute step. Skip it and you've quietly turned a benefit into payroll.

Mike Moore

None of this changes whether ICHRA saves you money

Substantiation is an administrative question: how you run the plan correctly once you have one. Whether an ICHRA saves your business money in the first place is a completely separate, county-level question, and it is worth not letting the paperwork obscure it. For the 2026 plan year, 1309 US counties price the individual-market benchmark premium below the small-group benchmark premium by at least $100 a month per employee, our qualifying threshold, built from Ideon rate data cross-verified against CMS public-use marketplace files. In those counties, estimated savings run from about 20% up to 63%, led by Ohio counties for the current dataset. Outside qualified counties, a traditional group plan is often still the better deal on pure cost, which is exactly why we publish the county data instead of a single national number.

Where the 2026 ICHRA savings case is strongest, nationally (top 8 qualifying counties)
County	State	Individual benchmark	Small-group benchmark	Est. savings	Est. annual / employee
Erie County	OH	$545	$1,474	63.0%	$11,145
Huron County	OH	$545	$1,474	63.0%	$11,145
Ottawa County	OH	$545	$1,474	63.0%	$11,145
Sandusky County	OH	$545	$1,474	63.0%	$11,145
Seneca County	OH	$545	$1,474	63.0%	$11,145
Wyandot County	OH	$545	$1,474	63.0%	$11,145
Morrow County	OH	$602	$1,612	62.7%	$12,121
Butler County	OH	$538	$1,427	62.3%	$10,675

These are the strongest cases in the dataset, not a typical result, and they are estimates from public and industry rate data, not quotes or a guarantee of savings for any specific employer. Your own county, and each of your employees' counties, is what actually matters; a national top-8 list is a starting point for understanding the shape of the opportunity, not a substitute for checking your own.

Stat card titled ICHRA Substantiation By The Numbers, 2026. 36,500 dollars: maximum Section 4980D excise tax exposure per employee per year for an uncorrected group health plan compliance failure, source 26 U.S.C. Section 4980D and IRS.gov. 2: separate federal substantiation requirements, annual and ongoing, source 26 CFR 54.9802-4(c). 3: documentation elements required on every claim receipt, service, date, and amount, source IRS Revenue Ruling 2003-43. 20,000 plus: U.S. businesses offering ICHRA or QSEHRA, source HRA Council Growth Trends for ICHRA and QSEHRA Volume 5, August 2026. Footer: ICHRA Savings, 2026, estimates not tax or legal advice.

How ICHRA Savings helps

We do not process your claims or hold your reimbursement funds; that work belongs to a licensed third-party administrator, and part of what we help employers do is pick one and understand what it costs. Where we help directly: checking whether your actual counties, not a national average, make the cost case for ICHRA in the first place, designing employee classes that hold up under the federal rules, modeling affordability so reimbursement amounts are set correctly before enrollment, and making sure the required employee notice and the substantiation workflow are both in place before your first paycheck cycle under the new plan, not scrambled together during it. None of the county math requires talking to anyone first. Check your county on the savings map: https://ichrasavings.com/ichra-savings-map/. If your renewal is already in hand and you have a deadline, it is worth a conversation: https://ichrasavings.com/book.

Questions employers actually ask

What is ICHRA substantiation?

It is the paperwork that keeps an ICHRA reimbursement tax-free. Federal regulations require an individual coverage HRA to confirm, through "reasonable procedures," that a participant is enrolled in individual health insurance or Medicare before the HRA pays anything on their behalf. There are two separate substantiation requirements: one confirming coverage for the plan year, and one confirming coverage before each specific reimbursement. Skip either one and the reimbursement can lose its tax-free treatment.

What documents satisfy the annual coverage substantiation requirement?

A signed attestation naming the insurer (or Medicare) and the coverage start date, or a document from a third party, such as an insurance card, a policy declaration page, or an enrollment confirmation from the exchange or the carrier. The federal Departments of the Treasury, Labor, and HHS publish a model attestation employers can use as-is; using it is considered good-faith compliance, though it is not the only acceptable method.

What has to happen before every reimbursement, not just once a year?

This is the ongoing substantiation requirement, and it is separate from the annual one. Before the HRA pays a claim, the participant has to show that they (or the family member whose expense is being reimbursed) had individual coverage or Medicare during the specific month the expense was incurred. In practice this is usually a short attestation submitted with each claim, though a document from the insurer or a record of direct premium payment also works.

What happens if an employee doesn't substantiate a claim?

The HRA cannot reimburse it. HealthCare.gov's own model notice for employees states this plainly: a participant who is no longer enrolled in individual coverage or Medicare cannot be reimbursed for expenses incurred during a month without that coverage, and a participant must report a retroactive termination of coverage back to the plan. An employer that reimburses anyway, without substantiation, risks the payment counting as taxable wages instead of a tax-free HRA benefit, under the same rule that governs every account-based health plan.

