How to Build a Custom Healthcare App Without Epic or Cerner Lock-In

For decades, if you wanted to build anything on top of a patient records system, you had two realistic choices, and both were painful. You either bought into a giant like Epic or Cerner, accepting their workflows, their timelines, and their control over your data, or you built everything from scratch and spent years reinventing the plumbing that healthcare software needs. Neither option suited a practice or a young digital health company that wanted to build something specific and modern without a seven-figure budget.

Medplum exists to remove that trade-off. It is a free, open-source healthcare platform that gives developers the compliant, standards-based backend of a modern electronic health record, the secure database of patient information, the interoperability, the permissions, the audit trails, without forcing them into the rigid workflows and vendor lock-in of the big enterprise systems. Increasingly, teams building custom clinical products are choosing Medplum precisely because it hands them the hard foundational parts for free and then gets out of the way.

This guide explains, in plain language, what Medplum actually is, why the word "headless" matters, how it compares to Epic and Cerner, and where it fits for a practice or founder thinking about custom healthcare software or AI. You will never need to write a line of code to make good decisions here.

The Free Foundation That Makes This Possible: Medplum, in Plain English

The clearest way to understand Medplum is to separate two things that traditional EHRs bundle together: the screens that clinicians click through, and the engine underneath that stores and organises all the data.

Epic and Cerner give you both, fused together. You get their screens and their engine as one package, and you largely take it as it comes. Medplum gives you only the engine, and lets you build whatever screens you want on top. This is what the industry calls a "headless" platform: a powerful, compliant backend with no fixed front end attached, so builders can design the exact experience their patients and staff need.

That engine is a serious piece of infrastructure. Out of the box, Medplum provides:

• A secure, compliant database for patient information, built natively on FHIR R4, the modern international standard for structured health data
• Ready-made handling of the things every healthcare app needs but nobody wants to build twice: user accounts, permissions, audit logging, and secure access
• Interfaces (APIs) and developer kits (SDKs) that let a team connect their own applications, websites, or AI tools to the data cleanly

Because it is built on FHIR from the ground up, Medplum speaks the same language as the rest of the modern healthcare world, which makes connecting to labs, other systems, and AI far simpler than wrestling data out of an older closed platform.

And it is open source. The entire codebase is public on GitHub, so any team can inspect exactly how it works, run it on their own servers, modify it, and avoid being locked into a vendor's black box. There is no licence fee to use it. Medplum offers paid hosting for teams that would rather not run the infrastructure themselves, but the platform itself is free.

Why "Headless" Is the Whole Point

The headless idea sounds technical, but its consequences are entirely practical and worth understanding, because they explain why teams pick Medplum over the giants.

When you buy a traditional all-in-one EHR, you inherit its worldview. Your workflows bend to fit its screens. Adding a feature it does not offer can mean waiting on the vendor's roadmap, paying for custom development through their channel, or simply going without. Your patient data lives in their system, in their format, accessible on their terms.

A headless platform flips this. The data and the compliant foundation are yours, running where you choose, in an open standard. The experience on top, what your staff see, what your patients interact with, the AI you layer in, is built to your requirements rather than inherited from a vendor. For a digital health startup building a novel product, or a practice that wants a genuinely tailored patient experience, this is the difference between building what you actually envisioned and settling for what a giant system permits.

This directly connects to a pattern we see constantly in our work: vendor lock-in is one of the most underestimated risks in healthcare technology. It is not only a pricing problem. When your core patient data and business logic live inside a system you cannot inspect, cannot easily export from, and cannot connect to on your own terms, the vendor's constraints quietly become your constraints. Every future project, every integration, every AI initiative has to negotiate with that closed system first. Medplum's open, standards-based, self-hostable design is a direct answer to that risk: your data stays in an open format you control, which keeps every future option open too.

How Medplum Compares to Epic and Cerner

It is important to be fair here, because Medplum and the enterprise giants are not really competing for the same job.

Epic and Cerner (now Oracle Health) are complete, clinician-facing enterprise EHRs. They come with fully built workflows, deep clinical features refined over decades, established support, and the scale to run a large hospital system. For a big health system that needs a proven, all-inclusive clinical system with a vendor to hold accountable, they are the default for good reason. They also now offer modern FHIR APIs, so they are far from closed off, but their strength is the complete packaged product.

Medplum is not trying to be a packaged clinician EHR you buy and switch on. It is a foundation for teams that want to build something custom: a specialised digital health product, a novel patient-facing app, an AI-driven workflow, or a tailored system for a specific type of practice. Its strength is flexibility and control, not out-of-the-box clinical workflows.

