An HSA card is a Visa or Mastercard debit card. Whether yours can take one comes down to a four-digit code

More of your customers are carrying a health savings account card this year. From 1 January 2026 the IRS treats bronze and catastrophic health plans as HSA-compatible, and people in certain direct primary care arrangements can now contribute to an HSA and pay the arrangement's periodic fees from it. The 2026 contribution limit is $4,400 for self-only cover and $8,750 for a family, and a health FSA can take $3,400.

The card in the customer's hand is a Visa or Mastercard debit or prepaid card, and Visa says employees can use it "wherever Visa Debit cards are accepted". What that sentence leaves out is that the issuer decides whether to approve it, and the issuer looks at what kind of business you are. There are three ways to get approved, and which one applies to you is set mostly by your merchant category code (MCC), the four-digit code your processor assigns when it opens your account.

Route one: you are a healthcare provider

The IRS's 2006 guidance let health FSA cards work at merchants whose category codes relate to health care, "such as physicians, pharmacies, dentists, vision care offices, hospitals, and other medical care providers". The IRS names categories of provider rather than codes, and the most usable lists come from the processors. Fiserv's CardPointe developer documentation lists the codes that "can accept FSA debit cards by default" without registering anywhere, including:

• 8011 doctors and physicians, 8021 dentists and orthodontists, 8031 osteopaths
• 8041 chiropractors, 8042 optometrists and ophthalmologists, 8043 opticians and eyeglasses
• 8049 podiatrists, 8050 nursing and personal care facilities, 8062 hospitals
• 8071 medical and dental laboratories, 8099 health practitioners not elsewhere classified

Stax's documentation gives the same codes and adds hearing aid stores (5975) and orthopedic goods (5976), with ambulance services and counseling marked as dependent on the plan administrator. If your practice has one of these codes you are usually already set. If it has a generic code, such as a business-services or retail code picked at sign-up, expect the cards to decline until the code is changed. Changing it is a request to your processor, not a setting you control: Stax asks for a support ticket, and Square tells you to contact its Customer Success team.

There is a catch for practices that also sell things. Stripe's support article says that a healthcare business which sells any products, giving "an ophthalmologist who also sells glasses" as its example, is subject to the same requirements as a retailer: product registration, IIAS certification and registration with SIGIS, Visa and Mastercard. Fiserv's list, by contrast, puts opticians among the codes accepted by default. The sources disagree, so an optical shop or a clinic with a retail counter should ask its processor which rule it applies before relying on either.