Securing OpenEMR

Securing OpenEMR

Overview

With the advent of the Patient Portals, the community is now addressing the issues of how to best secure OpenEMR instances that are open to the web. Doing this requires a firm understanding of securing several parts, which at least include OpenEMR itself, Apache, MySQL, firewall, router, https, certficates, etc. A forum that began to discuss this issue can be found here. Note this document is just a work in progress; hopefully as members of the community began securing their OpenEMR instances for the web, they will place things they learned here in order to help others.

OpenEMR

After installation/upgrade consider removing(or not allowing access) to the following scripts, which are not needed for general OpenEMR use:

• library/sqlconf.php
• acl_setup.php
• acl_upgrade.php
• sl_convert.php
• setup.php
• sql_upgrade.php
• gacl/setup.php
• ippf_upgrade.php
• admin.php
• entire contrib directory

After a patch consider removing(or not allowing access) to the following scripts, which is not needed for general OpenEMR use:

• sql_patch.php