German health insurance number (KVNR): format, validation and detection

What it is

The Krankenversichertennummer identifies a person insured in the German statutory health insurance. Maskflare's detector for it sits in the Healthcare (PHI) pack, so it is covered by the HIPAA Safe Harbor, UK GDPR and Swiss nDSG health profiles that include that pack.

In Maskflare this is the detector de_kvnr, labelled "Germany - Health insurance number (KVNR)", category health id number, in the Healthcare (PHI) pack.

Format and layout

• A capital letter A to Z, then nine digits, for example A123456780.
• Only the unchangeable part of the number is checked: letter, eight digits and the check digit.

How the check works

Turn the letter into two digits (A is 01), append the eight digits after it, and weight the ten digits 1, 2, 1, 2 and so on. When a product has two digits, add them together. Add everything up; the remainder after dividing by 10 is the check digit.

Worked example

1. A becomes 01, so the ten digits are 0 1 1 2 3 4 5 6 7 8.
2. Weighted 1, 2, 1, 2 and so on, and with two-digit products reduced to their digit sum: 0, 2, 1, 4, 3, 8, 5, 3, 7, 7.
3. The total is 40, and 40 divided by 10 leaves 0, the last digit of the example.

Valid and invalid examples

In running text the valid example reads, for instance, Versichertennummer A123456780. The invalid one is left alone: a value that fails the validator is treated as an ordinary string.

Regex and validation caveats

• The letter must be a capital A to Z at the start, with no spaces inside the ten characters.
• The detector sits in the health pack, which is on by default in Maskflare's default template, unlike country packs that follow the organisation's primary countries.
• A capital letter plus nine digits is a plain shape with no keyword to back it, so the check digit is the main filter.

How to detect it in LLM traffic

German health insurance number (KVNR) values appear in referral letters, lab reports, claims exports, appointment lists and clinical notes. When a clinician or administrator asks an assistant to summarise or rewrite such a document, the identifier goes with the text even though the task does not need it.

Maskflare scans the whole request, replaces each match with a token and, with response restoration on, puts the real value back into the answer for the person who is allowed to see it. Health identifiers sit in the Healthcare (PHI) pack, which is on in the default template without a country choice.

If you build the detection yourself

1. Strip spaces, dots and hyphens before running any arithmetic, but remember where they were so the original text can be replaced exactly.
2. Match the shape with a pattern anchored on word boundaries, so that a long digit string is not read as several shorter German health insurance number (KVNR) candidates.
3. Apply the layout rules from the section above. This identifier has no check digit to recompute, so expect more look-alikes than with a checksum-based format.
4. Replace the value before the text is sent anywhere, and keep a mapping if the answer has to be restored afterwards.

How Maskflare handles it

• Protect now, Finance - Protect now and Healthcare: mask (a reversible token).
• Developer: not turned on.
• Monitor first: alert (counted, forwarded unchanged).

The available actions are mask (reversible token), redact, partial, hash, format-preserving encryption, generalize, alert and block. Masked values are kept encrypted for 30 days so that answers can be restored, then they expire; prompts and responses are not logged. The full list of detectors is in the detector reference.

Compliance profiles that include it

3 of the 6 compliance profiles include the Healthcare (PHI) pack, and applying them turns this detector on: HIPAA Safe Harbor, UK GDPR and Switzerland - nDSG health data. A profile is a floor: it never turns anything off or weakens a rule that is already stricter.