US DEA registration number: format, validation and detection

What it is

DEA numbers identify US practitioners and institutions registered to prescribe or handle controlled substances. Maskflare's detector is in the Healthcare (PHI) pack, so the HIPAA Safe Harbor, UK GDPR and Swiss nDSG health profiles include it.

In Maskflare this is the detector us_dea_number, labelled "US - DEA registration number", category health id number, in the Healthcare (PHI) pack.

Format and layout

• Two letters and seven digits with no separators: AB1234563.
• The first letter is one of A, B, C, D, E, F, G, H, J, K, L, M, P, R, S, T, U or X.
• The second character is a capital letter or 9.

How the check works

Add the first, third and fifth of the seven digits. Add the second, fourth and sixth, and double that sum. Add the two results; the last digit of the total must equal the seventh digit.

Worked example

1. Digits 1 2 3 4 5 6 and check digit 3.
2. First, third and fifth digits: 1 + 3 + 5 = 9. Second, fourth and sixth: 2 + 4 + 6 = 12, doubled to 24.
3. 9 + 24 = 33, whose last digit is 3, matching the check digit.

Valid and invalid examples

In running text the valid example reads, for instance, DEA AB1234563. The invalid one is left alone: a value that fails the validator is treated as an ordinary string.

Regex and validation caveats

• The check digit is a single decimal digit, so one in ten wrong numbers passes; the letter rules narrow it further.
• The detector has no context words, but the letters-then-digits shape is specific enough that few ordinary codes pass.
• The validator is case sensitive: it expects capital letters.

How to detect it in LLM traffic

US DEA registration number values appear in referral letters, lab reports, claims exports, appointment lists and clinical notes. When a clinician or administrator asks an assistant to summarise or rewrite such a document, the identifier goes with the text even though the task does not need it.

Maskflare scans the whole request, replaces each match with a token and, with response restoration on, puts the real value back into the answer for the person who is allowed to see it. Health identifiers sit in the Healthcare (PHI) pack, which is on in the default template without a country choice.

If you build the detection yourself

1. Strip spaces, dots and hyphens before running any arithmetic, but remember where they were so the original text can be replaced exactly.
2. Match the shape with a pattern anchored on word boundaries, so that a long digit string is not read as several shorter US DEA registration number candidates.
3. Apply the layout rules from the section above. This identifier has no check digit to recompute, so expect more look-alikes than with a checksum-based format.
4. Replace the value before the text is sent anywhere, and keep a mapping if the answer has to be restored afterwards.

How Maskflare handles it

• Protect now, Finance - Protect now and Healthcare: mask (a reversible token).
• Developer: not turned on.
• Monitor first: alert (counted, forwarded unchanged).

The available actions are mask (reversible token), redact, partial, hash, format-preserving encryption, generalize, alert and block. Masked values are kept encrypted for 30 days so that answers can be restored, then they expire; prompts and responses are not logged. The full list of detectors is in the detector reference.

Compliance profiles that include it

3 of the 6 compliance profiles include the Healthcare (PHI) pack, and applying them turns this detector on: HIPAA Safe Harbor, UK GDPR and Switzerland - nDSG health data. A profile is a floor: it never turns anything off or weakens a rule that is already stricter.