The honest guidance: if you need a complete hospital EHR tomorrow with a vendor accountable for everything, that is Epic or Cerner territory. If you are building something specific, want to own your data in an open format, and value flexibility and cost control, Medplum is likely the better foundation.

Why Medplum Matters for AI

There is a specific reason Medplum keeps coming up in AI conversations, and it ties directly to a simple test we give every business owner who asks whether AI can realistically work with their systems.

The test is this: look at the core tools your practice runs on and ask, for each one, does it offer a proper, documented way for other software to connect to it, an API? If the answer is yes, an AI agent can almost certainly work with it cleanly, because there is a formal, stable doorway built for exactly that purpose. If the answer is no, integration is still possible but becomes fragile and expensive, because the AI has to operate the software the clumsy way, through the screen a human would use.

Medplum is, in effect, a platform designed to be all doorway. It is API-first and FHIR-native, which means AI tools connect to it through a clean, documented, standards-based front door rather than climbing through a window. For any practice or company that expects to layer AI onto its patient data, whether that is an intelligent patient intake and front-desk assistant, a clinical summarisation tool, or a custom agent, building on a platform like Medplum makes those future AI projects dramatically smoother and cheaper than trying to bolt AI onto a closed legacy system.

This is the practical upside of choosing an open, standards-based foundation: you are not just solving today's records problem, you are keeping the door open for every AI initiative you might want next.

Medplum and Compliance: HIPAA, GDPR, and Data Control

Compliance is where a platform choice has real teeth, and Medplum's design is genuinely strong here, with the usual honest caveat.

HIPAA. Medplum is built to support HIPAA-compliant deployments. It provides the technical safeguards HIPAA expects: access controls, audit logging of who touched what, and secure handling of protected health information. Crucially, because you can self-host it, you can keep all patient data inside your own controlled environment, avoiding third-party data flows entirely. If you use Medplum's hosted option instead, that becomes a business associate relationship requiring the appropriate agreement, exactly as with any cloud vendor. The point most practices miss: HIPAA compliance is never granted by software alone. Medplum gives you the tools and the architecture to be compliant; your team's configuration, access policies, and operational discipline complete the picture. Our guide on whether ChatGPT is HIPAA compliant explains this software-versus-configuration distinction in more depth.

Data sovereignty and GDPR. Because Medplum is self-hostable and stores data in an open format you control, it fits neatly with data residency and sovereignty requirements, including GDPR for EU and UK patients. You decide where the data physically lives and who can reach it, rather than accepting a vendor's default. This is the same on-premises-versus-cloud consideration we cover in our comparison of cloud AI versus local AI for medical practices.

The open-source trust angle. There is a quiet compliance advantage to open source that closed systems cannot match: you, or an expert acting for you, can actually inspect how the software handles data. Nothing about its security or data flows is hidden behind a vendor's walls. For a security-conscious practice, that transparency is a meaningful reassurance.

Getting Value From Medplum: A Practical Path

Here is the honest reality, and it is the same for every powerful open platform. Medplum is free and excellent, but it is a builder's foundation, not a switch-on product. Getting value from it requires a capable technical team, either yours or a partner's. Handing a foundation like this to someone without genuine technical fluency is where projects stall.

The most reliable projects we see have one thing in common: a person who is fluent in both the clinical goal and the technical build sits at the centre, translating what the practice actually needs into what the platform should do. A generic consultant who hands you a list of tools is not the same as someone who can specify the exact data model, the exact permissions, and the exact integrations your product requires and then build them. That role, whether it is on your team or your partner's, is the single biggest predictor of success.

A sensible path:

1. Decide what you are building. A custom patient-facing app? A specialised system for your type of practice? An AI-driven workflow on top of your records? Medplum is the foundation; the product vision has to come first.

2. Confirm the compliance model. Self-host for maximum control, or use Medplum's hosted option with the right agreement in place? This choice shapes your whole data architecture.

3. Put a genuinely technical owner on it. Someone who understands both FHIR and your clinical goal steers the build. This is not a task for a non-technical project manager alone.

4. Build incrementally and test safely. Prove the product against synthetic data before real patient records are ever involved, the same staged discipline we apply to every deployment.

Open Source vs. Commercial: What Are the Paid Alternatives, or Should You Build In-House?

If you need a records backend, you generally have three paths: license a giant, build everything yourself, or use an open, FHIR-native foundation like Medplum. It is worth knowing what each actually costs.

