OpenEMR Software

Implementation guide for developers and IT administrators deploying open-source electronic health records in medical practices

About OpenEMR Software

OpenEMR is the world's leading open-source electronic health records (EHR) and medical practice management solution, certified for ONC Ambulatory EHR. Used by healthcare organizations globally, it provides comprehensive features including patient scheduling, medical billing, e-prescribing, lab integration, and clinical decision support.

📋

Patient Records

Complete EHR with demographics, encounters, allergies, medications, and clinical notes.

📅

Scheduling

Multi-provider calendar with automated reminders and appointment types.

💳

Billing

Integrated medical billing with X12 5010 support and clearinghouse integration.

🔗

FHIR R4

HL7 FHIR R4 API for interoperability and third-party integrations.

🌐

Multilingual

Available in 30+ languages for global healthcare deployments.

🛡️

HIPAA Ready

Fine-grained access controls and audit logging for compliance.

System Requirements

OpenEMR runs on standard web hosting infrastructure. Version 8.0 introduces modern PHP requirements and improved performance.

8.0

OpenEMR Version

8.2+

PHP Version

10.11+

MariaDB/MySQL

2GB+

RAM Minimum

Server Requirements

✓ Linux (Ubuntu 20.04+, Debian 11+) or Windows Server 2019+
✓ Apache 2.4+ or Nginx 1.20+ with PHP-FPM
✓ PHP 8.2+ with extensions: mysqli, curl, gd, mbstring, xml, zip, openssl
✓ MariaDB 10.11+ or MySQL 8.0+ (InnoDB engine required)
✓ Minimum 10GB storage (depends on document storage needs)
✓ SSL certificate for HTTPS (required for production)

Important: PHP 8.0 and 8.1 reached end-of-life. OpenEMR 8.0 requires PHP 8.2+ for security patches and vendor support.

Installation Methods

Choose the installation method that matches your infrastructure and expertise level.

Method 1: Package Manager (Recommended for Linux)

The easiest path on Debian/Ubuntu with automated configuration.

$ wget https://github.com/openemr/openemr/raw/refs/heads/master/scripts/openemr-unified-install.sh

$ chmod +x openemr-unified-install.sh && sudo ./openemr-unified-install.sh

Method 2: Docker (Development & Containerized)

For containerized deployments using Docker Compose.

git clone https://github.com/openemr/openemr.git
cd openemr
docker compose up -d
# Access at http://localhost:8080

Method 3: Manual Installation

Full control for custom Apache/Nginx configurations.

# 1. Create database
mysql -u root -p -e "CREATE DATABASE openemr CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;"

# 2. Download and extract
wget https://sourceforge.net/projects/openemr/files/OpenEMR%20Current%20Stable%20v8/zip
unzip openemr-*.zip -d /var/www/html/

# 3. Configure web server
# (See Apache/Nginx config below)

# 4. Run web installer
# Navigate to http://your-server/openemr/setup.php

Initial Configuration

Critical settings to configure immediately after installation for production use.

Web Server Configuration

Apache virtual host for OpenEMR with PHP-FPM:

<VirtualHost *:443>
    ServerName emr.yourpractice.com
    DocumentRoot /var/www/html/openemr

    <Directory /var/www/html/openemr>
        AllowOverride None
        Options FollowSymLinks
        Require all granted
    </Directory>

    SSLEngine on
    SSLCertificateFile /etc/ssl/certs/emr.crt
    SSLCertificateKeyFile /etc/ssl/private/emr.key
    Include /etc/letsencrypt/options-ssl-apache.conf
</VirtualHost>

PHP-FPM Pool Configuration

[openemr]
user = www-data
group = www-data
listen = /run/php/php8.2-fpm-openemr.sock
pm = dynamic
pm.max_children = 50
pm.start_servers = 5
pm.min_spare_servers = 5
pm.max_spare_servers = 20
php_admin_value[upload_max_filesize] = 30M
php_admin_value[post_max_size] = 30M
php_admin_value[memory_limit] = 512M
php_admin_value[max_execution_time] = 300

OpenEMR Configuration File

Edit interface/modules/zend_modules/config/module.config.php or use the web interface at /interface/admin.php?action=configuration.

Pro tip: Enable debug mode temporarily only during troubleshooting. Set $gblis_time_zone to your server's timezone for accurate timestamps in audit logs.

Security Hardening

HIPAA compliance requires these security configurations for production OpenEMR deployments.

Critical Security Checklist

✓ Force HTTPS - Enable in Admin > System > Security
✓ Session timeout - Set to 15-30 minutes ($session_timeout)
✓ Password policy - Enable strong passwords, 12+ chars, MFA
✓ Failed login lockout - 5 attempts, 15-minute lockout
✓ Audit logging - Enable all audit types
✓ File permissions - Read-only except interface/continue.php
✓ Disable demo - Never run in demo mode in production
✓ Backup encryption - Encrypt backups with GPG or age

Fail2Ban Integration

Protect against brute force attacks:

[Definition]
failregex = ^.*ERROR.*Failed login attempt.*
ignoreregex =

[Action]
actionban = echo 'OpenEMR login failure' | mail -s "Fail2Ban Alert" admin@practice.com

ModSecurity Rules

# Block SQL injection attempts
SecRule REQUEST_URI|ARGS "@rx (?i)(\bunion\b|\bselect\b|\binsert\b|\bdrop\b|\bupdate\b|\bdelete\b)" \
    "id:1001,phase:1,deny,status:403,msg:'SQLi attempt blocked'"

# Block XSS attempts  
SecRule REQUEST_URI|ARGS "@rx