Hi great to be here! I am potentially looking at building out an EHR, and was wondering what inheritance of ONC and SOC2 looks like? I see that in the pricing page discusses SOC for hosted, but wanted to understand a bit more. Thanks!

For SOC 2, if you are using our hosted, then you are good to go regarding SOC 2. Medplum customers can request SOC 2 report and Pen test if you need them.

What is the practical difference between those two options?

Is the EHR for internal use? Or do you want to sell it to others? If the latter, may consider a listing yourself. Otherwise listing Medplum as a dependency seems fine.

I would like to sell it to others. Would love to hop on a call if you are willing!

do you have a website? maybe we can prep something relevant!

tbh not really - very early stage founder trying to decide if I should build an emr with a lot of AI things on top or just build a product as a sidecar/integration to existing emrs. Have had several customers who I pitched my product to and they ask for an entire emr, and wanted to get a better understanding of what that would entail if I built with medplum

Got it! So the scope matters a great deal. I'd recommend browsing through this repo for some background https://github.com/medplum/foomedical-provider