Onchain TLDs and healthcare providers: what to check

A hospital group’s name is not just a brand. It works as a clinical credential. When a patient follows a payment link, a practitioner routes a referral, or a supplier confirms payment details, the name of the institution is the signal they use to decide whether to trust the instruction. That name can also exist onchain as a top-level domain, held by someone the organization has never dealt with, and the complaint procedure that legal teams know from conventional domain names does not extend there.

This guide is written for the general counsel or chief information security officer of a healthcare provider that has discovered, or suspects, that its name exists as an onchain top-level domain (TLD) outside its control. It explains what is specific to the sector, where each function inside the organization is exposed, and what to check. It is information, not legal advice; your own counsel decides what steps to take.

After reading it you will have a map of the exposure by internal function, a checklist you can delegate the same day, and a view of what holding the TLD would let the organization do beyond defense.

What an onchain TLD is and where the DNS does not reach

An onchain TLD is a top-level domain recorded on a public blockchain instead of in the DNS. On the Freename registry it takes the form of a token that sits in a wallet, the software that holds the keys to blockchain assets. Whoever holds that token is the only party able to issue names under the TLD, such as pay.yourbrand or appointments.yourbrand, and Freename charges no yearly renewal to keep it. The record itself is public, and a block explorer lets anyone look it up.

Two limits matter to a legal team. The first is reach. These names are resolved outside the DNS that ICANN coordinates, which means a standard browser will not load one unless something adds support for it: a compatible wallet or a browser extension. That support exists in some places and not in others, and it shifts over time; the page on what is live follows the resolution paths with their sources. For ordinary web traffic the DNS remains the system that works everywhere.

The second is remedy. The UDRP, the dispute policy that registrants of conventional domain names accept through their registrars, does not bind an onchain registry. A trademark still gives you rights that your counsel can assert before a court or under whatever procedure a given registry offers, but the route is less standardized and varies by country.

Why healthcare differs from a generic brand

Every large organization has some exposure when its name exists as an onchain TLD in other hands. In healthcare, three features of the sector compound one another.

First, the name is tied to clinical authority. When a patient receives a message that appears to come from billing.yourbrand, the name is not only a source identifier in the trademark sense. It stands for medical legitimacy. Patients act on instructions from their provider in ways they would never act on instructions from a retailer: they share health information, follow payment instructions and change what they do before a procedure.

Second, the people who deal with a healthcare name are often in a vulnerable position when they do. An elderly patient managing a complex bill, a parent worried about a child’s treatment, a person absorbing a new diagnosis: none of them is likely to examine the technical properties of a name. That says nothing about their capability. It describes the circumstances in which they meet the name.

Third, a healthcare organization rarely acts alone. Affiliated clinics, group practices, specialist referral partners and temporary practitioners all act with apparent authority under the parent name. In that setting, a message from a unit the recipient has never heard of is not unusual, and so it is not questioned.

A consumer brand that is imitated loses sales and some goodwill. A provider that is imitated may see a patient miss an appointment, pay the wrong party or disclose a medical detail to a stranger. The harm lands on a person the organization has a duty to look after, which is why the question belongs on the desk of the general counsel and the security officer, not only with the marketing team.

Patients paying bills and receiving instructions

Billing is the most direct patient-facing exposure. A patient who receives a payment instruction carrying the organization’s name cannot tell a conventional domain from an onchain name. They see a familiar word and they act on it.

Paying to a name is a working capability, not a projection. An onchain payment router such as shaka lets a payment link settle to a name in place of a long raw address; the parties agree how the funds are divided and sign that split onchain before any money moves, and the router passes funds through without holding them. The page on payments to a name explains the mechanism. For a provider that holds its own TLD, this is useful. Where the TLD is held by someone else, the consequence is that a name such as pay.yourbrand could be issued, and could receive money, without the organization having any say.

The honest limit applies here too. Most patients pay by card, bank transfer or through the provider’s own portal, and a standard browser does not open an onchain name. The exposure is therefore narrow: it concerns patients, or relatives paying on their behalf, who use a wallet or a browser with support for these names. Narrow is not nil, and the group that pays on behalf of someone else deserves attention. A son or daughter settling a parent’s account has less context than the patient: they have not seen earlier invoices, they do not know the usual reference format, and the name of the hospital is the only thing they recognize.

