Swiss EPR-SPID: format, validation and detection

What it is

The EPR-SPID identifies a person in the Swiss electronic patient record (EPD/DEP). It sits in the Switzerland pack as a health ID, and the Swiss nDSG health profile includes it. The validator is based on the CH Core identifier definition referenced in its source.

In Maskflare this is the detector ch_epr_spid, labelled "Switzerland - Electronic patient record id (EPR-SPID)", category health id number, in the Switzerland pack.

Format and layout

• 18 digits.
• The first eight digits are fixed at 76133761.
• The last digit is a GS1 check digit.

How the check works

GS1 modulus 10 over the first seventeen digits: weight them 3 and 1 alternately, counting from the digit next to the check digit, add them up, and the check digit brings the total to the next multiple of 10.

Worked example

1. Seventeen digits before the check digit: 7 6 1 3 3 7 6 1 1 2 3 4 5 6 7 8 9.
2. From the right they are weighted 3, 1, 3, 1 and so on, which totals 163.
3. The next multiple of 10 is 170, so the check digit is 7, the last digit of the example.

Valid and invalid examples

In running text the valid example reads, for instance, EPR-SPID 761337611234567897. The invalid one is left alone: a value that fails the validator is treated as an ordinary string.

Regex and validation caveats

• The fixed 76133761 prefix does most of the work: very few other 18-digit numbers begin with it.
• The detector has no context words, so it needs none of the words patient record or EPD nearby.
• A valid form does not mean the number belongs to anyone.

How to detect it in LLM traffic

Swiss EPR-SPID values appear in referral letters, lab reports, claims exports, appointment lists and clinical notes. When a clinician or administrator asks an assistant to summarise or rewrite such a document, the identifier goes with the text even though the task does not need it.

Maskflare scans the whole request, replaces each match with a token and, with response restoration on, puts the real value back into the answer for the person who is allowed to see it. Health identifiers sit in the Healthcare (PHI) pack, which is on in the default template without a country choice.

If you build the detection yourself

1. Strip spaces, dots and hyphens before running any arithmetic, but remember where they were so the original text can be replaced exactly.
2. Match the shape with a pattern anchored on word boundaries, so that a long digit string is not read as several shorter Swiss EPR-SPID candidates.
3. Run the check from the section above. A failing check is almost always a typo or a made-up value; a passing one removes most look-alikes.
4. Replace the value before the text is sent anywhere, and keep a mapping if the answer has to be restored afterwards.

How Maskflare handles it

• Protect now, Finance - Protect now, Healthcare and Developer: mask (a reversible token) when Switzerland is a primary country.
• Monitor first: alert (counted, forwarded unchanged) when Switzerland is a primary country.

The available actions are mask (reversible token), redact, partial, hash, format-preserving encryption, generalize, alert and block. Masked values are kept encrypted for 30 days so that answers can be restored, then they expire; prompts and responses are not logged. The full list of detectors is in the detector reference.

Compliance profiles that include it

One compliance profile includes the Switzerland pack, and applying it turns this detector on: Switzerland - nDSG health data. A profile is a floor: it never turns anything off or weakens a rule that is already stricter.