OpenEMR AWS cloud packages vs self-hosted OpenEMR

In a self-hosted deployment, your team or your implementation partner owns every OS, web server, PHP and OpenEMR upgrade, and testing those changes against your own customizations and integrations is your responsibility. Recent OpenEMR releases require PHP 8.3 or later and run on a MySQL- or MariaDB-compatible database, so the PHP runtime is a version you must plan around. The AWS packages describe AWS minimum charges and support routes, but the data sheets do not settle how far the package operator patches the application for you. Ask the package provider, in writing, which layers they patch, how they test OpenEMR releases, and who approves a major upgrade. Effort rises with the number of custom modules, interfaces and third-party connections that must be retested after each release.

Backups are a recurring duty in both models, and a restore that has never been tested is not a backup you can rely on. Self-hosting puts the schedule, storage location, encryption, retention and restore drills on your team. A cloud package may include managed database snapshots through Amazon RDS, but you still need to confirm backup retention, cross-region copies, restore time and who runs a test restore. Effort grows with database size, the number of environments, document storage under the documents directory and how often you must prove recovery to an auditor. Ask for the backup schedule, retention period, encryption key handling and the last documented restore test before you sign.

You need to collect, store and review application, web server, database and access logs, and retain them for the period your policies require. The AWS packages list CloudTrail among the services used, which records AWS API activity, but CloudTrail does not replace application-level logs such as OpenEMR user access or patient record views. In self-hosting, your team selects the log pipeline, sets alert thresholds and pays for storage. Effort rises with the number of users, the volume of patient record access and the need for centralized review. Ask the provider which logs are shipped, where they are stored, who can read them and how long they are kept.

Yes. The OpenEMR website states that OpenEMR is ONC certified and told users to upgrade to version 8 by March 1, 2026 to maintain their system's active certification. Certification is a property of the software version you run, so falling behind on upgrades can leave a deployment outside the certified version. Both models require someone to track release timing, plan the upgrade and retest workflows. A cloud package does not remove your responsibility for confirming which version is live and whether your configuration still matches what was certified. Confirm with the project and your certification contacts which version your organization must run and how long you have to move.

Your organization owns incident response for its electronic protected health information in both models, because the HIPAA Security Rule places obligations on covered entities and their business associates. The AWS package provider may help with infrastructure events, but a business associate contract under 45 CFR 164.314(a)(2)(i) must require the vendor to report security incidents to you, and that contract should be checked before go-live. Self-hosting means your team runs detection, containment, forensics and notification decisions, or contracts a partner to do so. Ask the provider for its incident notification timeline, who is on call, which evidence it preserves and how it coordinates with your own response plan.

Effort is driven less by the license, which is GPL v3.0 with no licensing fee, and more by the number of environments, customizations, integrations, users and data volume. A cloud package moves infrastructure tasks such as provisioning and some backups to the provider, but it adds cost and dependency on AWS services and contract terms. Self-hosting gives you control over the stack and location but places more work on your staff or partner. Other factors include the depth of your FHIR and SMART integrations, the number of identity sources such as LDAP or Active Directory, and how often you must produce compliance evidence. Ask each provider for a written responsibility matrix that maps every task to a named party.

Ask for a written list of the tasks, the party responsible for each, the frequency and the evidence produced. For AWS packages, ask which AWS charges are passed through at the listed minimums of $10 per month for Express and $75 per month for Standard, as the data sheets describe these as Amazon Web Services charges rather than OpenEMR fees, and ask what is excluded. For self-hosting or a partner engagement, ask for the scope of patching, backup testing, monitoring, certification tracking and incident support, and whether ongoing support is a fixed-scope deliverable or a retainer. DeployOpen plans, implements, hardens, backs up, upgrades and documents self-hosted platforms inside your infrastructure, and quotes follow from a written scope.

