ERPNext for hospitals and clinics

How ERPNext for hospitals and clinics fits patient care and billing

Marley Health on ERPNext brings scheduling, clinical documentation, pharmacy, laboratory work and the insurance claims and billing they feed onto one self-hosted platform that you run in your own infrastructure. Most hospital and clinic operators today run these as separate systems, with patient identifiers retyped between them and charges reconciled by hand at month end. In the Marley Health model, appointments and patient encounters sit alongside inpatient admissions, medication orders, lab tests and diagnostic reports, nursing tasks, therapy plans and the emergency department, while payors and claims connect those clinical events to the accounting that ERPNext already provides. The gain is a shared patient and charge record, not a faster screen. For clinical teams, the main change is that a medication order, lab result or nursing task is entered once and is visible to the people who need it, with access governed by roles rather than by which system a user happens to log into. For finance, charges and claims come from the same encounter records that clinicians create, so revenue cycle questions can be traced back to the care that generated them. For IT, the work shifts to owning a platform: hosting, backups, identity, access reviews and upgrades become your responsibility or your implementation partner's, and they need to be planned before the first patient record is migrated. Confirm with the Marley Health documentation which modules your target version includes before you assume any workflow is covered.

Be clear from the start about who carries the healthcare obligations. Software does not make a hospital or clinic compliant. Under the HIPAA Security Rule, covered entities and their business associates are responsible for the electronic protected health information they create, receive, maintain or transmit, and the same duty applies in the EU and UK under their own regimes. DeployOpen can configure roles, set up login policies, design the hosting and integrations and prepare evidence, but the provider decides who may see which patient record, what the retention rules are and whether a vendor contract such as a business associate agreement is in place. There is no HIPAA certification to buy. Ask your compliance lead to map each Security Rule requirement to a named control, owner and piece of evidence before go-live, and treat that map as the scope of the implementation.

Healthcare requirements that shape an ERPNext build

This table maps the HIPAA Security Rule, business associate rules and ERPNext or Frappe facts to the decisions a Marley Health build has to make. Read each row as a requirement, where it comes from, and what it changes in the design, hosting or migration plan. Confirm the applicability of each rule with your privacy and legal advisers, since the HIPAA rules apply to covered entities and their business associates.

Requirement	Source	What it means for the build
Unique user identification for ePHI access	45 CFR 164.312(a)(2)(i), required	Each clinician, nurse, billing user and vendor account needs its own ERPNext user. Shared logins for nursing stations or the pharmacy counter must be replaced before go-live.
Emergency access procedure	45 CFR 164.312(a)(2)(ii), required	Define a break-glass process for reaching patient records when normal roles fail, and test it. Document who may invoke it and how the access is reviewed afterward.
Automatic logoff	45 CFR 164.312(a)(2)(iii), addressable	Set session timeouts in ERPNext and on workstations, and decide them with clinical staff. Document the chosen setting or the reason an alternative applies.
Encryption of ePHI	45 CFR 164.312(a)(2)(iv) and (e)(2)(ii), addressable	Plan encryption at rest for the database, backups and file storage, and in transit for every browser and integration path. Record the decision for each path.
Access control and need to know	CNIL decision, 3 September 2026 (GDPR Articles 32 and 34)	Role permissions in Marley Health and ERPNext should follow care team membership. Review external access paths for VPN and multi-factor authentication, as the CNIL case showed.
Business associate terms for hosting and support vendors	45 CFR 164.314(a)(2)(i)	Any hosting provider, support firm or integration vendor that handles ePHI needs a written contract requiring Security Rule compliance and incident reporting, flowed down to their subcontractors.
Incident reporting	45 CFR 164.314(a)(2)(i)(C)	Agree reporting timelines and contacts with each vendor in the contract. Build logs and alerts into the ERPNext hosting plan so incidents can be detected and reported.
Data import limits for migrated records	ERPNext Data Import documentation	The documentation advises importing only a few thousand records at a time. Plan patient, encounter and billing migrations in batches, with reconciliation checks after each one.
Server Scripts on shared hosting	Frappe Framework documentation	Server Scripts are disabled by default from version 15 and must be enabled. Frappe Cloud public shared benches do not allow them, so custom clinical logic needs a dedicated or self-hosted setup.

Which clinical workflows Marley Health covers in ERPNext

The Marley Health documentation describes a clinical layer on top of ERPNext that covers patients and practitioners, appointments, patient encounters, inpatient admission and medication orders, laboratory tests and diagnostic reports, nursing tasks, therapy plans, an emergency department, a patient portal, and insurance payors and claims. Read as a list, that scope maps the outpatient visit from registration and scheduling through the encounter, and the inpatient stay from admission through medication orders, nursing work and therapy. Before you size a project, confirm the depth of each module against the documentation for the exact Marley Health and ERPNext versions you plan to run, because a module can be listed without covering every workflow your clinicians expect.

