Healthcare Provider Identifier - Organisation

Detects Healthcare Provider Identifier - Organisation (HPI-O) values. The HPI-O is one of the four healthcare identifiers assigned under the Healthcare Identifiers Act 2010 (Cth); it identifies a healthcare provider organisation such as a hospital, medical practice, pathology or imaging laboratory or pharmacy, and is used in My Health Record, secure messaging and NASH transactions. It is a 16-digit number starting with the prefix 800362; the official format carries a Luhn check digit (not enforced here, matching the sibling au-individual-healthcare-identifier and au-hpi-individual classifiers). Labelled HPI-O references inside provider directories without a value are left to global-top500-337-provider-identifier-records.

Type: regex
Engine: universal
Confidence: medium
Confidence justification: Medium: the 800362 prefix gives strong structural specificity to a 16-digit number, but the Luhn check digit is not enforced, so other long numbers that happen to start 800362 surface at 65 until an HPI-O label is present.
Jurisdictions: au
Regulations: Healthcare Identifiers Act 2010 (Cth), My Health Records Act 2012 (Cth), Privacy Act 1988 (Cth)
Frameworks: ISO 27001
Data categories: healthcare, business-identifier
Scope: narrow
Risk rating: 4
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Compatible, Netskope: Compatible

Pattern

\b800362\d{10}\b

Corroborative evidence keywords

HPI-O, HPIO, Healthcare Provider Identifier - Organisation, HI Service, NASH, [object Object], Individual Healthcare Identifier, healthcare identifier, [object Object], HPI-I, provider identifier, AHPRA, registration number, prescriber number, PBS prescriber, pharmaceutical benefits, Medicare provider, provider number, [object Object], medical record number (+8 more)

Proximity: 300 characters

Should match

8003620000000001 — 65 tier - bare 800362 value with no context (discovery only)
8003629999999999 — 65 tier - upper range bare value (discovery only)
HPI-O: 8003621234567890 — 75 tier - labelled HPI-O without organisation context
Organisation details - Riverbend Medical Practice HPI-O: 8003620000000019 Responsible officer: Dr K Teston NASH certificate renewal due 30/11/2026; listed in the Healthcare Provider Directory. — 85 tier - practice record with HPI-O, responsible officer, NASH and Healthcare Provider Directory context
Pathology laboratory registration (HI Service): Healthcare Provider Identifier - Organisation 8003621111111111 linked as a network organisation under the HHS seed. — 85 tier - pathology laboratory HPI-O with HI Service context

Should not match

8003610000000001 — Wrong prefix (800361 is HPI-I)
8003600000000001 — Wrong prefix (800360 is IHI)
800362000000001 — Too few trailing digits (9 instead of 10)
80036200000000020 — Too many trailing digits (11 instead of 10)
Invoice tracking number 8003621234567890 for shipment 44 — Valid-shaped non-health number must remain discovery-only

Known false positives

Long numeric sequences in unrelated contexts (tracking numbers, serial codes, account numbers) that start 800362. Mitigation: The bare value is discovery-only; enforce tiers need an HPI-O label and non-health numeric context is excluded.
Public directory listings. HPI-Os are published to participating providers through the Healthcare Provider Directory. Mitigation: Low risk rating and OFFICIAL label reflect that the identifier is an organisational reference, not a secret.