Penetration Testing for UK Dental Practices and Dental Groups

Why Dental Practices Are Targeted

Dental practices occupy an interesting position in the UK healthcare security landscape. NHS dental data is subject to NHS data security standards and the Data Security and Protection (DSP) Toolkit requirements. Private dental practices and dental groups are subject to UK GDPR and the ICO's expectations for health data controllers.

Patient records held by dental practices are valuable data. They contain names, addresses, dates of birth, NHS numbers where applicable, detailed medical and dental histories, medication records, and often financial information for private treatment finance arrangements. This is special category health data — the highest sensitivity category under UK GDPR — and a breach triggers mandatory reporting to the ICO within 72 hours.

Dental practices also present a specific technical risk: the dental software and practice management systems they use — Dentally, SoE Exact, R4, Carestream Dental — are specialist platforms that connect to NHS Spine (for NHS practices), handle NHS BSA claims processing, and increasingly offer patient-facing portals. Each of these integration points is an attack surface that requires specific security testing.

What a Penetration Test Covers for Dental Practices

Patient portal security

Most modern dental practice management software includes a patient-facing portal where patients can book appointments, view treatment plans, receive messages from the practice, and in some cases access their records and invoices. A penetration test of the patient portal examines:

**Authentication security** — Can accounts be brute-forced? Is there account lockout? Is [multi-factor authentication](/blog/two-factor-authentication-website-security-uk) available and is it enforced for staff accounts?

**Access control between patients** — Can a logged-in patient access another patient's appointments, records, or documents by manipulating URL parameters or API requests? [IDOR vulnerabilities](/blog/what-is-idor-vulnerability) in patient portals directly expose health data.

**Session management** — Do sessions expire appropriately? Is the session token invalidated on logout? Are session tokens transmitted securely?

Practice management system exposure

The core practice management system — where patient records, treatment histories, X-rays, and appointment data are stored — must be accessed only by authorised staff on authorised devices. A penetration test examines:

- Whether the management system is accessible from the internet (it typically should not be) - Whether remote access is properly secured (VPN with MFA, not RDP exposed directly to the internet) - Whether staff accounts have appropriate privilege levels and are not all sharing a single admin account - Whether inactive accounts for former staff have been disabled

NHS integration points

NHS dental practices connect to NHS Spine and NHS BSA systems for claiming, scheduling, and patient record lookups. These integrations use smartcard authentication and operate over the NHS network (HSCN). A penetration test examines whether:

- HSCN connection points are properly firewalled and not accessible beyond the practice network - Smartcard sharing or workarounds are in use (a compliance failure that also creates security risk) - NHS system access is logged and monitored for anomalous activity

Website and online booking

The practice's public website and any online booking system are the patient-facing attack surface. Common issues:

- Contact and appointment request forms transmitting data over HTTP - Third-party booking widgets loading scripts from external origins that could be used for [formjacking](/blog/what-is-xss-attack-website) — injecting malicious scripts that capture form inputs - Weak credentials on the website's content management system - Outdated WordPress or booking plugin installations with known vulnerabilities

Finance and payment processing

Dental practices that offer payment plans, take online deposits, or process treatment finance arrangements handle financial data alongside health data. A penetration test checks:

- Payment form security and PCI DSS compliance for card-present and card-not-present transactions - [CSRF protection](/blog/what-is-csrf-attack) on payment-related endpoints - Whether payment confirmation webhooks are signature-validated

DSP Toolkit and CQC Obligations

NHS-contracted dental practices must complete the Data Security and Protection (DSP) Toolkit annually, demonstrating compliance with NHS data security standards. The DSP Toolkit requires evidence of technical security controls including access management, system patching, and network security.

CQC-registered practices are expected to demonstrate appropriate data security as part of the "Well-led" domain of the Key Lines of Enquiry. A documented penetration test and a remediation record provide tangible evidence of proactive security management.

The ICO has specifically investigated dental practices following patient data breaches. In several published cases, breaches resulted from basic failures: unencrypted devices, shared login credentials, and unsecured patient record exports.

What Yrzo AI Covers

The [Advanced scan (£799)](/checkout/pro) is the appropriate tier for dental practices and dental groups, covering:

- Unauthenticated website and booking form security - Email authentication — SPF, DKIM, and DMARC for the practice domain - Authenticated patient portal testing — access control, IDOR, session management - API endpoint enumeration and security review for practice management system integrations - Security headers and third-party script inventory - Exposed administrative interfaces

For multi-site dental groups, a scoped engagement covering multiple practice websites and a shared central platform can be discussed via [contact](/contact). [Start with a free scan](/free) to see your current unauthenticated exposure.

Related reading: [Website Security for Healthcare SaaS UK](/blog/healthcare-saas-website-security-uk) · [GDPR Website Security Requirements UK](/blog/gdpr-website-security-requirements-uk) · [What Is IDOR Vulnerability?](/blog/what-is-idor-vulnerability)