OpenEMR 8 Upgrade Guide for Small Practices

If your practice runs OpenEMR 7, two things changed in 2026. First, OpenEMR 7’s ONC certification was retired at the end of February 2026, and only OpenEMR 8 is certified now. Second, the security fixes released since then have all gone into the 8.x line: no 7.0.x patch has shipped since 7.0.4 in December 2025.

This guide explains what that means for a small practice, whether you need the certification at all, and how to plan the upgrade safely: what to back up, what to check, and what tends to break. It is written for practice owners and office managers as much as for whoever looks after your server.

A note on who we are: MedTec is built on OpenEMR. This guide is neutral and practical, and everything in it comes from the OpenEMR project’s own release notes, wiki and forum, linked at the end.

What happened, in order

Date	Event
December 23, 2025	OpenEMR 7.0.4 released: US Core 8 / USCDI v5 FHIR profiles, SMART on FHIR 2.2, bulk FHIR export 2.0. The last 7.0.x release.
January 30, 2026	OpenEMR 8 certified under the ONC Health IT Certification Program.
February 11, 2026	OpenEMR 8.0.0 released, mainly as the certification release.
End of February 2026	ONC certification for OpenEMR 7 retired (the project’s release notes give February 27). OpenEMR 8 becomes the only certified version.
March 2026	8.0.0.1 to 8.0.0.3 patches, including security fixes. The project then stops patching 8.0.0; 8.1 is skipped.
July to October 2026	8.2.0 (July 8), 8.3.0 (August 18), 8.4.0 and 8.4.1 (September), 8.5.0 (October 27), the current stable release.

The practical takeaway: “upgrade to 8” today means upgrading to the current 8.x release, not to 8.0.0. The 8.0.0 line no longer receives patches either.

Do you actually need ONC certification?

Certification matters if you use your EHR to take part in a federal program that requires certified EHR technology (CEHRT). For most small practices, that means Medicare’s Merit-based Incentive Payment System (MIPS), where the Promoting Interoperability category is scored on use of CEHRT.

Small practices (15 or fewer clinicians) are reweighted automatically. CMS’s 2026 small-practice guide says Promoting Interoperability is reweighted to 0% for small practices unless they choose to submit it. If you don’t submit it, you don’t report a CEHRT ID for MIPS.
It matters more if you report Promoting Interoperability anyway, or if you take part in a Medicare Shared Savings Program ACO, where some participants still attest to CEHRT use. Check your program’s current rules.
A cash-only or non-Medicare practice has no MIPS reason to need certification, though some payer contracts may ask about it.
Running certified software isn’t enough by itself. OpenEMR’s certification page says certified use also requires EMR Direct phiMail for Direct messaging, listed at a $300 setup fee plus $150 per provider per year.

Even if you don’t need certification, the security case for upgrading stands on its own (next section).

The security case

OpenEMR’s 2026 releases fixed a steady stream of security issues, several rated critical. A few examples from the project’s published advisories:

A remote code execution flaw in the backup function (CVE-2026-32238, rated 9.1), fixed in 8.0.0.2.
A SQL injection flaw (CVE-2026-32127, rated 8.8), fixed in 8.0.0.1.
Critical issues fixed in 8.5.0, including one that could allow unauthenticated read and write access to patient records through the API, and remote code execution through ERA file upload.

The fixed versions listed in these advisories are all in the 8.x line. If your OpenEMR is reachable from the internet (a patient portal, API access or remote staff), running an unpatched version is a real risk to patient data, and HIPAA expects you to address known risks in your risk analysis.

Before you upgrade: the checklist

Write down what you run. Your OpenEMR version (Administration, About), PHP version, database (MySQL or MariaDB) and version, operating system, and how it’s installed: Docker, a Linux server, Windows (XAMPP), or a cloud package.
Check the new requirements. OpenEMR 8.4 and 8.5 need PHP 8.3 or newer and MariaDB 10.11 or MySQL 8.4 or newer. On Windows, the project’s upgrade page says XAMPP cannot run OpenEMR 8.3.0 or later, so a Windows install may need a different stack before it can move to current 8.x.
List your customizations. Custom or third-party modules, custom forms and layouts (LBF), custom templates, interfaces (labs, e-prescribing, clearinghouse) and anything your vendor changed in the code. Third-party modules are the most common upgrade problem; the project’s advice is to contact the module’s developer.
Back up everything, and test the restore. The project’s upgrade steps start by moving the old OpenEMR folder aside, but they don’t include a database dump, so add your own: a full database dump, the whole sites folder (which holds your configuration and sites/default/documents, your scanned documents and attachments), and any custom module folders. Then restore them onto a test machine and make sure you can log in and open a chart.
Upgrade a copy first. Run the upgrade on the test copy, not the live system. Check scheduling, a sample of charts, prescriptions, billing and claims, documents and any interfaces.
Pick a quiet window and tell staff the system will be down. Keep the old version’s backup until you’re sure.

