16 Oct 2026 · HIPAA Journal
American Collection Medical Agency patients agreed to a $6.4 million settlement resolving claims over a major historical data breach. The cyberattack targeted AMCA's web …
Medical clinics
Patient records sit behind a password. Your clinic addresses turn up in old breaches.
Patient portals, referral inboxes and clinic addresses in old breaches. We read them from outside first and name what to close before it is used against a patient.
Attackers now use AI to read a clinic from outside the way a search engine does: the website, directories, search results and what AI assistants say. Each finding we hand you is human-verified before your assessment is released.
Outside reads onlyNot a pen testHuman-verified72 hours to your documents
Rules that apply to youMapped per finding
FTC Act Section 5
Unfair or deceptive security practices
HIPAA
Safeguards and notice for patient health information
State breach notification laws
Notice to affected residents
Also in Canada
PIPEDA Principle 4.7, PHIPA s. 12, PIPEDA s. 10.1 and 10.3
Each finding mapped to the rule it touches in the Rules and Insurance Briefing, so you can show your regulator what you checked and fixed.
When you must report
The reporting deadlines that apply to you.
US, health
60 days
HIPAA Breach Notification Rule
Notify affected patients of a breach of unsecured health information.
Canada, federal
As soon as feasible
PIPEDA
Report a breach that creates a real risk of significant harm to the Privacy Commissioner, and tell the people affected.
Quebec
Promptly
Quebec Law 25
Notify the Commission d'accès à l'information and the people concerned of an incident that risks serious injury, and keep a register of every confidentiality incident.
Ontario, health
First reasonable opportunity
PHIPA
Tell the patient, and report to the Information and Privacy Commissioner when the thresholds are met.
Your deadline
60 days
HIPAA Breach Notification Rule
A summary of published rules, not legal advice. The Rules and Insurance Briefing names the rules that apply to you.
With your patients
Patients choose a clinic they trust with their records. A letter saying their chart was exposed is the one they remember.
01 · This week, across all clinics
Nothing reported for this sector this week. What attackers used elsewhere, and what we check for it.
14 Oct 2026 · Security Affairs
Way in
A known flaw in software the victim ran.
We check
Software versions your site advertises and known flaws in them.
14 Oct 2026 · BleepingComputer
Way in
Email made to look like it came from a trusted sender.
We check
Whether anyone can send mail that passes as your domain.
Recent cases in your line of work
Payment fraud, from the public record.
23 Jul 2026
A man who laundered the money was sentenced in July 2026 in a case where a hacker got into a furniture supplier's email system, posed as its staff, changed the bank details a children's hospital system held for it, and had $5.3 million wired. About $4 million was recovered.
Each case is from the public source linked under it, in that source's own terms. LeakTrace had no part in any of them.
Your outside changes
What changes after your assessment, and how often we look.
- 01A new vendor or tool is allowed to send as you.
- 02Your mail moves to a new provider.
- 03A new portal or subdomain goes live.
- 04A certificate lapses.
- 05Your addresses turn up in a fresh breach.
- 06A look-alike of your name is registered.
On monitoring: email settings, look-alikes and new host names hourly; everything else daily, with newly exploited flaws matched to your website’s software within a day and an alert the same day. The first month of monitoring comes with the assessment.
02 · Featured research
Medical clinics · 5 min · Aug 2026
Business data exposure briefing: July 2026
The kinds of business data that are routinely stolen and resold, and what a business can check from the outside today.
03 · What you receive
Human-verified. The full watch, the proof for every finding, and the fix.
1
Owner Summary and Action Brief
For the owner
2
Technical Evidence and Findings
Each finding, with its fix
3
Rules and Insurance Briefing
Privacy rules and insurer questions
4
Assessment Record
Dated record, issued by LeakTrace Inc.
For a medical clinic: the assessment covers what your clinic shows the public internet: its email, its website, look-alike domains and addresses at your domain in breach data. It is not a HIPAA security risk analysis, and it does not look at patient records or internal systems.
What the fourth document is. A dated record of what was read from outside your clinic, verified by a person at LeakTrace before release. LeakTrace Inc. issues it as a company, with a reference and a fingerprint anyone can check at getleaktrace.com/verify/. No individual signs it. It is not a certification, not a penetration test, not legal or compliance advice, and not a statement about your internal systems.
A recorded walkthroughA short video of your own dashboard, made at release.
The first month of monitoringYour domain and its addresses watched: email settings, look-alikes and new host names re-checked every hour, with an alert within the hour to a named contact; the rest daily.
We close it: We give you the fix for each finding and re-check from outside until it is closed.
The one change we can make ourselves is to your email records, and only when you approve each step, where your DNS host allows it.
Where it does not, you get the exact records to paste.
Your evidence pack:
- an owner summary
- the technical evidence with the fix for each finding
- a rules and insurance briefing
- a dated assessment record
It doubles as your insurance renewal evidence pack:
- the outside questions insurers commonly ask at renewal, each shown with its evidence
- forged-email protection where we reach your DNS host, one click per step
- the Rules and Insurance Briefing, which sets each of your findings beside the plain terms a renewal application uses
Booking and payment messages to patients are what a forged email or a look-alike domain is used to copy.
On monitoring, fixed checks re-check the sender records and look-alike domains that make that possible, every hour, and the Monitor AI agent puts first the change that needs you.
The assessment comes with an AI security agent on your dashboard: ask it about any finding in plain English and it answers from your own clinic's findings.
Our AI agents work from outside only. They never log in, never install anything, and never touch your internal systems.
The one change they can make, to your email records, happens only when you approve it.
04 · Check my clinic
See what is open before anyone else does.
We read from outside, find each way in first, and show it with a check anyone can re-run. No access, nothing tested, no obligation.
What we readPublic sources only
Who sees itYou alone
Delivery72 hours from confirmation
Meeting firstNone
See a sample reading → An invented clinic, so you see what arrives before you ask for yours.
Reading requestPrivate
Received
A person reads your clinic from outside and emails your outside reading within 72 hours, from [email protected].
What happens next
- We read your clinic from outside.
- You see what is open, with the proof for the lead finding.
- If it is worth it, you order.
While you wait: the 72 hours · 34 seconds, no sound
What happens if you go ahead. More at getleaktrace.com/see-it-first/.
Read the transcript
- 72 hours. One domain. Nothing to install.
- Discover. Every way in, found from outside.
- Validate. Every finding, proven. Dated and checkable by anyone.
- Close. Forged email: one click per step, where we reach your DNS host and you approve it.
- You get the fix for the rest, step by step, and we re-check until it is closed.
- Monitor. On monitoring: email settings, look-alikes and new host names re-checked every hour. Alerts within the hour.
- Every paid assessment is human-verified before release.
- The AI defense layer for businesses. getleaktrace.com/see-it-first/