Opioid treatment programs

Payers and suppliers act on email in your program's name.

A note with new remittance or bank details is the pattern to watch. Attackers read your domain. We read it first and show you what is open.

Attackers now use AI to read a program the way a search engine does: the website, directories, search results and what AI assistants say. Each finding we hand you is human-verified before your assessment is released.

Request your program’s reading How we read a domain
Zero accessNot a pen testHuman-verified72 hours to your documents
Rules that apply to youMapped per finding
HIPAA
Safeguards and notice for client health information
FTC Act Section 5
Unfair or deceptive security practices
State breach notification laws
Notice to affected residents
201 CMR 17.03
Massachusetts residents: a yearly review of your security program
Also in Canada
PHIPA s. 12, PIPEDA Principle 4.7, PIPEDA s. 10.1 and 10.3
Each finding mapped to the rule it touches in the Rules and Insurance Briefing, so you can show your regulator what you checked and fixed.
For opioid treatment programs

What we read for opioid treatment programs

  • The certificate your website answers with, seen externally: its name, its dates and who issued it.
  • The headers and cookies your website sends to every visitor, seen externally.
  • Common addresses for configuration files, code folders and cloud storage, read externally; nothing inside is touched.
  • The scripts your front page loads, read externally for keys and passwords left in them.
  • The versions your website and its script libraries show, read externally.
  • Read with the assessment. What AI assistants answer about your program. A client who asks an AI assistant about your program trusts the answer it gives. Assistants build those answers from pages they crawl. A look-alike address an attacker could register can be built to be crawled: its robots file invites the AI crawlers in and its page claims your name. Attackers manipulate AI answers to send your paying and enquiring clients to their own look-alike page, web address, sign-in page, phone number or email. In 2025, asked for the sign-in pages of 50 brands, an AI assistant gave addresses the brand did not control one time in three. The check is built to ask six assistants: Claude, ChatGPT search, Gemini, Perplexity, Grok and Copilot, through Bing. Monitoring asks again every week and tells you when an impostor's phone or address is in an answer. Source: Netcraft research, read on 4 November 2026.

The rule, from its source: What does the HIPAA Security Rule ask a health care practice to do?

How the fraud works: Business email compromise, explained

Request your program’s reading

Up to 350 look-alike addresses an attacker could register from your name, checked on each assessment.

75 techniques attackers use against programs like yours, each checked externally on every assessment.

16 routes to your money, your clients, your accounts and your name, checked end to end on each assessment.

Attackers run AI agents in swarms: many at once, each trying the combinations of these routes against any program it can read. We read for the combinations first.

Everything LeakTrace reads about a program, area by area, with what the program receives and what we never do: Capabilities

How it reaches you

Where an attack uses a look-alike address an attacker registered from your name, the first sign is the registration. Under the watch, LeakTrace reads the look-alike addresses an attacker could register from your name every hour and the day's public list of new registrations each night.

Four steps from left to right. Someone registers a look-alike address from your name, sets up mail or a sign-in page on it, then a message or a call reaches your people and money or a code goes to them. The watch reads the first two steps. The third is your own step: a call back on a number you already have and telling your clients how you ask for payment.

The watch reads here 1 Someone registers a look-alike address 2 They set up mail or a sign-in page on it 3 A message or a call reaches your people 4 Money or a code goes to them Your step: call back, tell clients The watch reads here 1 Someone registers a look-alike address 2 They set up mail or a sign-in page on it 3 A message or a call reaches your people 4 Money or a code goes to them Your step: call back, tell clients The watch reads here 1 Someone registers a look-alike address 2 They set up mail or a sign-in page on it 3 A message or a call reaches your people Your step: call back, tell clients 4 Money or a code goes to them

  1. Step 1

    A look-alike address is registered

    Someone registers a domain made from your program's name: one letter changed, a word added or another ending.

    Anyone can see: The registration record and, once a certificate is issued for it, its entry in the public certificate logs.

    What LeakTrace does: Under the watch, a name that shows is dated on your record, with what it showed.

  2. Step 2

    Mail or a sign-in page is set up on it

    Mail is switched on for the name, or it answers with a page that looks like your website or a sign-in page.

    Anyone can see: The mail record and the page it answers with.

    What LeakTrace does: LeakTrace reads its mail and its page and grades it. With the watch, or for the names the look-alike response covers, we send the takedown request in your program's name once you approve it. The registrar decides. Your page shows its answer once it is recorded.

  3. Step 3

    The message or the call reaches a person

    An email from it reaches someone at your program or one of your clients. Or a caller who says they are from IT support sends someone to the sign-in page and asks for the code.

    Anyone can see: Nothing. It happens inside a mailbox or on a phone.

    What LeakTrace does: LeakTrace never goes inside a mailbox or a call. This is the one step only your program can take.

    Your step: Tell your clients that you never change payment details by email. Any such note gets a call to a number they already have. Confirm every change of payment details by a call to a number you already have. Sign in with a passkey where your mail system offers one: a code can be passed on from a fake page. A passkey cannot.

    How to set up your step

    Tell your clients how you ask for payment. Put one line on the invoice footer and the first email you send: "We never change payment details by email. Call the number you already have for us."

    What changes
    Your clients read one extra line. A request that breaks it is easy to spot.
    Stays on?
    Yes. The line can stay on every letter, invoice and first email.
    To undo
    It is wording, not a setting. Take the line out of those templates and it is gone.

    Confirm every change of payment details by a call. Any new bank details, from anyone, are confirmed by a call to a number you already have for that person. Never to a number written in the message.

