How to validate an NPI number (the check-digit algorithm)

An NPI isn't just 10 random digits — the last digit is a check digit, mathematically derived from the first nine using a variant of the Luhn algorithm (the same family of checksum used on credit card numbers). That means you can catch a mistyped or transposed NPI before you ever hit a registry lookup, which matters if you're validating hundreds of numbers in a batch import.

The algorithm

1. Take the first nine digits of the NPI (drop the check digit — the 10th).
2. Prepend the fixed constant prefix "80840" — a five-digit identifier reserved specifically for the NPI system inside the broader ISO/IEC 7812 issuer identification scheme Luhn checksums come from. This gives you a 14-digit string.
3. Run the standard Luhn algorithm across all 14 digits: starting from the rightmost digit and moving left, double every second digit; if doubling produces a number over 9, subtract 9 from it; sum every digit in the string (doubled and un-doubled).
4. The correct check digit is whatever single digit, added to that sum, brings the total to the next multiple of 10.

A worked example

Take the NPI 1245319599. The first nine digits are 124531959. Prepend the constant prefix: 80840124531959 — 14 digits. Running the Luhn doubling-and-summing rule across those 14 digits gives a total of 71. The next multiple of 10 above 71 is 80, so the check digit has to be 9 — and sure enough, the actual 10th digit of 1245319599 is 9. The number checks out structurally, meaning it's well-formed even before you look it up against the registry.

Why validate before you submit

A single transposed digit still produces a 10-digit number, and without the check-digit test it looks exactly as plausible as a real one — you won't know it's wrong until a claim bounces or a credentialing record fails to match. Running the check-digit algorithm locally, before a registry call, is nearly free and catches typos immediately; it's the first line of defense, with the live registry lookup as the second.

Validating in bulk

Checking NPIs one at a time in a browser doesn't scale past a handful of records. For a provider roster, an EDI 837 claim batch, or a credentialing file with hundreds of NPIs, you want a single call that returns pass/fail (and, ideally, the reason) for every number at once, rather than looping a single-lookup endpoint yourself.

For developers and agents

The check-digit algorithm above is easy to implement client-side in any language — it's pure arithmetic, no network call required — and it's worth doing as a first-pass filter. For the registry confirmation, `POST /api/v1/validate` accepts arrays of both `npis` and `icd10` codes and validates a whole claim's worth of identifiers in one request; batches over a single item are a paid-plan feature. If you're wiring this into an agent, the same check is exposed as the `validate_codes` tool over MCP — see the developer docs for the full setup.