# Cyber Security for Orthodontic Practices: Protecting Patient Data and What to Do If It Goes Wrong Publisher: Virtual Consultant Online Author: Virtual Consultant Online Published: 2026-10-08 Updated: 0001-01-01 Canonical URL: https://virtualconsultant.online/blog/cyber-security-orthodontic-practice-data-breach-plan Citation metadata: https://virtualconsultant.online/citation.json?url=https%3A%2F%2Fvirtualconsultant.online%2Fblog%2Fcyber-security-orthodontic-practice-data-breach-plan An orthodontic practice holds exactly the kind of information that criminals value and patients care about most: names, dates of birth, addresses, health histories, clinical photographs of children, payment arrangements and the parents' contact details that go with them. This guide to cyber security for orthodontic practices sets out the realistic threats, the controls that matter most for a small clinical team, the UK GDPR duties that apply if something goes wrong, and a one-page incident plan you can adapt. You do not need to be technical. You need to decide who is responsible, switch on a handful of protections and rehearse the first hour of a bad day. Key takeaway The National Cyber Security Centre reports that one in two small businesses suffer a cyber incident every year, and that many of the fixes take minutes. The Cyber Essentials scheme boils protection down to five controls: firewalls, secure configuration, security update management, user access control and malware protection. If a personal data breach is likely to put people at risk, the ICO expects you to notify it as soon as possible and, where feasible, within 72 hours. ## What are the main cyber threats to an orthodontic practice? The most common threats to a small clinical practice are phishing emails, stolen or reused passwords, ransomware, unpatched software and lost or unprotected devices. None of them needs a sophisticated attacker. The NCSC describes most attacks as basic in nature, the digital equivalent of a thief trying your front door to see if it is unlocked. Phishing and fake invoices An email that looks like a supplier, a lab or the practice owner and asks for payment or a login. Slow down on anything urgent Check by phone using a known number Credential theft A reused password from another breached service is tried on your email or practice software. Use unique passwords Turn on multi-factor authentication Ransomware Files are locked and a payment is demanded, often after a user opens an attachment or an unpatched system is attacked. Keep tested backups Install updates promptly Lost or shared devices A laptop left on a train, a phone with patient photos, or a shared login on the reception PC. Encrypt devices Give every person their own account Orthodontics adds two specific exposures. Clinical photographs, scans and radiographs are large files that are often copied to phones, USB drives and email for convenience, which multiplies the places where they can leak. And many practices work with young patients, so a breach can affect children and their parents at once. Treat photographs and images as health data, not marketing assets. ## Why does patient data need special care under UK GDPR? Information about a person's health is special category data under UK GDPR, which means you need both a lawful basis and an additional condition to process it, and you must keep it secure. The ICO's security guidance explains that the security principle requires appropriate technical and organisational measures proportionate to the risks, and it expects organisations to be able to restore access to personal data in a timely way after an incident. In practical terms, that is the argument for backups, access control and a tested recovery plan. We cover the wider legal framework in our plain-English guide to GDPR for orthodontic practices and the specific duty to respond to requests in our article on subject access requests . This article focuses on the technical and organisational protections that keep you out of trouble in the first place. ## What are the five Cyber Essentials controls, and how do they apply to a practice? Cyber Essentials is the NCSC's certification scheme built on five technical controls, and it is the minimum standard the Government recommends for organisations of all sizes. You do not have to certify to benefit from the controls, but they make an excellent checklist for a practice manager and an IT provider. Control What it means in plain English In a practice Firewalls A security filter between your network and the internet Use the router's firewall, keep it configured, and change default admin passwords Secure configuration Set up computers and devices to minimise ways in Remove unused accounts and software; use screen locks and device encryption Security update management Fix known weaknesses promptly Turn on automatic updates for operating systems, browsers and clinical software; retire unsupported systems User access control Control who can reach data and at what level One account per person; give receptionists, nurses, clinicians and the owner only what they need; remove leavers the same day Malware protection Identify and stop malicious software Use up-to-date protection on every computer and restrict who can install software According to the NCSC, certification involves a self-assessment with independent audit for Cyber Essentials, or independent technical testing for Cyber Essentials Plus. The NCSC also states that UK organisations with turnover under £20 million that certify their whole organisation are automatically entitled to cyber liability insurance arranged by its delivery partner. Prices and terms change, so read the current Cyber Essentials overview before you decide. Our article on orthodontic practice insurance explains what else your cover should include. ## How do you protect accounts with passwords and multi-factor authentication? Use a different, long password for every account and switch on multi-factor authentication wherever it is offered, starting with email and practice software. The NCSC recommends long passwords built from three random words and the use of a password manager so nobody has to remember dozens of credentials. Multi-factor authentication stops a stolen password being enough on its own. The NCSC also publishes a guide to multi-factor authentication for online services. A password and access checklist for the team ◆ Every person has their own login for email, practice software and imaging ◆ No shared reception password written on a monitor ◆ Multi-factor authentication on email, cloud storage and clinical systems ◆ A password manager for the practice, with a plan for the