    What changes
    A payment with changed details waits for one short call.
    Stays on?
    Yes. It is a standing rule for everyone who handles payments.
    To undo
    It is a rule, not a setting. It ends the day you stop asking for the call.

    Sign in with a passkey where your mail system offers one. Each person adds a passkey in their email account's security settings, on the phone or computer they use.

    What changes
    Signing in can use a fingerprint, a face or the device PIN. A fake sign-in page gets nothing it can pass on.
    Stays on?
    Yes. It is meant to stay on for every account.
    To undo
    A passkey is removed in the same security settings. Sign-in then asks for the password and code again.

  4. Step 4

    The money or the code moves

    A payer sends a remittance to new bank details, or someone at your program pays a pharmacy supplier invoice to new bank details, or a code passed on lets someone else sign in.

    Anyone can see: Nothing, until someone notices.

    What LeakTrace does: Under the watch, the name's first two steps are dated on your record: when it appeared and what it showed.

    If a payment went to new details, the first call is to the bank, that day.

    How to make that call

    If a payment went to new details, call the bank that day. Call the bank's fraud line on the number printed on your card or statement, that day. Then tell the police.

    What changes
    The bank can attempt to recall the payment.
    Stays on?
    It is a one-time step, not a setting.
    To undo
    There is nothing to undo.

Where an attack uses a look-alike address an attacker registered from your name, we see it first.

Everything LeakTrace covers for opioid treatment programs
When you must report

The reporting deadlines that apply to you.

US, health
60 days
HIPAA Breach Notification Rule

Notify affected clients of a breach of unsecured health information.

US, every state
Varies by state
State breach notification laws

Notify affected residents when certain personal information is breached. Timing and content differ.

Canada, federal
As soon as feasible
PIPEDA

Report a breach that creates a real risk of significant harm to the Privacy Commissioner and tell the people affected.

Ontario, health
First reasonable opportunity
PHIPA

Tell the client and report to the Information and Privacy Commissioner when the thresholds are met.

Your deadline
60 days
HIPAA Breach Notification Rule

A summary of published rules, not legal advice. The Rules and Insurance Briefing names the rules that apply to you.

What changes on your external layer

Your program keeps changing. So does what an attacker can see.

  • 01A new vendor or tool is allowed to send as youOne more sender an attacker can pose as.
  • 02Your mail moves to a new providerThe records that refuse forged mail can break in the move.
  • 03A new portal or subdomain goes liveA new sign-in page anyone can reach.
  • 04A certificate lapsesBrowsers warn your clients and a copy looks as trustworthy as you.
  • 05Your addresses turn up in a fresh breachReused passwords become a way into the mailbox.
  • 06A look-alike of your name is registeredSomeone can now write to your clients as you.
Every houremail settings, look-alike addresses and new host names.
Every dayeverything else.
Within a daynewly exploited flaws matched to your website’s software, with an alert the same day.

The first month of monitoring comes with the assessment.

02 · What you receive

Human-verified. The full watch, the proof for every finding and the fix.

1
Owner Summary and Action Brief
For the owner
2
Technical Evidence and Findings
Each finding, with its fix
3
Rules and Insurance Briefing
Privacy rules and insurer questions
4
Assessment Record
Dated record, issued by LeakTrace Inc.

For a health practice: the assessment covers what your program shows the public internet: its email, its website, look-alike domains and addresses at your domain in breach data. It is not a HIPAA security risk analysis and it does not look at client records or internal systems.

What the fourth document is. A dated record of what was read externally, verified by a person at LeakTrace before release. LeakTrace Inc. issues it as a company, with a reference and a fingerprint anyone can check at getleaktrace.com/verify/. No individual signs it. It is not a certification, not a penetration test, not legal or compliance advice and not a statement about your internal systems.

A recorded walkthroughA short video of your own dashboard, made at release.
The first month of monitoringYour domain and its addresses watched: email settings, look-alikes and new host names re-checked every hour, with an alert within the hour to a named contact; the rest daily.

We close it: We give you the fix for each finding and re-check externally until it is closed.

The one change we can make ourselves is to your email records and only when you approve each step, where your DNS host allows it.

Where it does not, you get the exact records to paste.

Your evidence pack:

  • an owner summary
  • the technical evidence with the fix for each finding
  • a rules and insurance briefing
  • a dated assessment record

It doubles as your insurance renewal evidence pack:

  • the external questions insurers commonly ask at renewal, each shown with its evidence
  • forged-email protection where we reach your DNS host, one click per step
  • the Rules and Insurance Briefing, which sets each of your findings beside the plain terms a renewal application uses

The assessment comes with an AI security agent on your dashboard: ask it about any finding in plain English and it answers from your own program's findings.

Our AI agents operate externally. They never log in, never install anything and never touch your internal systems. They change nothing by themselves: you approve each change to your email records.

What each AI agent does and what it can never do.

03 · Request your program’s reading

See what is open before anyone else does.

We read externally, find each way in first and show it with a check anyone can re-run. No access, nothing tested, no obligation.

What we readPublic sources only
Who sees itYou alone
Delivery72 hours from confirmation
Meeting firstNone

See a sample reading → An invented program, so you see what arrives before you ask for yours.

Reading requestPrivate
Problem: Enter your program's name.
Problem: Enter your name.
Problem: Enter a full address, like [email protected].
Problem: That does not look like a website. Try yourdomain.com.

A person reads every request. Your external reading comes by email within 72 hours from [email protected]. Privacy