The clinical records do not sit apart from the financial system. Encounters, lab orders and medication orders are the events that generate charges, and payor and claim records determine how those charges are billed and reconciled. On the ERPNext side, the accounting and stock modules receive the financial and inventory effects, so the decisions that matter are which clinical events create invoices, which create stock movements for drugs and consumables, and who posts the entries. Ask the implementation team to write down, for each encounter type, the document that is created, the ledger or stock entry it produces, and the person who approves it. Gaps in that mapping are usually where month-end reconciliation problems start.

Confirm three things with Marley Health and your own clinical leads before design starts: which workflows are in production use at sites similar to yours, which are still in development, and which depend on customizations you would have to maintain. The emergency department, the patient portal and the insurance claims workflow each carry their own access and data-sharing questions, so treat them as separate design items rather than assuming they follow the outpatient configuration. Document your answers, because they determine how much of the build is configuration, how much is custom development, and how much will need retesting at each upgrade.

Modules, settings and integrations to configure first

These six areas form the first configuration pass for a Marley Health deployment on ERPNext. Each one depends on the one before it, so identity and roles should be settled before clinical records are loaded, and migrated data should only enter once the clinical and billing setup has been tested.

Patients, practitioners and appointments

Set up patient master records, practitioner profiles, service units and appointment schedules before any clinical workflow goes live. Clinical leads should sign off on the practitioner roster, schedules and the fields that identify a patient. Test duplicate patient detection, double booking across practitioners, and how a cancelled or rescheduled appointment shows in the patient's history.

Encounters, admissions and medication orders

Configure encounter types, inpatient admission flows, and medication order templates that match your ward and outpatient practice. The clinical governance lead signs off on order sets and who can place or change an order. Test an encounter from registration through discharge, including a medication order that is amended after it is placed.

Laboratory and diagnostic reports

Define lab test templates, specimen handling, and the report layouts that clinicians and patients see. The laboratory director should approve reference ranges, units and result sign-off rules. Test an ordered test from collection to a released report, and confirm that a corrected result is recorded as a change rather than overwriting the original.

Payors, claims and billing into accounts

Map insurance payors, claim workflows and tariff items to ERPNext accounts, receivables and revenue accounts. The finance controller and the revenue cycle lead should sign off on account mapping and write-off rules. Test a claim that is partly paid, denied and resubmitted, and confirm the ledger balances against the claim status reports.

Identity, LDAP and role mapping

Choose between LDAP settings for Active Directory or OpenLDAP and Social Login Key for an external identity provider, then map groups to ERPNext roles. The security officer owns the mapping and the login policy. Test that a leaver loses access at the next login, that a clinician in two groups gets only the intended roles, and that TLS is enforced on the directory connection.

Legacy patient and payor data import

Load legacy patient and payor records through the Data Import tool with its downloadable templates, in small batches. The data steward signs off on field mapping, duplicate rules and a reconciliation count per batch. Test a sample batch in a non-production site first, and confirm that child table rows such as addresses or contacts attach to the correct parent record.

Outpatient clinic, inpatient ward or emergency department: different builds

An outpatient clinic is built around scheduled care: practitioners, appointments, patient encounters and the claims that follow each visit. The configuration work centers on appointment types, practitioner schedules and the encounter form that clinicians complete before billing starts. Lab orders and referrals are usually short cycles, so the main question is how results return to the encounter and who may read them.

Dominant workflows: patient registration, appointment booking, encounter documentation, lab orders and result review, and patient portal access for results or forms.
Roles needing the most care: front-desk staff who book and check in patients but should not view clinical notes, and practitioners who should see only their own encounters unless a referral applies.
Claims and billing paths: per-visit charges tied to the encounter, with payor and claim records created after the visit. Confirm how self-pay and insured visits are separated.
Integrations that matter most: the patient portal, lab systems that return results, and payment collection at the front desk.
Scheduling conflicts: check how the appointment calendar handles overbooking, cancellations and no-shows before go-live.

Before build, confirm with the clinic which visit types generate claims and which do not, and test one full visit from booking to claim in a non-production site.

Compliance questions ERPNext for hospitals and clinics must answer

A hospital or clinic running ERPNext with Marley Health holds protected health information in several modules at once. The questions below decide which rules apply, who carries which obligations, and what evidence a deployment must produce. Confirm each point with counsel and your compliance lead before scoping the build.

