A software provider has been fined £3m over a ransomware attack that disrupted critical NHS services and put the data of tens of thousands of patients at risk.