Controlled substance logs and audit trails, built in.
OpenVPM provides a controlled-substance ledger with patient and lot linkage, waste-witness fields, running balances, clinic roles, and audit records for selected high-risk workflows. It is not compliance certification. Validate configuration, recordkeeping, exports, and reporting against federal, state, and local requirements.
Workspace access is immediate. Live clinic use starts as a guided pilot alongside the current PIMS. See current fit and rollout limits.
Operational Controls
OpenVPM includes clinic roles, selected high-risk audit records, and a controlled-substance ledger. These are operational controls, not compliance certification; each clinic must validate its configured process against applicable requirements.
- Controlled-substance ledger with patient linkage, witness fields, lots, and running balances
- Audit records for selected high-risk workflows
- Clinic roles and protected administrative actions
- Documented export and backup paths
Open source
The whole PIMS is AGPLv3. Read it, run it, shape it. This module is included, never gated.
Your data
Public schema, full export anytime. Your records are yours, in formats you can actually use.
Open API
Supported workflows use a versioned REST API with scoped keys and signed webhooks, backed by public source and schema.
Built for practices like yours
Use OpenVPM your way.
Self-host the full open-source PIMS for free, or let us run it for you. Same software, your choice.
Run OpenVPM on your own infrastructure. You operate security, backups, email, messaging, payments, model providers, and production validation.
- Full source under the AGPLv3 license
- All source modules and the documented API
- Docker or Vercel deployment paths
- Bring your own database, email, SMS, and AI keys
Common questions
Does OpenVPM keep a controlled substance log?
Yes. Controlled substance logging tracks a full chain of custody, with dispensing tied to the medical record and the signing user.
Is there an audit trail?
OpenVPM records selected high-risk changes and operational events. It does not claim that every field mutation is captured in a compliance-ready universal audit trail.
Can I limit what staff can see and do?
Clinic roles protect administrative and clinical workflows. Each practice must test its role assignments before go-live.
Can I export records for an inspection?
OpenVPM has documented exports and backup paths, but each clinic must validate that the available format and content meet the inspection or regulator's requirements.
See operational controls in action.
The demo is live and loaded with real-looking data. Click around, then self-host it free or let us run it for you.