Instructions are the second channel. Appointment reminders, notices that a prescription is ready and pre-procedure instructions are all messages on which a patient acts quickly, on the strength of who appears to have sent them. A page reached through a name under .yourbrand would carry the same apparent authority as the organization’s own site for anyone whose software opens it.

None of this depends on a failure of the organization’s own systems. It depends only on the name existing outside its control. That is what makes it awkward for a security function: there is nothing internal to patch, and the conventional perimeter controls do not see it. The practical counterweight is on the organization’s side of the relationship. A provider that states clearly, on its bills and its portal, which channels it uses for payment and which it never uses gives patients and their families a reference point that no third party can alter.

Practitioners and clinics that act under the group’s name

A hospital group works through a wide circle of affiliated practitioners and clinics. They send referrals, request records, issue communications and take payments under the group’s name. Each of them can be confused in two directions: they may receive a request that appears to come from the parent organization, and their own identity may be imitated toward patients or toward colleagues.

The structure of a TLD maps closely onto the structure of a group. Names such as radiology.yourbrand, referrals.yourbrand or records.yourbrand mirror the way departments and shared services are already described internally. A practitioner who receives a request under such a name is being asked to act on the institution’s authority, not on that of an individual colleague, and the institution’s authority is harder to question.

Records requests deserve particular thought. In most countries health information is among the most strictly protected categories of personal data, and the rules differ from one jurisdiction to the next. A clinic that discloses a patient file to the wrong party in good faith has still made a disclosure, and the group whose name was used will be part of the conversation that follows. Your counsel will know which obligations apply where you operate.

You cannot expect practitioners to detect the difference themselves. They have no reason to know how onchain names resolve and no time to look up a registry record before answering an administrative request. The control has to sit with the group: a clear statement to affiliates of which channels the group uses for referrals, records and payments, and a known contact to whom anything outside those channels is forwarded.

Turnover adds a further point. Practitioners join and leave, clinics change affiliation, and the group’s own list of who may act under its name is rarely perfect. Where that list is unclear internally, outsiders have even less to check against.

Trust and vulnerability: why impersonation in health is treated severely

Healthcare organizations owe their patients a duty of care, and in practice that duty colors how any incident involving patients is judged. The details vary by country, and your counsel will know the standard that applies to you. The general pattern is consistent: when a patient is harmed through a channel that carried the provider’s name, the people reviewing the incident may ask what the provider knew about that channel and what it did about it.

Three things explain the severity.

The first is the nature of the harm. Misdirected money can sometimes be recovered. A delayed treatment, a missed procedure or a disclosed diagnosis cannot be undone in the same way.

The second is the position of the person harmed. Societies tend to judge conduct that exploits illness, age or distress more harshly than conduct aimed at an ordinary consumer, and the institution whose name was borrowed stands close to that judgment even when it did nothing wrong.

The third is how clinical trust works. It is built slowly, over repeated contact, and it is shared: patients talk to one another, and so do referring doctors. A single incident under the organization’s name can unsettle people who were never touched by it. The effect on confidence can be out of proportion to the sum involved.

There is a staff dimension as well. An administrator or nurse who follows an instruction that appears to come from their own institution is acting on institutional authority as they understand it. Blaming the individual rarely survives scrutiny; the question returns to what the organization had done to make its genuine channels recognizable.

None of this calls for alarm. It calls for knowing where you stand, which is the purpose of the Namespace Exposure Score, a free tool that scores how exposed a brand is onchain.

Suppliers and payers who verify payment details

Healthcare supply chains are extensive. Medical consumables, pharmaceutical wholesale, equipment maintenance and facilities management all involve recurring payments, often under time pressure, handled by teams whose priority is that the wards never run short. A change of payment details is a routine event in that environment, and routine events receive the least attention.

Verification of such a change usually rests on a name match: does the request come from the trading partner we know? A request under payments.yourbrand passes that test on its face. Whether the name lives in the DNS or on a blockchain was never part of the test, because for most of the history of these procedures there was only one place a name could live.

The exposure runs both ways. Your suppliers may receive a notice that appears to come from the group, asking them to send refunds or credit notes somewhere new. Your own accounts-payable team may receive a notice that appears to come from a supplier’s unit inside your namespace, a shared procurement platform for instance.