HIPAA Security Rule applicability

The Security Rule covers covered entities (health plans, clearinghouses and covered providers) and their business associates for all electronic protected health information they create, receive, maintain or transmit. Whether your ERPNext and Marley Health instance falls in scope depends on your role, not on the software. Confirm your status and map every module that stores patient data. The Security Rule's 18 standards and 36 implementation specifications, 14 required and 22 addressable, become the control checklist for the build.

Business associate contract terms

If your hosting provider, implementation partner or support vendor can access ePHI, 45 CFR 164.314 requires a written contract. It must require compliance with the Security Rule, flow the same terms to subcontractors that handle ePHI, and require reporting of security incidents, including breaches of unsecured PHI. Ask who signs, who hosts the database and backups, and how incident notices travel between your team and the vendor.

No HIPAA certification exists

No HIPAA certificate is issued under the Security Rule. HHS states that no standard requires certifying compliance, and that private certifications do not stop HHS from later finding a violation. Be cautious with any vendor or partner claiming HIPAA certification. The HHS Office for Civil Rights enforces the rule through complaints, compliance reviews and audits, so your evidence should be risk analyses, access logs and documented decisions that you can produce on request.

Civil money penalty exposure

For penalties assessed on or after 28 January 2026, the inflation-adjusted HIPAA civil money penalty runs from $145 to $2,190,294 per violation, with a calendar-year cap of $2,190,294 (45 CFR 102.3). Exposure grows with the number of violations, so unmanaged access to patient records in ERPNext can multiply quickly. Ask your counsel how penalty tiers apply to your organization and budget the controls that reduce the likelihood of violations.

Pending Security Rule revision

HHS proposed a major Security Rule revision on 6 January 2025 (90 FR 898). As of October 2026 no final rule has been published, and the Unified Agenda projects final action for July 2027. Design your ERPNext controls, including MFA, encryption and audit logging, so they can absorb stricter requirements without rebuilding the system. Track the rulemaking entry and ask counsel which proposed changes would affect your hosting model.

HITRUST as optional assurance

HITRUST is a private assurance framework, not a legal requirement for HIPAA. Some customers and payers ask for it as third-party evidence. Its CSF is organized into 14 control categories, and assessments are run by HITRUST-authorized assessors. Decide early whether a HITRUST assessment is commercially needed, because the scope affects how you segment ERPNext, Marley Health and the hosting environment. Confirm requirements with your customers before committing.

GDPR, NIS2 and external access

EU operators face GDPR Articles 32 and 34 on security and breach notification, and NIS2 lists health providers and medical device manufacturers as high-criticality sectors. France's CNIL fined Hopital Prive de la Loire EUR 500,000 on 3 September 2026 for external access to patient records without VPN or multi-factor authentication, and for access control that ignored care team need-to-know. Require VPN or equivalent controls, MFA and role-based access for every remote user in your ERPNext and Marley Health deployment.

21 CFR Part 11 as a conditional check

21 CFR Part 11 governs electronic records and signatures in FDA-regulated work, such as clinical research or regulated laboratory records. It applies only if your ERPNext or Marley Health records fall under FDA rules. If they do, plan validated audit trails, electronic signature controls and access records. If they do not, this rule is out of scope. Confirm applicability with counsel before adding validation work to the project plan.

Where patient data can run and who can reach it

The hosting choice comes first, because it decides which controls you can actually turn on. Frappe Cloud shared benches do not allow Server Scripts, and Marley Health workflows that depend on server-side logic for clinical or billing rules need them. Server Scripts are disabled by default from version 15 and must be enabled with the server_script_enabled setting, so a self-hosted site is the practical option when those scripts are part of the design. Self-hosting can use bench on Linux or the production images and Compose files in the frappe_docker repository, which provides separate services for MariaDB, Redis, workers, the scheduler, Socket.io and Nginx. The single-file demo setup is marked for short-lived evaluation only and should never hold patient records. Confirm with your hosting provider where backups, database replicas and logs are stored, who holds administrative access to the hosts, and whether the provider will sign a business associate agreement under 45 CFR 164.314 if it handles ePHI.

Remote access is where the French hospital case is most instructive. In September 2026 the CNIL fined Hopital Prive de la Loire EUR 500,000 under GDPR Articles 32 and 34, finding that external access to its patient record system lacked VPN and multi-factor authentication, and that access control ignored the care team's need to know. For Marley Health, treat vendor engineers, locum staff and remote clinicians as separate populations, each with a named account, a defined entry path through a VPN or zero-trust gateway, and multi-factor authentication enforced at the identity provider. Use the LDAP or Social Login Key integrations to centralize sign-in, and confirm that ERPNext's own two-factor settings apply to every login path, including API tokens. Remove vendor accounts when a support contract ends.