master password ◆ Admin accounts used only for admin tasks ◆ Leavers' access removed on their last day ◆ Locums given time-limited accounts, not a colleague's login ◆ Screens lock automatically when unattended Access control is also a patient-safety and privacy issue. A receptionist does not need to open radiographs, and a trainee does not need billing exports. Role-based accounts reduce both the chance of a mistake and the harm if one account is compromised. ## How should an orthodontic practice back up its data? Back up regularly, keep at least one copy separate from your main systems, and test that you can restore it. The NCSC small business guide includes a section on backing up your data , because a recent backup is the difference between an inconvenience and a crisis if ransomware locks your files. Ask your IT provider and your software suppliers three questions: What exactly is backed up, including images, scans, photographs and documents held outside the main practice system? Where are the copies held, and can a compromised computer on our network reach and encrypt them? When did we last restore a file, and how long did it take? If your practice management and imaging systems are cloud based, the supplier looks after much of this, but you remain responsible for choosing suppliers carefully and for your own devices and accounts. Ask suppliers about their security certifications and how they handle incidents, and keep their answers on file. Keep patient information in one secure place Virtual Consultant Online keeps assessments, photographs, quotes and communications attached to one patient record, instead of spread across inboxes, phones and USB sticks. See the journey as a patient does. Try the online quote → ## What does the NHS Data Security and Protection Toolkit require? The Data Security and Protection Toolkit is an online self-assessment against the National Data Guardian's 10 data security standards, and all organisations that have access to NHS patient data and systems must use it. If you hold an NHS contract or use NHS systems, check your contract and your commissioner's requirements and keep the annual submission in your governance calendar. Private-only practices are not necessarily in scope, but the standards are a sensible benchmark either way. The toolkit is available at the official DSPT site , and it can help you structure policies on training, access and incident response. ## What should you do in the first hour after a suspected breach? Contain the problem, preserve evidence, tell the people who must know, and start the clock on the ICO's 72-hour expectation. A personal data breach is any security incident that affects the confidentiality, integrity or availability of personal data, and it includes loss as well as theft. The ICO says you must assess the likely risk to people's rights and freedoms. If a risk is likely, you must notify the ICO as soon as possible and, where feasible, within 72 hours, and if the risk to people is high you must also notify those people without undue delay. Step What to do Who 1. Contain Disconnect affected devices from the network, change passwords for affected accounts, and stop the spread without wiping evidence Practice manager and IT provider 2. Record Write down what happened, when it was discovered, what data is involved and who is affected Practice manager 3. Assess Decide the likely risk to individuals, considering the type of data (health data, photographs, children) and what an attacker could do with it Data protection lead 4. Notify If a risk is likely, report to the ICO; if the risk is high, tell the affected people clearly and without undue delay Data protection lead and practice owner 5. Recover Restore from backups, check systems before reconnecting and tell your insurer if cover requires it IT provider 6. Learn Review what failed, change procedures and document the changes Whole team The ICO provides a self-assessment tool and a simple guide to the first 72 hours aimed at small companies. Keep the link and the practice's incident plan in a printed copy, because you may not be able to open a computer when you need it. The ICO's page on how to report a personal data breach explains the reporting process and says the online form takes about 30 minutes to complete, so gather your facts first. Remember that even if you decide a breach does not need to be reported, you should record the decision and the reasons. Important Do not pay or negotiate with an attacker without taking advice. Report the incident, keep evidence, and involve your IT provider, insurer and, where appropriate, the NCSC and the police. Your own process should say who has the authority to take these decisions out of hours. ## How do you build a security culture in a small team? The NCSC's small business guidance makes a point that suits a clinical team: do not leave cyber security to a single person, because every member of the team should realise it is everyone's business. A short briefing at induction, one worked example of a convincing phishing email each quarter and a clear way to report a mistake without blame will do more than a long policy nobody reads. Habits to build in the first quarter ◆ A named data protection lead and a deputy ◆ A one-page incident plan on the wall and in the shared drive ◆ A quarterly five-minute phishing example at the team meeting ◆ A rule that payment details are never changed by email alone ◆ A leavers and joiners checklist for accounts and devices ◆ An annual review of suppliers and what they can access Cyber hygiene also supports the patient trust that drives referrals. Patients who feel their information is safe are more willing to share the photographs and medical details you need, which feeds your patient lifecycle from enquiry to long-term referral. Reduce the number of places patient data lives Virtual Consultant Online gives orthodontic practices one record for assessments, photographs, quotes and communications, so there are fewer inboxes, phones and drives to protect. Explore the patient journey from the patient's side. Try the online quote → ## FAQs ### Is an orthodontic practice a target for cyber attacks? Yes, because it holds health information, photographs of children and payment details, and small practices often have fewer protections than large organisations. The NCSC reports that one in two small businesses suffer a cyber incident every year, and most attacks are basic ones that simple controls can stop. ### What is a personal data breach in a dental practice? It is any security incident that affects the confidentiality, integrity or availability of personal data, including accidental loss, an