for daily users of openemr in production, adding all features in daily practice what is the monthly cost if it is going to be HIPAA compliant ( including email SMS …etc) realizing it will vary from practice to practice but mainly AWS hosting ( not sure if market place has higher support than openemr 7?)
Hello @Mohammad
As you said: ‘realizing it will vary from practice to practice’, you must expand that to ‘from one OpenEMR instance to the next’. To say nothing of, ‘from one dev to the next’.
Too many factors are involved in all the permutations of the production environment to give a better answer than what we give our customers, ‘around $4000 if using GCP. Or it might be $2000, depending’. And I am not a dev but I understand that AWS is more time- consuming (therefore expensive) to work with than GCP.
And re: your remark about ‘not sure if market place has higher support than openemr 7’. The ‘marketplace’ that provides OpenEMR support is whomever you contract with to provide your support. That vendor should be able to support whatever version you have installed.
You will have to locate a vendor and request an estimate based on the specifics of your own situation to get any kind of usable answer.
And the method to use to find the best support vendors should be to contact the certified OpenEMR vendors and discuss your needs. They can be found here:
Alternatively, check out the ‘Help Wanted’ subtopic in this forum,
although those resources are not vetted for their skills or reliability.
Good luck!
- Harley
This is my August spending on GCP for both Openemr and FreePBX (Phone + Fax). This include daily backups as well. I recently added gemini API so it might be a little more in September
Good morning @Mohammad ,
I have my PBX / Fax server way before the EMR. At that time I learned that HIPAA is a process of safeguarding the PHI. Look at feaures / settings that would hardening your server. Here are some other things to consider (from Gemini):
Technical Safeguards
-
Data Encryption: PHI must be encrypted both at rest (AES-256 for databases, file systems, and volume snapshots) and in transit (TLS 1.2 or TLS 1.3 across all web, API, and internal network routes).
-
Access Control & Authentication: Every user must have a unique identifier. Servers must enforce strict role-based access controls (RBAC) and multi-factor authentication (MFA) for SSH, database, and admin panel logins.
-
Audit Logging & Monitoring: The system must generate immutable, timestamped logs capturing all access, modifications, exports, and deletions of PHI. Logs must be monitored regularly for anomalies and retained for at least 6 years.
-
Session Timeouts: System and application layers must enforce automatic inactivity logouts to prevent unauthorized access from abandoned workstations.
-
Data Integrity & Backups: Encrypted off-site backups must run continuously or on a strict schedule, accompanied by routinely tested disaster recovery and data restoration procedures.
Infrastructure & Administrative Safeguards
-
Business Associate Agreement (BAA): A legally binding BAA must be signed with any cloud provider, hosting company, or managed service provider that has potential access to the infrastructure or data.
-
Network Isolation & Security: Implementation of Web Application Firewalls (WAF), network firewalls, Intrusion Detection/Prevention Systems (IDS/IPS), and private subnets to isolate the database server from direct internet exposure.
-
Patch Management & OS Hardening: Server operating systems, software packages, and database engines must be continuously updated with security patches to close known vulnerabilities.
-
Physical Security: Data centers must feature strict access controls (biometric entry, keycard logging, 24/7 surveillance), environmental safeguards, and secure hardware disposal policies (drive wiping/shredding).
-
Risk Assessment & Vulnerability Scanning: Continuous system monitoring and regular security audits to identify operational weaknesses and threat vectors before they can be exploited.
And all that was just paper files in an office location , just that…how did we get to this point of intrusion and how far are we going?
Just on AWS, years ago, I was looking at network logs for my testing environment.
Do not be surprised if there are ping requests from various countries, at any one time.
Just as we have developed great infrastructure for the internet, we have failed to stop sharing the connection with the entire world. In fact, if there was a separate network, that healthcare could operate on, that would be amazing.
We need to do something more to protect vital resources.
Once AI and quantum computing takes off, encryption won’t matter in the wrong hands.
I am not sure if you know who developed snomed and which city and why…?
what the hell has Copenhagen anything to do with US citizen’s medical records that were kept safe in my office file cabinet on paper? aren’t we going to migrate to SNOMED from Icd10 sooner or later?