Epic is often cited around $1,200 per user, with a single-hospital implementation taking 12 to 24 months and multi-hospital rollouts stretching 3 to 5 years. Oracle Health (Cerner) starts around $25 per user per month for smaller cloud deployments, but full-scale hospital implementations run from $1.5 million to over $13 million. Beyond the big two, HealthIT.gov estimates general EMR software purchase and installation costs of $15,000 to $70,000 per provider, which is the realistic range for many mid-sized commercial deployments.

Building from scratch is the other extreme: standing up your own compliant, FHIR-capable, audited patient-records backend, the access controls, the audit logging, the interoperability, is a multi-year engineering undertaking even for a well-funded team, and most of that work is not differentiated for your product, it is table stakes every healthcare system needs.

Medplum sits between these two paths. The self-hosted community version is free, and Medplum's own hosted cloud plans start around $2,000 per month, a fraction of an Epic or Cerner enterprise contract and far faster than building the compliant backend yourself. For a practice or digital health team building something genuinely custom, this middle path, take the free or low-cost standards-based foundation and spend your engineering budget on the part that actually differentiates your product, is usually the economically sound choice.

Frequently Asked Questions

What is Medplum in simple terms?

Medplum is a free, open-source healthcare platform that gives developers the compliant backend of a modern electronic health record: a secure, standards-based database for patient information, plus the permissions, audit trails, and connection points that healthcare apps need. Unlike Epic or Cerner, it does not come with fixed screens or workflows. Teams use it as a foundation to build their own custom clinical products, patient apps, and AI tools on top.

Is Medplum really free?

Yes, the platform is open source and free to use, with the full source code public on GitHub. There is no licence fee. Medplum offers an optional paid hosting service for teams that would rather not run the servers themselves, but you can also self-host it at no software cost. The main investment in a Medplum project is the technical expertise to build your product on it.

How is Medplum different from Epic or Cerner?

Epic and Cerner are complete, ready-to-use clinical systems with their own built-in screens and workflows, suited to large health systems that want an all-inclusive product with vendor support. Medplum is a "headless" platform: it provides only the powerful backend engine, letting teams build their own custom experience on top. Medplum offers far more flexibility, lower cost, and full data control, while Epic and Cerner offer complete out-of-the-box clinical functionality.

Is Medplum HIPAA compliant?

Medplum is designed to support HIPAA-compliant deployments and provides the necessary technical safeguards: access controls, audit logging, and secure data handling. Because you can self-host it, you can keep all patient data inside your own environment. However, no software is automatically compliant on its own; your configuration, access policies, and operational practices complete the compliance picture. If you use Medplum's hosted option, a business associate agreement applies as with any cloud service.

Why is Medplum good for AI projects?

Medplum is API-first and built on the FHIR standard, which means AI tools can connect to your patient data through a clean, documented, standards-based interface rather than the fragile workarounds needed for closed legacy systems. If you expect to add AI to your records, an intake assistant, a summarisation tool, a custom agent, building on an open, connectable platform like Medplum makes those AI projects significantly smoother and cheaper.

Do I need developers to use Medplum?

Yes. Medplum is a foundation for building custom software, not a finished product you switch on, so it requires a capable technical team, either in-house or through a partner. The most successful projects have someone fluent in both the clinical goal and the technical build steering the work. Most practice owners engage a technical partner to design and build on Medplum rather than doing it themselves.

The Bottom Line for Your Practice

Medplum represents a genuine shift in what is possible for practices and digital health teams that do not want to be boxed in by the enterprise giants. It hands you the hard, compliant foundation of a modern records platform for free, in an open standard you control, and then lets you build exactly the product, experience, or AI workflow you actually want on top.

It is not the right answer for everyone. If you need a complete, packaged hospital EHR with a single vendor accountable for all of it, Epic or Cerner remain the sensible choice. But if you are building something specific, care about owning your data in an open format, want to keep every future AI option open, and value flexibility over a one-size-fits-all package, Medplum is one of the strongest foundations available, and its price is zero.

The one requirement is honest: it is a builder's platform, so it needs genuine technical expertise to turn into value. If you are considering a custom healthcare product or an AI-enabled workflow and want it built on an open, future-proof foundation, ValueStreamAI's healthcare team can help you scope and build it. Start with our AI for Medical Practices hub, compare it against the established open EHR in our OpenEMR buyer's guide, or get in touch to talk through what you want to build.

The foundation is free and modern. The value comes from building on it well.