email sent to the wrong person, a lost laptop or ransomware that locks records. Record every breach, even those you decide not to report. ### How quickly must a practice report a breach to the ICO? If the breach is likely to result in a risk to people's rights and freedoms, you must notify the ICO as soon as possible and, where feasible, within 72 hours of becoming aware of it. If the risk is high you must also tell the affected individuals without undue delay. ### What are the five Cyber Essentials controls? They are firewalls, secure configuration, security update management, user access control and malware protection. The NCSC designed them to prevent the most common internet-based attacks, and they work as a checklist even if you do not certify. ### Does my practice need to complete the Data Security and Protection Toolkit? All organisations with access to NHS patient data and systems must use the toolkit. Check your NHS contract and commissioner requirements to confirm whether it applies, and use its standards as a benchmark if you are private only. ### How often should we test our backups? Test restoring files at least a few times a year and after any change to systems, and keep one copy that a compromised computer cannot reach. Ask your IT provider and suppliers what is backed up, where copies are held and how long a restore takes. ### How can I tell if my orthodontic practice keeps my data safe? You can ask how photographs and scans are stored, who can see them and how long they are kept. A good practice will explain its privacy notice, use secure systems and tell you promptly if your information is ever involved in a breach. ### What should we do if we click a phishing link? Tell the practice manager immediately without worrying about blame, disconnect the device from the network, change the passwords for affected accounts and follow your incident plan. Quick reporting limits the damage and helps you meet the 72-hour expectation if a breach is confirmed. ### Is an orthodontic practice a target for cyber attacks? Yes, because it holds health information, photographs of children and payment details, and small practices often have fewer protections than large organisations. The NCSC reports that one in two small businesses suffer a cyber incident every year, and most attacks are basic ones that simple controls can stop. ### What is a personal data breach in a dental practice? It is any security incident that affects the confidentiality, integrity or availability of personal data, including accidental loss, an email sent to the wrong person, a lost laptop or ransomware that locks records. Record every breach, even those you decide not to report. ### How quickly must a practice report a breach to the ICO? If the breach is likely to result in a risk to people's rights and freedoms, you must notify the ICO as soon as possible and, where feasible, within 72 hours of becoming aware of it. If the risk is high you must also tell the affected individuals without undue delay. ### What are the five Cyber Essentials controls? They are firewalls, secure configuration, security update management, user access control and malware protection. The NCSC designed them to prevent the most common internet-based attacks, and they work as a checklist even if you do not certify. ### Does my practice need to complete the Data Security and Protection Toolkit? All organisations with access to NHS patient data and systems must use the toolkit. Check your NHS contract and commissioner requirements to confirm whether it applies, and use its standards as a benchmark if you are private only. ### How often should we test our backups? Test restoring files at least a few times a year and after any change to systems, and keep one copy that a compromised computer cannot reach. Ask your IT provider and suppliers what is backed up, where copies are held and how long a restore takes. ### How can I tell if my orthodontic practice keeps my data safe? You can ask how photographs and scans are stored, who can see them and how long they are kept. A good practice will explain its privacy notice, use secure systems and tell you promptly if your information is ever involved in a breach. ### What should we do if we click a phishing link? Tell the practice manager immediately without worrying about blame, disconnect the device from the network, change the passwords for affected accounts and follow your incident plan. Quick reporting limits the damage and helps you meet the 72-hour expectation if a breach is confirmed. ## References - National Cyber Security Centre: Small organisations guide to cyber security (https://www.ncsc.gov.uk/collection/small-business-guide) - NCSC guidance for small organisations covering passwords, email, backups and spotting attacks, including the statistic that one in two small businesses suffer a cyber incident each year. - National Cyber Security Centre: Cyber Essentials overview (https://www.ncsc.gov.uk/cyberessentials/overview) - The five technical controls of Cyber Essentials and the difference between Cyber Essentials and Cyber Essentials Plus. - Information Commissioner's Office: Report a personal data breach (https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/) - ICO guidance on assessing a breach, notifying the ICO within 72 hours where feasible and informing individuals when the risk is high. - NHS Data Security and Protection Toolkit (https://www.dsptoolkit.nhs.uk/) - The online self-assessment against the National Data Guardian's 10 data security standards, required for organisations with access to NHS patient data and systems. - National Cyber Security Centre: Small organisations guide to cyber security (https://www.ncsc.gov.uk/collection/small-business-guide) - NCSC guidance for small organisations covering passwords, email, backups and spotting attacks, including the statistic that one in two small businesses suffer a cyber incident each year. - National Cyber Security Centre: Cyber Essentials overview (https://www.ncsc.gov.uk/cyberessentials/overview) - The five technical controls of Cyber Essentials and the difference between Cyber Essentials and Cyber Essentials Plus. - Information Commissioner's Office: Report a personal data breach (https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/) - ICO guidance on assessing a breach, notifying the ICO within 72 hours where feasible and informing individuals when the risk is high. - NHS Data Security and Protection Toolkit (https://www.dsptoolkit.nhs.uk/) - The online self-assessment against the National Data Guardian's 10 data security standards, required for organisations with access to NHS patient data and systems.