Health IT infrastructure · Open source EHR
Medplum
An open source, FHIR native electronic health record that developers install instead of licensing. It carries a federal health IT certification, ships a release most weeks, and has never filed a Form D.
One command
The install instruction on the Medplum home page is three words long: npm init medplum. The alternative is a git clone. Either way a developer ends up with a clinical data repository, a FHIR R4 API in REST and GraphQL, an identity layer on OAuth, OpenID and SMART on FHIR, audit logging, and a React component library that renders a patient intake form.
The repository is medplum/medplum, public since April 21, 2021. As of September 23, 2026 the GitHub API reports 2,700 stars, 959 forks, 6,957 commits on main, 187 named contributors, and 301 tagged releases running from v0.0.23 in June 2021 to v5.1.39 on September 16, 2026.
Three hundred and one releases in five years is roughly one a week, in public, under an Apache 2.0 license, for a product that is also a federally certified health IT module.
The bottleneck was the back end
Healthcare software has a shape problem. A monolithic electronic health record bundles the interface, the clinical logic and the data store into one system, and a company that wants a different workflow has to buy the whole thing and then argue with it. Analysts call the alternative a headless EHR: clinical data and logic behind an API, screens left to whoever is building the product. A 2026 review by Vinta Software placed Medplum alongside Oystehr, Canvas Medical, Healthie and Elation Health, and singled it out as the one you can run entirely yourself.
Regulation created the opening. The 21st Century Cures Act and the rules that followed made data movement a compliance question rather than a courtesy. One criterion, 170.315(b)(10), requires that a full export of a patient record be available in a machine readable format, in a timely way, without calling support. When Medplum certified to it in August 2023 the company counted 70 EHRs on the federal product list holding that criterion, out of 708 listed. The HTI-1 final rule followed in January 2024.
Founders who had built this before
Reshma Khilnani, Cody Ebberson and Rahul Agarwal were the founding team of MedXT, a Y Combinator Winter 2013 company that put medical images in the cloud and was acquired by Box. Khilnani holds a BS and MEng in electrical engineering and computer science from MIT, worked at Facebook and Microsoft, and spent 2021 as a Visiting Group Partner at Y Combinator. Ebberson was Director of Engineering at One Medical and Healthcare Engineering Lead at Box, and holds an MBA from Harvard.
They had shipped the same infrastructure more than once, for different employers, and the repetition is the founding story they tell. The repository went public in April 2021, more than a year before Medplum appeared on Hacker News. The code came first.
From a launch post to a certificate
In the November 2022 launch post the founders wrote that the company was SOC 2 and HIPAA compliant and was pursuing ONC and HITRUST. That is an easy sentence to write and a hard one to finish.
The clock ran like this. A standards advancement notice for the US Core implementation guide was issued in March 2023. The (b)(10) export criterion was certified in August 2023. The current mandatory disclosure lists the product as Medplum version 5, certified December 31, 2025, across 24 criteria, including transitions of care, decision support interventions, the d series of authentication and audit controls, and the standardized patient and population API at (g)(10). HITRUST e1 certification for the hosted platform at Amazon Web Services followed, assessed through Prescient Security. Every item on the 2022 list was delivered, roughly three years later.
The money side is simpler: the code is free, self hosting is free, and the hosted tiers are published at $2,000 and $6,000 a month with an enterprise tier priced on request. AWS Marketplace lists the same Production tier at $24,000 for 12 months. ONC certification appears in the pricing grid only from Premium upward, a reminder that the certificate attaches to a hosted module, not to every copy of the source.
