OpenEMR

Important: patient data and healthcare compliance

OpenEMR handles Protected Health Information (PHI). This image is a ready-to-run starting point, not a compliance guarantee.

Complete the steps below before you enter any real patient information. Add your own domain and TLS so the console is served over HTTPS. Follow OpenEMR's own hardening guidance. Put in place the controls that your jurisdiction's healthcare regulations require (for example HIPAA in the United States).

You are responsible for the security, privacy and regulatory compliance of the data you store in OpenEMR.

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting size. Choose a larger size for bigger or busier practices.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network and 80/tcp for the console. Also allow 443/tcp once you add TLS. OpenEMR serves plain HTTP on port 80 out of the box, so terminate TLS in front of it with your own domain before you enter patient data. The bundled MariaDB listens on 127.0.0.1 only, so port 3306 stays off the network.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for OpenEMR by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Review the dedicated data disk on the Disks tab, then select Review + create and Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:openemr-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name openemr \
  --image sac1647283583153:openemr-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Open port 80 for the console:

az vm open-port --resource-group <your-rg> --name openemr --port 80

Step 3 - Confirm the services are running

SSH in as azureuser and confirm that nginx, PHP FPM and MariaDB are all active. MariaDB listens only on 127.0.0.1:3306, while nginx serves the console on port 80.

systemctl is-active nginx php8.3-fpm mariadb openemr-firstboot

ss -tlnp | grep -E ':80 |:3306 ' | sed 's/ */ /g'

Step 4 - Retrieve the per-VM administrator password

Each VM generates its own OpenEMR administrator password on first boot. The password, the login user and the console URL are written to a root-only credentials file. Read it with sudo:

sudo cat /root/openemr-credentials.txt

Sign in to the console as user admin with the OPENEMR_ADMIN_PASSWORD from this file. On the VM itself, run sudo mariadb to reach the database directly over the local socket without a password.

Step 5 - Sign in to the clinical console

Browse to http://<vm-public-ip>/. The OpenEMR sign-in page opens.

Enter username admin and the password from Step 4, then choose your language.

After you sign in, the main clinical console opens with the calendar front and centre. The top navigation gives you access to the finder, patient records, fees, procedures, reports and administration.

Step 6 - Find and add patients

Open Patient, then the finder, or click Finder in the top navigation. Search your patient list by name, phone, social security number, date of birth or external identifier.

To register a new patient, click Add New Patient. On a fresh install the list is empty and ready for your data.

Step 7 - Configure administration and global settings

Open Admin, then Globals, to reach the configuration screen. The sections down the left side (Appearance, Locale, Features, Security, Notifications, Billing, Portal and more) control how OpenEMR looks and behaves for your practice.

Use this screen to set your locale, tune security, and configure the patient portal and connectors.

Step 8 - Confirm there are no default credentials

OpenEMR ships with a well-known default administrator login (admin and pass). The SecureAnyCloud image removes it. On first boot the administrator account is set to a unique per-VM secret, the default password no longer works, and the web installer and upgrade scripts are removed so they cannot be run again.

Verify this with the built-in round-trip check. It confirms that the per-VM administrator signs in through OpenEMR's own login form, while the default pass and common weak guesses are all rejected:

sudo mariadb --protocol=socket -uroot -N -e "SELECT CONCAT(username,' (per-VM admin account)') FROM openemr.users_secure WHERE username='admin'"

sudo bash /usr/local/sbin/openemr-cred-roundtrip.sh

Step 9 - Verify the stack and where your data lives

The MariaDB database lives on the data disk mounted at /data and bind-mounted onto /var/lib/mysql. OpenEMR's patient documents, EDI and ERA directories live on the same disk. Your clinical data is therefore kept separate from the operating system disk and travels with the VM.

Confirm the OpenEMR version, the health endpoint, the data disk and the installed schema:

sudo mariadb --protocol=socket -uroot -N -e "SELECT CONCAT('OpenEMR ',v_major,'.',v_minor,'.',v_patch) FROM openemr.version"

curl -sI http://127.0.0.1/healthz | head -1

findmnt -no SOURCE,TARGET,FSTYPE,SIZE /data;
findmnt -no SOURCE,TARGET /var/lib/mysql

Add your own domain and TLS

The appliance serves plain HTTP on port 80. Serve OpenEMR over HTTPS with your own domain before you enter any real patient information.

Front OpenEMR with your domain and a TLS certificate. You can terminate TLS with Azure Application Gateway, an nginx or Caddy reverse proxy, or a managed load balancer. Then open Admin, then Globals, and set your site address so that portal links resolve correctly.

Open 443/tcp in your NSG and restrict 80/tcp accordingly.

Security and compliance notes

• Compliance is your responsibility. OpenEMR handles Protected Health Information, and this image is a starting point, not a compliance guarantee. You must meet your jurisdiction's healthcare regulations (for example HIPAA), including access controls, audit logging, encryption in transit and at rest, and business associate agreements where applicable.
• Encrypt web traffic. OpenEMR serves plain HTTP on port 80. Put it behind your own TLS-terminating reverse proxy or Azure Application Gateway with a certificate for your domain before you handle patient data.
• Keep MariaDB private. It listens on 127.0.0.1 only and is never reachable from the network. Administer it through OpenEMR or over SSH.
• Protect the administrator password. It is unique per VM, and no known, default or blank credential authenticates. Keep /root/openemr-credentials.txt protected, and change the password from within OpenEMR if you share access. Create individual named accounts for each clinician rather than sharing the admin login.
• Installer removed. The OpenEMR web installer and upgrade scripts are removed from this image as part of its post-install hardening.
• Restrict network access. Limit inbound 80/tcp and 443/tcp in your NSG to the networks that need the console.

Trademark

OpenEMR is a project name used here for identification only. This image is an independent packaging of the open source OpenEMR software (licensed under the GNU General Public License, version 3) by SecureAnyCloud. It is not affiliated with, sponsored by, or endorsed by the OpenEMR project or the OEMR organisation.

Support

This image is maintained by SecureAnyCloud with 24/7 support. For help deploying or operating OpenEMR on Azure, contact us through secureanycloud.com.

Deploy on Azure

Launch OpenEMR on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com