Payers are the third party in the triangle. Insurers, public health schemes and billing intermediaries send remittances and payment confirmations to the provider, and they too verify the destination by name. If the destination were changed at the payer’s end, the provider’s own controls would never see the instruction. The provider would learn of it only at reconciliation, when expected funds failed to arrive.

The remedy is not technical and not new: a change of payment details is confirmed through a second channel that was established before the request arrived. What the onchain layer changes is the list of things a finance team should recognize as a name. A name ending in .yourbrand should be treated as unknown until the organization itself has said otherwise.

Exposure by function inside the organization

The table maps each internal function to its main exposure and the consequence it is most likely to meet. It is a triage aid, not a complete inventory.

Function	Main exposure	Likely consequence
Patient billing	Name appears in a payment instruction to patients	Patient pays the wrong party
Accounts payable	Name used in a change of payment details	Supplier payment misdirected
Clinical administration	Referral or records request under the name	Patient data sent to an unknown party
IT and security	Name opens a page imitating a staff sign-in	Staff credentials exposed
Communications	Name used in public or patient messaging	Confidence of patients affected
Revenue and payer relations	Remittance destination changed at the payer	Gap found only at reconciliation
Legal and compliance	No record of whether the TLD exists	Slow, uncoordinated response

No single function sees the whole picture. Billing knows what patients receive, finance knows how payment details change, clinical administration knows the affiliates, and security knows what the organization’s devices can open. That is the argument for one file with one owner, taken up in the section on options.

Ten checks and the function that owns each

Each check names the function best placed to carry it out. None requires contact with a holder, and none requires specialist onchain knowledge to begin.

Onchain TLD exposure: ten checks for a healthcare provider

Agree who knowsName the small group that will see the results before any check is run, and record the review as confidential. Owner: general counsel.
List the names to checkWrite down the group name, the trading names of each hospital and clinic, and the abbreviations patients and staff actually use. Owner: legal, with communications.
Run the name checkSubmit those names to the free Trademark Name Check on the Hush Partners site to see where they stand as onchain TLDs. Owner: legal or brand protection.
Score the exposureComplete the Namespace Exposure Score for the group name so the result can be compared across entities and repeated later. Owner: legal, with IT security.
Test what staff devices openEstablish whether managed devices and approved browsers can open onchain names at all, and whether any wallet software is permitted on them. Owner: IT security.
Review patient payment channelsList every payment link and instruction sent to patients and confirm each one points to a channel the organization controls. Owner: patient billing, reviewed by finance.
Review changes of payment detailsConfirm that no supplier or payer detail can be changed on a name match alone, without confirmation through a second, pre-agreed channel. Owner: accounts payable.
Check the affiliate registerVerify that the list of practitioners and clinics entitled to act under the group's name is complete, and that departures are reflected in it. Owner: clinical administration.
State the official channelsPrepare a short statement of the channels the group uses for payments, referrals and records, for affiliates, suppliers and patients. Owner: communications, approved by legal.
Decide on monitoring and next stepsDecide whether the names should be monitored on a standing basis and whether the result of the name check calls for further action. Owner: general counsel.

Checks five to nine are worth doing whatever the name check shows. They strengthen controls that also protect against imitation through conventional domains, email and telephone, which remain the more common channels.

The options and who should own the file

Once the checks are done, the organization is in one of three positions.

In the first, no onchain TLD matching the name is found. The choice is then between monitoring and taking the name yourself where a registry makes it available. What a TLD of that kind is, for a provider that has never held one, is set out on the page on trademark TLDs. Holding it on one registry does not settle the question on every other, so monitoring remains relevant either way.

In the second, the TLD exists and nothing appears to be happening under it. A holder is entitled to hold a name, and holding one is not evidence of bad intent. The options are to monitor, to assert trademark rights if your counsel sees a basis, or to acquire the TLD by agreement. An acquisition by agreement is a commercial conversation, and it tends to go better when it is prepared, discreet and conducted by someone the holder has no reason to mistrust. For a provider that chooses this route, acquiring the onchain TLD that matches its brand is the work covered by the service called brand namespace recovery.