Photo: panumas nikhomkhai / Pexels

How the upgrade works

On a Linux server

The OpenEMR Linux upgrade guide follows these steps, after your backup:

Move the current OpenEMR web folder to a backup folder (for example openemr_bk).
Unpack the new release, preserving file permissions (tar -pxvzf).
Copy your old sites folder into the new OpenEMR folder, and carry over custom modules from interface/modules/custom_modules.
Open sql_upgrade.php in the browser, choose the version you are upgrading from, and click “Upgrade Database”. The current release includes the database upgrade scripts for every earlier version, so one run brings an older database up to date.
Clear your browser cache and test.

On Docker

The project recommends Docker. The official image supports automatic upgrades: change the image tag to the new version and bring the container back up. Two conditions from the image documentation: it only works if your sites directory is on a shared volume, and it does not apply to patch-version upgrades. The documentation also recommends backing everything up first.

On Windows

Because current 8.x needs PHP 8.3 and MariaDB 10.6 or newer, and XAMPP can’t run 8.3.0 or later, plan for a new stack (or a move to Docker or Linux) rather than an in-place update.

Known issues people hit after upgrading

Prescriptions: after upgrading to 7.0.4 or 8.0.0, some users couldn’t add or edit prescriptions (“Incorrect DATETIME value”), especially with MySQL in strict mode. It was fixed in 8.0.0.1, another reason not to stop at 8.0.0.
Large databases: a 7.0.4 care team migration step could time out on big databases; it was fixed in 8.0.0. Allow extra time and test on a full-size copy.
A voice vendor setting that broke the interface after upgrade was fixed in 8.0.0.1.
Docker builds were described by the project’s own admin notes as unreliable for some multi-architecture setups in early 2026. Use a tested image tag.

Who should do the upgrade?

Do it yourself if someone on your team is comfortable with Linux or Docker, database dumps and restores, and you have a test machine.
Use a support vendor if you don’t. The OpenEMR project lists professional support vendors on its wiki. Ask them what version they will move you to, how they test custom modules, how long the downtime will be, and whether they will document the backup and the restore.
Cloud packages: the OpenEMR Foundation offers an AWS Marketplace “Express” edition free of charge (you pay AWS infrastructure costs). Check which OpenEMR version the listing installs before you rely on it.

Whichever route you pick, add the upgrade and its results to your HIPAA risk analysis (our guide to what the HIPAA Security Rule requires in 2027 covers the rest). For a plain-English list of the other security basics, see our cybersecurity checklist for small clinics. For how we approach interoperability standards such as FHIR and HL7, see our interoperability page.

Frequently asked questions

Is OpenEMR 7 still certified?

No. OpenEMR 7’s ONC certification was retired at the end of February 2026 (the project gives February 27). OpenEMR 8 is the certified version.

What is the latest version of OpenEMR?

As of November 13, 2026, the current stable release is 8.5.0, released October 27, 2026.

Can I upgrade straight from OpenEMR 7 to 8.5?

The current release includes the database upgrade scripts for every earlier version, and sql_upgrade.php runs them in order. Check that your server meets the 8.5 requirements (PHP 8.3+, MariaDB 10.11+ or MySQL 8.4+) and test on a copy first.

Do I need ONC certification as a small practice?

Only if you take part in a program that requires certified EHR technology. Small practices are automatically reweighted out of MIPS Promoting Interoperability unless they choose to report it.

Sources

This guide is general information based on the OpenEMR project’s public documentation as of November 13, 2026. Every installation is different and some need configuration work; always back up and test on a copy before upgrading a live system. Not legal or compliance advice.

Questions about your own setup? Book a Free Demo: a free 30-minute demo on your own workflows, no sales script.

OpenEMR 7 Lost Its ONC Certification: The Upgrade-to-8 Guide for Small Practices