What is proven, and what is still claimed
| Evidence | What the record shows | Source type |
|---|---|---|
| ONC certification | Number 15.04.04.3147.Medp.05.03.1.251231. Product listed as Medplum, version 5, certified Dec 31, 2025. Twenty four criteria disclosed, including b10 electronic health information export, b11 decision support interventions and g10 standardized API for patient and population services. Real World Testing plans published for 2024 and 2025. | Public record |
| Public code record | GitHub API, Sep 23, 2026: created Apr 21, 2021, Apache 2.0, TypeScript, 2,700 stars, 959 forks, 6,957 commits on main, 187 named contributors, 301 releases, latest v5.1.39 on Sep 16, 2026. | Public record |
| Published pricing | Hosted Production $2,000 a month, Premium $6,000 a month, self hosted free. AWS Marketplace lists the Production contract at $24,000 per 12 months. | Public record |
| SOC 2 Type II and HITRUST e1 | Both stated by the company. The SOC 2 report and penetration test sit behind a Vanta trust center request. HITRUST e1 covers the platform at AWS, assessed with Prescient Security. Neither attestation is public. | Company-stated |
| Named implementations | Summer Health pediatrics, built in 16 weeks. Develo pediatric EHR, self hosted. Rad AI Omni Reporting. Awell Panels with Guideway Care at a post acute provider of 180 or more facilities. Named testimonials from Thirty Madison, Ro and Flexpa. | Company-stated |
| Platform scale figures | The home page claims more than 20 million patient records, more than 120 million workflow actions and billions of monthly API calls. None are audited and no methodology is published. | Company-stated |
| Independent assessment | Vinta Software, August 2026, rates Medplum the only platform in its headless EHR field that runs entirely on your own infrastructure, and flags the operational burden that follows. | Independent |
| Securities filings | SEC EDGAR company and full text search on Sep 23, 2026 returned no filings for Medplum, and none for Orangebot, the legal entity name reported by one aggregator. Zero Form D notices. | Not found |
| Reported funding | Three databases disagree by a factor of fifty: CB Insights $6.5 million, PitchBook $550,000, Tracxn $125,000. No press release announces any round. | Sources disagree |
Read plainly: the certification and the code are checkable, and they check out. Adoption is the softer half. The named customers are real companies with named people attached, but the scale figures are unaudited, the compliance reports sit behind a request form, and an open source vendor cannot count users who never introduce themselves. The funding record is the strangest gap, and the sister page deals with it.
What to watch
- HTI-4 and CMS-0057-F. The company says it is certifying the changes needed for prior authorization and billing mandates ahead of a January 2027 enforcement date.
- Whether the certified module stays current. Real World Testing plans and results are published each year; the 2026 set is the next checkpoint.
- Contributor concentration. 187 named contributors is a real community, but 22 of them produced August 2026. The share of commits from outside the company is the number that matters.
- A first SEC filing. Any priced round under Regulation D produces a Form D within 15 days of the first sale, and would settle the database dispute at a stroke.
- Enterprise self hosting. Develo and Guideway Care run Medplum on their own cloud accounts, which generates no hosting revenue. That is where adoption has to convert.
In their words
“Working as healthcare app developers ourselves, we kept seeing organizations developing the same infrastructure over and over.”
Cody Ebberson, Reshma Khilnani and Rahul Agarwal, Launch HN post, November 2022 · Founders
“Medplum is under the Apache 2.0 license so any developer can use it for free with no strings attached. We make money through enterprise integrations, and by providing a hosted version and support.”
Launch HN post, November 2022 · Founders
“Test-driven development is your best friend in the regulated industry.”
Reshma Khilnani, CEO, The Stack Overflow Podcast, 2023 · Interview
“I think regulators often don’t really think in an open source way, and so the idea that code is different from product and those nuances are sometimes hard to navigate.”
Reshma Khilnani, The Stack Overflow Podcast, 2023 · Interview
“Sometimes people feel like open source couldn’t be HIPAA compliant because something might be exposed.”
Reshma Khilnani, The Stack Overflow Podcast, 2023 · Interview
“Medplum’s implementation is open source and we believe we are the only open source implementation of this criteria so far.”
Reshma Khilnani, on certifying the (b)(10) export criterion, Medplum blog, August 2023 · Company
“Self-hosting shifts operational burden (uptime, scaling, patching) onto your own team; the hosted tier’s pricing isn’t publicly listed.”
Vinta Software, headless EHR landscape review, August 2026 · Independent
Related companies
Sources
- Public recordONC certification mandatory disclosure
- Public recordGitHub REST API record for medplum/medplum
- Public record170.315(b)(10) EHI export test method
- Public recordHTI-1 final rule
- Public recordEDGAR company and full text search, no results
- Public recordAWS Marketplace product listing
- InterviewHow to build open source apps in a highly regulated industry
- IndependentHeadless EHRs: a deep dive into the landscape
- IndependentHeadless EHR and open source EHR comparisons
- InterviewEpisode 16, Reshma Khilnani
- IndependentCompany and funding profiles
- FoundersLaunch HN: Medplum (YC S22)
- CompanyONC Certified for (b)(10)
- Company2026 Roadmap
- CompanyMonthly Update, August 2026
- CompanySummer Health, Develo and Awell Panels case studies
- CompanyPricing, compliance, SOC 2, HITRUST and security pages
- CompanyCompany and founder profiles
Profile researched and written by Healthcare Discovery. Last updated September 29, 2026.
