Why do generic data quality tools miss bad NPI, NDC, DEA, and HCPCS codes?

Because generic tools check shape, not the rules each code is built on. A transposed NPI is still ten digits, so a pattern check passes it; only the Luhn check digit catches it. NDCs lose their meaning when hyphens are stripped, and HCPCS validity needs the current published list. The bad value then drops silently from the join.

Key points

  • An NPI's tenth digit is a Luhn check digit computed with the 80840 prefix, and a DEA number carries its own check digit, so a transposition passes any pattern check and fails the arithmetic.
  • Strip the hyphens from a 10-digit NDC and an illustrative value such as 1234567890 fits 4-4-2, 5-3-2, and 5-4-1, which pad to three different 11-digit codes.
  • TestGen Enterprise's Commercial Pharma set, shipped 27 August 2026, has twelve identifier tests. Its HCPCS coverage is J-codes only: J followed by four digits, checked for shape, not against the published code set.
  • Of the twelve, only Valid CMS POS checks membership in a published list. The others check format and check digits, so a failure is definite and a pass only narrows the possibilities.
  • A malformed identifier does not error. It fails the join, and every downstream number comes in quietly low.

Commercial pharma joins on identifiers most data tools have never heard of. NPI for the prescriber. DEA for controlled substances. NDC for the product, at two levels. ICD for the diagnosis. HCPCS J-codes for anything infused. Each has a published format with rules a general-purpose tool knows nothing about.

So the tool counts characters. Ten digits in the NPI column, so the column passes. The identifier post has the long version. Here is the short one.

Shape is not validity

CodeWhat a generic check confirmsWhat the spec requiresTestGen Commercial Pharma testWhat a pass does not prove
NPITen digitsLuhn check digit with the 80840 prefixValid NPI (Fail)That the NPI was issued or is active
DEATwo characters and seven digitsSeventh digit equals a weighted sum of the first six, mod tenValid DEA (Fail)That the registrant-type letter is one DEA assigns
NDCTen or eleven digitsSegment layout: 4-4-2, 5-3-2, or 5-4-1, padded to 5-4-2Valid NDC, Valid NDC Product, Valid NDC Any Form (Warning)That the product is active
HCPCSA patternMembership in the current published setValid HCPCS J-Code, J codes only (Warning)That the code exists; non-J codes are not covered
ICD-10-CMA patternICD-10-CM shape, dotted or undottedValid ICD-10 Diagnosis (Fail)That the code is in the current release

Test names and severities from the Commercial Pharma set, shipped in TestGen Enterprise on 27 August 2026.

The tests sort by how much a pass is worth. Valid NPI and Valid DEA run arithmetic, so a failure is not a matter of opinion. The NDC tests check the level a column stores. The ICD, J-code, and NCT tests check shape only. One test, Valid CMS POS, checks membership in a published list, because CMS Place of Service is small enough to carry inside the test.

NDCs break during normalization

NDC is where a warehouse loses a day a quarter. The FDA assigns ten digits in one of three layouts. Billing wants eleven in 5-4-2, which you get by padding the short segment with a leading zero. That works while the hyphens are there.

Strip them and the value loses its meaning. Take an illustrative 1234567890. As 4-4-2 it pads to 01234567890. As 5-3-2 it pads to 12345067890. As 5-4-1 it pads to 12345678900. Three products, the same ten characters.

So Valid NDC accepts the package-level and 11-digit forms your 867 files and claims carry, and rejects the bare 10-digit string on purpose. Even the loosest test, Valid NDC Any Form, still catches the leading zero Excel ate and the UNKNOWN someone typed into a required field. The 867 answer covers what that does to sales totals.

HCPCS needs a reference list

Be precise about HCPCS, because it is the code in your question with the least test coverage. TestGen covers J-codes: a J followed by four digits. That is the slice Part B buy-and-bill drugs run on, and it is a shape check. J0001 passes, and it is not a real code. A column that also carries the rest of HCPCS Level II will warn on every non-J value, which is a scoping decision rather than a data defect.

HCPCS requires validation against the current published set, which changes over time. No test ships that set. The method the testing post describes is to load a maintained reference dataset alongside your data and check it with Reference Match like any other table. The same goes for active NDCs and current ICD codes.

A bad code costs you rows, not an error

A malformed identifier does not fail the load. It fails the join. The claim with the wrong NPI or NDC drops out, and every downstream number comes in quietly low. The identifier post opens on a rep whose territory came up about 40 TRx short, because a transposed NPI had been dropping one prescriber from the join since March. A transposed NPI passes a ten-digit pattern check every time.

Missing values are a separate test. The identifier tests ignore nulls, because whether a field must be populated is a Required Entry question. In the 2024 Open Payments file, 13,890 practitioner records lacked an NPI, license state, or specialty.

None of this replaces Veeva Network or your MDM. MDM tells you what it could match. Identifier tests tell you what arrived broken, per column, before a match rate hides it. The HCP duplicates answer covers the matching side.

Turning it on

The Commercial Pharma set generates from a profiling run when a column’s name and its values agree, so a column named %npi% with ten-digit values gets Valid NPI. A column named code_3 gets nothing and needs a test added by hand. Each identifier test replaces the Pattern Match generated on the same column in that run.

The set ships in TestGen Enterprise, at $100 per user per month plus $100 per connection per month. The profiler underneath is open source, so you can see what your feeds look like before you decide.

Frequently asked questions

Short answers to the follow-up questions people ask next.

Why does a regex pass an invalid NPI?

Because a regex counts to ten and stops. An NPI's tenth digit is a Luhn check digit computed over the first nine plus the 80840 prefix, and transposing two adjacent digits breaks it. Hand-keying and OCR produce transpositions, which is why the identifier carries a check digit. A pattern test throws that design away and stays green on a value that joins to nothing.

Should NDCs be stored as 10 or 11 digits?

Store the level your column means, and keep the segments. 867 files and claims carry the 11-digit package form, padded to 5-4-2; product masters and formulary files carry the two-segment product form. A bare 10-digit NDC with its hyphens stripped is ambiguous, because three FDA layouts fit the same ten digits. TestGen's Valid NDC rejects that bare form for that reason.

Does TestGen validate every HCPCS code?

No. The Commercial Pharma set includes Valid HCPCS J-Code, which checks J followed by four digits, the slice of HCPCS Level II that Part B buy-and-bill drugs use. It checks shape only, so J0001 passes although it is not a real code. For the rest of HCPCS, or for real-code checks, load a maintained reference list and run Reference Match against it.

Does a passing NPI test mean the prescriber is real?

No. A Luhn-valid NPI is a number that could have been issued, not proof that one was. The Commercial Pharma tests never call NPPES, so they cannot say whether a provider is active or whether the NPI belongs to the prescriber the feed claims. A failure tells you something definite. A pass narrows the possibilities.

Is a missing NPI the same problem as a malformed one?

No, and it takes a different test. The identifier tests ignore empty and null values; whether a field must be populated is a Required Entry question. Both matter. In the 2024 CMS Open Payments file, 13,890 practitioner records lacked an NPI, license state, or specialty that the reporting rule requires, and 949,435 covered product records lacked an NDC or device identifier.

Talk to the people who test this data every week

DataKitchen builds and runs commercial data platforms for small and midsize pharma, with the tests in place from day one.