Is an attestation alone ever enough, or do we always need a receipt?

An attestation alone can satisfy either substantiation requirement under the federal rule; a signed statement is one of the recognized methods, alongside a third-party document. What is not acceptable is a design that pays out automatically without any check at all, or one that only checks a sample of claims rather than every claim. The IRS drew that exact line in Rev. Rul. 2003-43: a debit-card program that reviewed and substantiated every transaction passed; a program that used random statistical sampling and did not check every claim did not.

What is the actual financial risk if our substantiation process is sloppy?

Two separate risks, and employers tend to hear about only one. First, an individual reimbursement that was not properly substantiated for medical care can lose its tax-free status under Section 105(b), becoming taxable income to the employee (and potentially reportable, and subject to payroll tax adjustments). Second, and larger, a group health plan that fails to meet applicable federal requirements can trigger an excise tax under Internal Revenue Code Section 4980D of $100 per day, per affected individual, which is $36,500 per employee per year if left uncorrected, according to the IRS. Most ICHRA employers never see this because their process is sound; it exists specifically to make a sound process worth having.

Do dependents need their own substantiation, separate from the employee?

Yes. The federal model attestation forms treat each covered family member as a separate line: the employee signs on their own behalf, and the form is completed once per family member if more than one dependent is covered by the HRA. A spouse or child needs their own individual coverage or Medicare enrollment to be substantiated before their expenses can be reimbursed, exactly as the employee does.

Should we run substantiation ourselves or use a third-party administrator?

Most first-time ICHRA employers use a third-party administrator to run intake, attestations, and reimbursement, rather than tracking it by hand in a spreadsheet, because the ongoing requirement applies to every claim, every month, for as long as the plan runs. Our guide to ICHRA administration cost covers what that runs in 2026. Nothing about the substantiation rule itself requires an administrator; it requires a reasonable, consistently applied procedure, which is easier to keep consistent with software than without it.

How these figures are calculated

The regulatory text and requirements quoted in this article come directly from the Departments of the Treasury (IRS), Labor, and HHS's Individual Coverage HRA Model Attestations and Model Notice guidance documents, which cite the underlying final regulations at 26 CFR 54.9802-4, 29 CFR 2590.702-2, and 45 CFR 146.123/147.123. The three-element documentation standard and the sampling holding come from IRS Revenue Ruling 2003-43. The excise tax figure comes from the IRS's own "Employer health care arrangements" guidance page, cross-checked against the statutory text of 26 U.S.C. §4980D itself; both state the same $100-per-day figure independently. The 20,000-business adoption figure comes from the HRA Council's "Growth Trends for ICHRA & QSEHRA," Volume 5, published August 12, 2026, aggregating data from 17 HRA Council member organizations. County savings figures come from the same qualified-counties dataset behind every state page on this site (src/data/qualified_counties.json), built from Ideon rate data cross-verified against CMS public-use marketplace files for the 2026 plan year; a county enters the dataset when the individual-market benchmark premium runs at least $100 a month below the small-group benchmark premium, per employee.

Sources

U.S. Departments of the Treasury, Labor, and HHS, "Individual Coverage HRA Model Attestations" (annual and ongoing substantiation requirements; 26 CFR 54.9802-4, 29 CFR 2590.702-2, 45 CFR 146.123)
U.S. Departments of the Treasury, Labor, and HHS, "Individual Coverage HRA Model Notice" (employee-facing substantiation language; 90-day notice; premium tax credit interaction)
IRS, Revenue Ruling 2003-43 (three-element claim documentation standard; sampling does not satisfy Section 105(b))
IRS, "Employer Health Care Arrangements" ($100/day, $36,500/year Section 4980D excise tax)
26 U.S.C. §4980D (statutory text of the excise tax amount)
HealthCare.gov, "Individual coverage HRA" (employer requirements overview; reasonable-procedures language)
HRA Council, "Growth Trends for ICHRA & QSEHRA," Volume 5 (August 12, 2026; 20,000+ businesses, 500,000+ employees)
ICHRA Savings qualified-counties dataset (src/data/qualified_counties.json), built from Ideon rate data cross-verified against CMS public-use marketplace files, 2026 plan year

Important. This article is general educational information, not tax, legal, HR, or individualized financial advice. It describes federal substantiation requirements as of this article's publication date; the IRS, Department of Labor, and HHS can amend or reinterpret these rules, and your plan document controls its own specific procedures. Rate and savings figures are estimates drawn from public and industry data for the 2026 plan year and are not an offer of insurance, a quote, or a guarantee of coverage or savings. Taking an ICHRA generally means waiving the premium tax credit for that month unless the ICHRA is unaffordable under the IRS test. ICHRA Savings is a private, independent advisory service and is not connected with or endorsed by the U.S. government, HealthCare.gov, CMS, the Department of Labor, or the IRS. Consult a qualified tax advisor, benefits attorney, licensed third-party administrator, or licensed insurance professional before making decisions for your business.