Role permissions must reflect the care team's need to know, not the job title on an org chart. Map Marley Health roles to what each clinician, nurse, pharmacist and billing clerk needs for a given patient, then apply User Permissions and Role Permissions so that a ward nurse cannot browse unrelated encounters or lab results. Test this with a set of named test users before go-live, and record the results as evidence. Ask your security team to confirm how access reviews, emergency access and audit logging will work, since the HIPAA Security Rule requires unique user identification and an emergency access procedure, and it treats automatic logoff and encryption as addressable specifications that you must document a decision on.

Rollout sequence for ERPNext for hospitals and clinics

The sequence moves a clinic or hospital from scoping and compliance decisions through hosting, configuration, data migration and testing to a controlled go-live, with each phase closed by a named check. It is built so clinical and billing staff validate workflows before any patient data moves into production.

Scope workflows and compliance obligations
DeployOpen and your team list the clinical and administrative workflows in scope, such as registration, appointments, outpatient encounters, inpatient admission, laboratory, pharmacy, insurance claims and billing. Your privacy or compliance lead records which regulations and contracts apply, including whether business associate agreements are needed for any hosting or support provider. Exit criteria, sign-off owners and any related assessment evidence are agreed in the written scope before build starts. Output: a signed scope document with a workflow inventory and a compliance decision log.
Design hosting, identity and access
The team selects the hosting location and environments (development, test and production) within infrastructure your organization controls, and designs backups, TLS, network paths and any external access for patients or staff. Identity is planned next: how staff sign in through LDAP or social login, how roles map to clinical and billing duties, and how two-factor authentication applies to remote access. Output: an architecture and access design that a security reviewer has accepted, with the role matrix that will be configured in the next phase.
Configure patient and encounter workflows
DeployOpen configures the Marley Health app on ERPNext for patient records, practitioners, appointments, encounters and the inpatient, laboratory, pharmacy and nursing workflows agreed in scope. Custom fields, scripts and print formats are built only where the standard workflow falls short, and each customization is recorded so it can be reviewed and upgraded later. Output: a configured test environment and a change log that clinical leads have walked through with sample cases.
Map claims, billing and accounting
The team maps payors, insurance claims, service charges and clinical events to ERPNext accounting, including receivables, payment entries and the chart of accounts structure your finance team needs. Billing staff confirm how each encounter type produces an invoice or claim and how rejected or partially paid claims are followed up. Output: a signed mapping document and a set of reconciled test transactions that finance has checked against expected results.
Migrate data in small batches
Legacy patient, practitioner, payor and open-balance records are cleaned, mapped and loaded in small batches, since the ERPNext Data Import tool documentation advises importing only a few thousand records at a time. Each batch is validated against source counts and sample records, and reconciliation differences are logged and resolved before the next batch runs. Output: a migration log with record counts, exceptions and sign-off from the data owner for each dataset.
Test with clinical and billing staff
Clinical and billing staff run scripted scenarios in the test environment, covering normal visits, admissions, lab orders, medication orders, claim submission and rejected claims, along with access tests that confirm each role sees only what its duties require. Defects are triaged by severity, retested and tracked to closure before production is considered. Output: a test report with pass results, open defects and written acceptance from the clinical and billing sign-off owners.
Go live with a fallback plan
The production cutover is run in a controlled window with a named rollback decision point, a documented fallback procedure to the legacy process and a support rota for the first days of use. Final data loads are checked against the migration log, and monitoring and backup jobs are verified before users are enabled. Output: a go-live record showing the cutover checks passed, the fallback plan retained until the agreed exit criteria are met, and the handover to ongoing support.

What hospitals and clinics ask before hiring a partner for ERPNext

What drives the cost and effort of an ERPNext implementation for a clinic?

The main drivers are the number of modules in scope, how many integrations must exchange data with clinical and billing systems, the volume and quality of records to migrate, and how many roles and approval paths need configuring. Custom Server Scripts, custom apps and print formats add build and testing effort. Ask the partner to price each module, integration and migration stream separately in the written scope. ERPNext itself is free and open source under GPL-3.0, according to the frappe/erpnext repository, so the paid work is labor, hosting and support rather than software licenses.

Which ERPNext costs are one-time and which recur each year?

