Bug: DE_HEALTH_INSURANCE (KVNR) checksum rejects valid values (factor sequence mismatch vs §290 SGB V Anlage 1)

[602Ann]

Describe the bug
The checksum validation for DE_HEALTH_INSURANCE (KVNR) appears to use a factor sequence that is inconsistent with the official §290 SGB V Anlage 1 method, causing valid KVNR examples to be rejected.

To Reproduce

1. Go to presidio-analyzer/presidio_analyzer/predefined_recognizers/country_specific/germany/de_health_insurance_recognizer.py.
2. Run the current validate_result checksum logic for these sample KVNRs:
   • A000500015
   • C000500021
3. Observe validation result.

Expected behavior
Both sample values should validate as true according to the official KVNR Prüfziffer method (letter -> 01..26, alternating factors 1,2,1,2,..., cross-sum, sum % 10 equals check digit).

Screenshots
N/A.

Additional context
Current implementation uses factors [2,9,8,7,6,5,4,3,2,1].
Official references:

• https://www.gkv-datenaustausch.de/kvnr/kvnr.jsp
• https://www.gkv-datenaustausch.de/media/dokumente/kvnr/Anlage_1_20230102_Pruefziffernberechnung-KVNR.pdf

This was noticed while validating German health insurance letter extraction after PR #1909.

[MvdB]

Thanks for the detailed report and the Anlage 1 reference — confirmed the bug. The previous validate_result applied weights [2,9,8,7,6,5,4,3,2,1], which is not the algorithm from § 290 SGB V Anlage 1 (Stand 02.01.2023) that you supplied.
The spec uses alternating factors [1,2,1,2,1,2,1,2,1,2] on the 10 effective digits (2-digit letter ordinal + 8 data digits), digit sum on any product ≥ 10, and sum mod 10 against the check digit at position 10. Opened a PR to fix it: #1974 .

Both samples you supplied now validate as expected:

• A000500015 → A=01, expanded 0100050001, products 0,2,0,0,0,10,0,0,0,2, cross-sums 0,2,0,0,0,1,0,0,0,2 = 5 → PZ 5 ✓
• C000500021 → C=03, expanded 0300050002, products 0,6,0,0,0,10,0,0,0,4, cross-sums 0,6,0,0,0,1,0,0,0,4 = 11 → 11 mod 10 = 1 → PZ 1 ✓

[MvdB]

Small update: the KVNR fix is now part of a broader DE-recognizer rework in #1990 (supersedes #1974, which I've closed). The algorithm and worked examples in the comment above remain correct — just the PR number changes. #1990 also fixes the other DE recognizers that I verified against primary sources during the follow-up audit and will close this issue when merged.