In the third, names under the TLD lead to content or receive payments in ways that concern you. This is an incident and should be handled as one: record what was observed, where and with which software, and let your counsel decide which remedies to pursue and in what order. Have the record made by IT security or an outside specialist, so that it is made once and made properly.

Why the general counsel owns it

The security officer has the tools to observe, and finance has the controls that matter most day to day. The file still belongs with the general counsel, for three reasons. It may lead to a negotiation or a dispute, both of which are legal matters. It involves patient data and duty-of-care questions on which only counsel can advise. And confidentiality is easier to maintain when one office decides who is told what. The security officer supplies the technical record, finance the review of payment channels, communications the patient-facing wording, and clinical administration the affiliate register.

Where a desk fits

Hush Partners is a private desk for onchain TLDs. An organization can mandate it to find and approach a holder, and one named partner then follows the file from the first note through to closing. A standard mutual NDA covers each exchange. The fee is a fixed amount, never a percentage, and only the client who gives the mandate pays it. Closing takes place through onchain escrow on an aftermarket. The page for brands and legal teams sets out how the desk works with general counsel. Monitoring of a brand’s names onchain is a separate service, Namespace Watch.

What a healthcare provider could do as holder of its TLD

Holding .yourbrand is first a matter of control. Because names under a TLD come only from its holder, no pay.yourbrand, billing.yourbrand or referrals.yourbrand can exist unless the organization creates it. The question of who might use those names is closed on that registry.

Beyond defense, the capabilities are modest and real, and each should be weighed against the fact that resolution support is incomplete.

Payment destinations the organization controls

A treasury or revenue team could publish a single named destination for the payers and suppliers that already settle onchain, in place of a raw address that no one can read or check by eye. For most providers this will concern a small share of counterparties, if any. Its value is clarity: one name, issued by the organization, that finance can point to.

Names for affiliates

Affiliated clinics and practitioners could be given names under the TLD. Because only the holder can issue them, a name under .yourbrand would itself indicate that the group granted it, and withdrawing a name when an affiliation ends would be part of governing the namespace. This asks for the same discipline as the affiliate register in the checklist: the namespace is only as accurate as the list behind it.

Software agents acting for the organization

Providers are beginning to consider software agents for scheduling and administrative work. ERC-8004, known as “Trustless Agents”, is a draft Ethereum standard that describes three registries for such agents: one for identity, one for reputation and one for validation. Being a draft, the text may change, and how naming registries will connect to those registries is still evolving. It is something to follow, not something to build on yet.

A note on royalties

Freename operates a royalty program under which a TLD holder is paid part of every registration fee for names registered under its TLD. Freename advertises that share as reaching up to half; the terms the registry has in force, and its activation conditions, determine what applies. A healthcare provider is unlikely to open its own name to public registration, so this matters little here. It is mentioned so that the picture is complete.

The practical work after a transfer, including which names to issue first and who governs them, is covered under post-transfer activation. For a provider, the sensible order is payment destinations and affiliate names first, and nothing public until governance is settled.

The next step is small. Give checks one to four to your legal team and check five to your security officer, and review the results together before deciding anything else.

Questions people ask

Does a trademark registration give us rights over the onchain TLD?

A trademark gives you rights in the name for the goods and services it covers, and those rights can be asserted before a court or under a registry’s own procedure where one exists. It does not hand you control of the token. The strength of the mark is relevant in any dispute or negotiation, and your counsel will advise on the options available where you operate.

If nothing is happening under the TLD, does it still matter?

It matters less, and it is still worth recording. A holder can issue names at any time, so a quiet TLD is a fact about the present state of the record, not a guarantee. The sensible response is proportionate: note the position, decide on monitoring, and revisit the question at the intervals your risk process already uses.

Should our security team block onchain names on staff devices?

That is a policy decision for the security officer. If staff devices cannot open these names and no wallet software is permitted, the staff-facing exposure through managed devices is small. Personal devices and the devices of patients, suppliers and affiliates are outside that control, which is why the statement of official channels matters more than any block.

Can we look at the record without anyone knowing?

Reading a public blockchain record is a passive act: it sends nothing to the holder of a token. What can reveal interest is conduct around the reading, such as inquiries made under the organization’s name or internal discussion that travels. That is the reason to settle the circle of people first.