One-time costs usually include discovery, configuration, integration build, data migration, testing and training. Recurring costs include hosting, backups, monitoring, security patching, minor and major version upgrades, and support. Self-hosting ERPNext is free according to the ERPNext pricing page, but your own servers, storage and staff time still recur. If you choose Frappe Cloud, the same pricing page lists shared site hosting starting at 5 US dollars per month, shared servers from 20 US dollars per month and dedicated servers from 125 US dollars per month. Confirm current rates on the pricing page before budgeting, since these are starting points and do not include implementation.

Can our internal IT team run an ERPNext deployment without a partner?

An experienced internal team can deploy ERPNext, but the work spans Linux administration, database operations, background workers, TLS, backups and version upgrades, along with healthcare-specific configuration. Assess whether you have staff for on-call support, security testing and upgrades on a schedule, and whether that capacity survives staff changes. Many organizations split the work: internal staff own day-two operations while a partner handles configuration, integrations and migration. DeployOpen plans, implements, hardens, backs up, upgrades and supports self-hosted platforms inside your own infrastructure, so either model can be scoped in writing.

What do clinical and billing staff need to contribute to the build?

Clinical and billing staff must define how work actually flows: who registers patients, how appointments and encounters are documented, how orders reach the laboratory and pharmacy, and how claims are prepared and followed up. They also decide which roles see which patient data, since access rules are configured in ERPNext and must match the care team's need to know. Plan for sign-off sessions on workflows, test scripts for each process, and a named owner for each approval. Without these decisions, configuration tends to be reworked late in the project.

Does using ERPNext or Marley Health make our clinic HIPAA compliant?

No software makes an organization HIPAA compliant. The HIPAA Security Rule applies to covered entities and business associates for the electronic protected health information they handle, and compliance depends on administrative, physical and technical safeguards that your organization operates. There is no HIPAA certification: HHS states that no Security Rule standard requires certifying compliance, and private certifications do not prevent HHS from later finding a violation, according to HHS FAQ 2003. DeployOpen prepares systems, controls and evidence for assessments but does not issue audit reports or attestations. Ask whether a business associate contract is needed before any partner accesses ePHI.

Can we import all migrated patient records in one step?

Usually not. The ERPNext Data Import tool loads CSV or Excel files and supports child table rows, but the documentation advises importing only a few thousand records at a time. Large patient, encounter and billing histories therefore need batching, validation against a staging copy, reconciliation of counts and totals, and a planned cutover. Decide early which historical data must move and which stays in an archive, because the answer changes the migration effort. Ask the partner to describe its validation method and rollback approach in the written scope.

What should a written quote for a clinic ERPNext project include?

A useful quote lists the modules in scope, each integration with its data direction and frequency, the migration sources and record types, and the environments to be built. It should name the deliverables, acceptance tests, training, go-live support and handover documentation. Require separate line items for hosting setup, backups, monitoring, security testing and any retainer for upgrades and support. Ask what is excluded, which assumptions the timeline depends on, who is responsible for clinical sign-off, and what a change request costs. Most DeployOpen engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts.

How DeployOpen scopes and delivers an ERPNext healthcare build

DeployOpen plans, implements, customizes, integrates, hardens, documents and supports self-hosted open-source platforms inside your own infrastructure, including ERPNext with the Marley Health app for hospitals and clinics. Engagements are fixed-scope, so the scope, deliverables and timeline are agreed in writing before any build work starts.

How we scope

Map your patient, billing, lab, pharmacy and accounting workflows to the Marley Health modules you intend to use.
Record in the written scope which hosting location, identity source and integrations are in and out of the engagement.
Confirm with your compliance and privacy leads which HIPAA or other obligations apply before data design begins.
Agree the data migration sources, record volumes and cutover approach as named deliverables in the scope.

How we build

Deploy ERPNext and Marley Health in infrastructure you control, using the installation method agreed in the scope.
Configure roles, permissions and login policies so access follows each care team's need to know.
Build the integrations agreed in scope, with test data and documented field mappings for each interface.
Test workflows end to end, including appointments, encounters, orders, claims and audit logging, before any go-live decision.

How we hand over

Deliver configuration records, custom app code, integration specifications and access model documentation to your team.
Provide runbooks for backups, restores, upgrades and the security settings your operators must maintain.
Walk your administrators and super users through the system and the procedures they will run after go-live.
Document the evidence your compliance team may need, while noting that independent auditors make any assessment.

How we support

Offer ongoing support, upgrades and continuous testing as a retainer, scoped separately from the build.
Plan upgrades against the ERPNext and Marley Health release history, testing each step in a non-production environment first.
Ask for a written quote that lists the build, testing, documentation and retainer components as separate line items.
Review the support scope yearly so it reflects new modules, integrations and changes to your regulatory obligations.

ERPNext for hospitals and clinics with Marley Health