A dental practice sits on special category data: health records, images, sometimes children's records too. That is the most sensitive tier the law recognises, and it comes with real duties. Yet the practice management and imaging software that holds it is often a specialist system, bought once, and left on whatever version it shipped with because touching it feels risky.

The recurring problem we see is a system the supplier has not meaningfully updated for a couple of years, running on a computer that cannot be updated either without breaking the software. That machine then quietly becomes the weakest point in the building, holding the most sensitive data, precisely because nobody wants to be the one who breaks the X-rays.

This is not a reason to panic, but it is a reason to plan. The first step is knowing exactly what you have: which system holds patient data, what version, whether the supplier still supports it, and what they will do if it is attacked. If the honest answer is that support ended, that is a business conversation to have with them now, not during an incident.

In the meantime there is sensible containment. Keep the vulnerable machine off the general internet where you can, restrict who can sign into it, make sure there is a genuine backup of the records held somewhere separate, and ensure a lost or stolen device cannot simply be read. None of that fixes the ageing software, but it limits the blast radius while you sort a proper answer.

If patient data is ever exposed, you also have reporting duties, and a tight window to meet them. Knowing in advance who you would call and what you would report turns a frightening morning into a procedure. That preparation is cheap. The alternative is not.