Managed IT Support & Cybersecurity Transformation for Private Dental Practice

A private dental practice with two locations in London and 18 staff was operating with IT infrastructure that would have failed any compliance inspection. Patient records were stored on an unencrypted Windows Server 2012 R2 machine that hadn't been patched in two years. X-ray images were stored on a local hard drive with no backup. The practice had no multi-factor authentication, no cybersecurity protections, and no IT support. Two phishing attacks in six months had resulted in one staff member's email account being compromised — though the practice owner was unaware of the extent of the breach.

The practice owner, a dentist with 20 years of clinical experience but no IT expertise, had assumed that 'dental software' came with 'dental IT security.' It didn't. The practice management software (Dentalink) ran on the unpatched server, but the server's security, backup, and compliance were entirely the practice's responsibility — and no one had ever told the practice owner what that responsibility entailed. When a patient asked about the practice's GDPR compliance for data subject access requests, the owner realised he didn't have an answer.

We were referred by another dental practice we support. Our initial assessment, conducted over 2 days, identified 14 critical risks: unencrypted patient data, no backup, no MFA, unpatched server, no firewall, no email security, no device management, no incident response plan, no GDPR documentation, no data processing agreements with suppliers, no staff security training, no access controls on patient data, no audit logging, and no disaster recovery plan. The practice owner was shocked — and motivated to fix everything immediately.

The practice's budget was £1,000 per month for IT support and security — a significant amount for a dental practice, but far less than the cost of a data breach or a failed CQC inspection. We designed a solution that delivered complete compliance, robust security, and proactive support within this budget, using cloud-based services that provided enterprise-grade protection at small-business prices.

The core was Microsoft 365 Business Premium at £16.60 per user per month — for 18 users, that was £298.80 per month. Business Premium included Exchange Online email, OneDrive and SharePoint, Microsoft Intune for device management, Microsoft Defender for Endpoint, and Microsoft Defender for Office 365 — providing most of the security and compliance controls the practice needed. We added Mimecast email security at £4 per user per month (£72) for advanced phishing protection, and Azure Backup at £80 per month for immutable backup of all patient data and x-ray images.

For managed IT support, we provided a dedicated support line with 2-hour response SLA, 24/7 monitoring of all devices and systems, monthly health checks, and quarterly strategic reviews — all for £400 per month. The total monthly cost was £850.80 — within the practice's £1,000 budget, with £149.20 remaining for contingency. The practice owner was relieved: 'I thought proper IT security would cost thousands a month. This is less than I pay for my dental software licence.'

The implementation was completed over 3 weeks, with all work scheduled outside patient hours to ensure zero disruption to clinical operations. Week 1 was Microsoft 365 setup and email migration. We configured the Microsoft 365 tenant, set up the practice's custom email domain, and migrated all 18 mailboxes to Exchange Online using a hybrid migration that maintained email continuity throughout. We deployed Mimecast email security and configured impersonation protection for the practice owner and front desk staff — the most common targets for phishing.

Week 2 was the critical phase: patient data migration. The practice's patient records were stored in Dentalink, which we migrated to a cloud-hosted instance running on Azure Virtual Machines. The migration was performed over a weekend, with the on-premises server and the cloud instance running in parallel for 48 hours to verify data integrity. All patient data was encrypted at rest using Azure Disk Encryption and in transit using TLS 1.2. We configured Azure Backup with immutable storage to protect the patient data and x-ray images — 90-day retention with point-in-time recovery, meaning the practice could recover from any data loss event, including ransomware.

We also implemented access controls on patient data. Only clinical staff (dentists and hygienists) could access patient records. Front desk staff could access appointment scheduling and patient contact information but not clinical records. The practice owner had full access plus an audit log showing who accessed what data and when. This was a critical GDPR requirement — the practice needed to demonstrate that patient data was accessed only by authorised staff for legitimate purposes.

Week 3 was device management and security hardening. We enrolled all 18 devices (desktops at both locations, laptops, and tablets) in Microsoft Intune via Windows Autopilot. We configured compliance policies requiring disk encryption, up-to-date patches, and Defender for Endpoint anti-malware. Conditional access blocked access to patient data from any non-compliant device. We deployed MFA using Microsoft Authenticator for all staff, with FIDO2 security keys for the practice owner and IT admin accounts. And we configured Microsoft Defender for Office 365 with healthcare-tuned DLP policies to detect and prevent the transmission of patient data (NHS numbers, patient names) to external recipients.

With the technical controls in place, we turned to compliance documentation and certification. Cyber Essentials was the first priority — the UK government-backed certification that demonstrates basic cybersecurity hygiene. We worked through the five Cyber Essentials controls: firewalls (Azure Firewall and Windows Defender Firewall on all devices), secure configuration (Intune security baselines), user access control (least-privilege via Entra ID and Intune), malware protection (Defender for Endpoint), and security update management (Intune automatic patching). The practice passed the Cyber Essentials assessment on the first attempt, within 6 weeks of starting the project.

For GDPR compliance, we documented the practice's data processing activities, created data processing agreements with all suppliers (Microsoft, Mimecast, Dentalink), and implemented data subject access request procedures. We configured Microsoft 365 retention policies for patient email and documents, and enabled litigation hold on clinical mailboxes to prevent permanent deletion of patient communications. We also created a breach notification procedure — a step-by-step guide for what to do if a data breach occurred, including notifying the ICO within 72 hours as required by GDPR.

For CQC compliance, we documented the practice's data security arrangements as required by the CQC's Key Lines of Enquiry (KLOEs) for safe data handling. We created an IT security policy, an incident response plan, a backup and disaster recovery policy, and a staff training log. We provided 1-hour security awareness training for all 18 staff, covering phishing recognition, password security, data handling procedures, and what to do if they suspected a security issue. The training was repeated quarterly, with phishing simulations sent monthly to reinforce learning.

When the CQC inspected the practice 4 months after the implementation, the inspector specifically noted the IT security arrangements as 'exemplary' — a word that the practice owner told us he had never heard in a CQC report before. The practice passed the inspection with zero findings related to data security, and the compliance documentation we created was cited as evidence of good practice.

In the 18 months following the implementation, the practice experienced zero security incidents, zero data loss events, and zero compliance findings. Three phishing emails were caught by Mimecast and never reached staff inboxes. One device was lost (a tablet left at a patient's home) and was remotely wiped via Intune within 10 minutes — no patient data was compromised. The monthly phishing simulation click rate dropped from 28% to under 5%, and two real phishing attempts were identified and reported by staff members who had been trained to recognise them.

The practice's IT support experience was transformed. Previously, when something broke, the practice owner would spend hours on the phone with a break-fix IT provider who didn't know the practice's systems. Now, staff called our dedicated support line and received a response within 25 minutes on average — against a 2-hour SLA. Monthly health checks identified and resolved 3-5 issues before they impacted the practice, and quarterly strategic reviews kept the practice's technology aligned with its growth plans.

The practice owner, who had been anxious about IT and compliance before the engagement, now describes it as 'one less thing to worry about.' 'I focus on dentistry, and Third Eye handles the technology,' he said. 'I used to spend hours every week dealing with IT issues. Now I spend zero. And I know that if anything goes wrong, there's someone who knows our systems and can fix it immediately.' The practice has since opened a third location, and the IT infrastructure scaled seamlessly — new devices enrolled in Intune automatically, new users were added to Microsoft 365 in minutes, and the same security and compliance controls applied from day one.