The Memo. Although addressed to the division of Small Business and Self-Employed Employment Tax Policy, the Memo provides a useful reminder to employers of all sizes that all medical expenses paid for or reimbursed though an FSA debit card must be substantiated. Without breaking any new ground, the Memo highlights that the following practices – all involving debit cards – are noncompliant:

• Not requiring independent third-party information for charges that are self-certified.
• Not requiring independent third-party information if the charge is less than a specified dollar amount.
• Reimbursing all charges, and only requiring substantiation of a random sample of charges.
• Approving otherwise unsubstantiated charges to the debit card from certain favored providers such as certain dentists, doctors, and hospitals.

While the Memo provides examples of specific non-compliant substantiation practices, plan sponsors should keep in mind that the requirement to substantiate all medical expenses is one of seven requirements that apply health FSA debit cards.

Debit card rules. For a health FSA to permit the use of debit cards, the employer must follow seven mandatory rules:

1. The agreement from employee. Before receiving a debit card, an employee must agree in writing:

• to use the card only to pay for medical expenses of their own, or of their spouse or dependents,
• not to use the debit card for any medical expense that has already been reimbursed,
• not to seek reimbursement under any other health plan for any expense paid for with the debit card, and
• to obtain and retain sufficient documentation (e.g., a receipt describing the service or product, the date of service or sale, and the amount of the expense) for any expense paid with the debit card.

1. The card. The debit card must include a statement that the agreements described in section (1) above are reaffirmed each time the employee uses the card.
2. The amount. The amount available for reimbursement through the card must equal the amount elected by the employee less amounts paid or reimbursed for medical expenses incurred during the plan year.
3. Termination. The card must be automatically cancelled when the employee terminates FSA participation.
4. Limited points of sale. The employer must limit use of the card to (i) physicians, dentists, and vision care offices, hospitals, and other medical care providers, (ii) stores with the merchant category code for drugstores and pharmacies,[2] and (iii) stores that have implemented an inventory information approval system in accordance with the proposed cafeteria plan regulations.
5. Correction procedures. The employer must follow established correction procedures in the event of improper reimbursement.
6. Claim substantiation. The employer must substantiate claims in accordance with the cafeteria plan substantiation rules.

General substantiation and auto-substantiation rules. As described in the Memo, the Internal Revenue Code (the “Code”) requires substantiation of all medical expenses by an independent third party, with information describing the service or product, the date of service or sale, and the amount of the expense (e.g., an explanation of benefits from the insurance company; a receipt from a pharmacy relating to a prescription).

Health FSAs that utilize debit cards for the reimbursement of medical expenses may also rely on the auto-substantiation rules which, when properly administered, allow for many medical expenses to be paid for or reimbursed without verification from an independent third party. There are four broad categories of medical expenses that can be auto-substantiated:

• debit card charges made through an inventory information approval system that operates in compliance with the proposed cafeteria plan regulations;
• transactions where the dollar amount charged to the debit card equals an exact multiple of not more than five times the dollar amount of the copayment for the specific good or service purchased under the debit card holder’s health insurance plan;[3]
• recurring medical expenses that match previously approved expenses;
• expenses that are verified in real-time by the medical provider, merchant, or pharmacy benefit manager, at the point of sale (including electronically by email, the internet, intranet or telephone).

All other medical expenses paid or reimbursed through a debit card must be substantiated by an independent third party. In other words, for FSAs that offer debit cards for payment or reimbursement, substantiation by independent third-party information is required unless the auto-substantiation requirements are satisfied.

Recommendations regarding claims substantiation. To comply with the debit card claim substantiation rules, plan sponsors should:

• confirm that their cafeteria plan and related services agreements include language providing for independent third-party substantiation as a default in the event another approved method is not used;
• revise plan provisions that appear to endorse the use of noncompliant practices;
• verify that the cafeteria plan and related services agreements include auto-substantiation provisions that conform with the proposed cafeteria plan regulations summarized above;
• with respect to auto-substantiation through an inventory information approval system:
  - ensure that the services agreement provisions address the recordkeeping of information that the debit card processor's system collects about items purchased using the inventory control information (e.g., stock-
  keeping units, or SKUs);
  - become familiar with the audit rights typically contained in service agreements;
  - ask for representations that the system compares the information about the items purchased to an accurate list of items that qualify as expenses for medical care and will approve transactions only as to medical
  care expenses; and
  - verify that any attempts to use the card at non-participating merchants or service providers will fail.
• for auto-substantiation of copayment matches, ensure that the dollar amount of any transaction paid for with the debit card is limited to an exact multiple of up to five times the dollar amount of the copayment for the specific service. (The amount of copayment should be verified by the health plan’s current copayment schedule.)
• with respect to auto-substantiation of recurring expenses that match previously approved expenses, confirm that the plan requires a match as to the amount, the medical care provider, and the time period.

Conclusion. Although unwieldy, the debit card rules are more efficient than the alternative – requiring employees to submit independent third-party information with all the relevant data points for every medical expense to be reimbursed through a health FSA. In this context, the Memo also provides a useful reminder that auto-substantiation is the only compliance ‘shortcut’ for debit card claims substantiation – any other method runs afoul of the proposed cafeteria plan regulations.