The AWS minimum charges are Amazon Web Services charges, not OpenEMR fees. The OpenEMR Cloud data sheets list a minimum of $10 per month for the Express package and $75 per month for the Standard package, and state that the software itself has no licensing fees. The Standard data sheet lists EC2, EBS, CloudFormation, VPC, S3, KMS, IAM, CloudTrail and RDS among the services used, so your monthly bill will depend on compute, storage, database, logging and data transfer consumed beyond those minimums. Confirm the current AWS pricing for your region and usage, and ask the package provider exactly which services and sizes the quoted figure assumes.

No. Using a cloud package does not transfer your HIPAA obligations to AWS or to the package provider. The HIPAA Security Rule applies to covered entities and business associates for all electronic protected health information they create, receive, maintain or transmit. AWS's role is shared responsibility, so you still own the risk analysis required under 45 CFR 164.308(a)(1)(ii)(A), access control, user management, audit review and the configuration of the application. Before signing, confirm whether the provider will sign a business associate agreement that meets 45 CFR 164.314(a)(2)(i), and confirm which AWS services are covered under your arrangement. HIPAA has no certification, so ask for evidence of your controls rather than a badge.

No researched figure for migration duration is available, so confirm it in writing with the vendor or consultant against your own environment. The main drivers are the database size and the number of custom modules, interfaces and integrations, the volume of documents stored in the sites directory, the number of users who need re-authentication after an identity change, and the testing needed to validate billing, scheduling and reporting after the cut-over. Ask for a written plan with phases, rollback steps and a clear list of what is out of scope before you agree on any date.

It can, if the team has the skills for the work that recurs. A self-hosted deployment needs someone to own the server or container platform, database backups and restores, TLS, patching of OpenEMR and its PHP runtime, and monitoring. Recent OpenEMR releases require PHP 8.3 or later and run on a MySQL- or MariaDB-compatible database, and the project offers Docker deployment options. Security releases such as 8.3.0 and 8.4.0, which fixed vulnerabilities in FHIR APIs, billing and the patient portal, mean upgrades are not optional. The Securing OpenEMR guide also asks you to limit access to HTTPS, remove setup.php after installation, block direct web access to sites/*/documents, and enable multi-factor authentication. Assess whether your team can keep those controls running every month, not just at go-live.

Ask for a written scope that lists the environments, the deployment target, the data migration, the integrations, the identity setup and the documentation you will receive. DeployOpen works on fixed-scope engagements where scope, deliverables and timelines are agreed in writing before work starts, and it does not publish a price list, so the quote follows from that scope. Ask which items are one-time work and which recur, such as upgrades, backups testing, monitoring and retainer support. Ask what the quote excludes, who holds the cloud or data center accounts, how the acceptance criteria are defined, and what evidence you will get for your risk analysis and control reviews. DeployOpen prepares systems and evidence for compliance assessments but does not issue audit reports or certifications, so confirm that boundary in writing.

Self-hosting tends to fit organizations that already run their own infrastructure, need to place the system in an existing data center or air-gapped network, or need control over network design, identity integration and retention. It can also suit teams that want the AWS minimum charges to be replaced by their own hardware or hosting contracts. The trade-off is that you carry the operating work and the evidence burden directly. An AWS package can fit smaller practices without an operations team, provided they accept the shared responsibility model and confirm what the provider manages. Compare the total running cost, including staff time for patching and backups, against the package charges before deciding.

Check how users will sign in before you commit to a hosting model. OpenEMR added LDAP and Active Directory login in version 6.0.0, which validates passwords against the directory but still requires the user to exist in OpenEMR. Google Sign-In arrived in version 6.1.0. Version 6.0.0 also added password length limits, a strong password rule, reuse prevention for up to 5 prior passwords, expiration settings and a choice of Bcrypt, Argon or SHA512 hashing. Confirm that your chosen hosting model can reach your directory securely and that multi-factor authentication is configured as the Securing OpenEMR guide recommends. Identity design is often where migration and security reviews take the most time.