Skip to main content

Medplum Monthly Update - August 2026

· 21 min read
Reshma Khilnani
Reshma Khilnani
Medplum Core Team

PlumCon 2026 is this Thursday, September 3, in San Francisco. The agenda is posted. General registration has closed, but waitlist spots are available.

On August 1 we hosted the YC x Medplum Hackathon at the Y Combinator office in San Francisco, where 160+ hackers built on Medplum in a day. Read the recap.

It was a heavy month of shipping: 183 commits from 23 contributors and nine patch releases, v5.1.28 through v5.1.36.

DICOM moved to Beta, scheduling got its own React package and a mountable booking workspace — the fastest path yet from empty project to a working calendar. Terminology got its 2026 refresh with multi-language display support, and externally issued JWTs can now authenticate against a specific project rather than the whole server.

All of this continues to drive forward our 2026 roadmap priorities.

Features​

Scheduling​

Philip Knott Philip Knott and Noah Silas Noah Silas

Scheduling was the largest area of the month. The work that had been living inside the Provider App became a package of its own, and a complete booking flow was built on top of it:

  • @medplum/react-scheduling — A dedicated React package for scheduling UI, separate from @medplum/react. Scheduling components carry more domain logic than a typical component library, and they now version and ship on their own, with a Storybook section to browse them
  • The Scheduling Workspace — A single top-level component that mounts an entire scheduling workflow. A team that wants a working calendar can render one component rather than assembling the pieces, and it is designed as an evolving shell for our best scheduling experience rather than a fixed layout
  • A complete booking form — Booking now runs end to end inside the workspace: gather the criteria, find a time, attach the appointment details, and book. The supporting pieces landed alongside it — a service select component, an actor selection field with a proposed-appointments hook, and appointment time cards for a day
  • Multi-schedule calendar — A calendar widget that renders several schedules at once, which is how a practice with multiple practitioners or rooms actually looks at its day
  • Availability in the calendar — CalendarDateInput gained month navigation, availability marking, and range selection, and the Provider App shows an availability overlay while scheduling so open time is visible during booking rather than discovered by trial
  • Shared primitives — Service type utilities and scheduling duration units moved into @medplum/core, and useSchedulingResources was extracted from the Provider App, so a team building its own calendar uses the same resource loading and units the Provider App does
The Scheduling Workspace component rendering a full scheduling workflow Booking form inside the scheduling workspace, gathering criteria and finding a time Multi-schedule calendar widget showing several schedules side by side

Imaging and DICOM (Beta)​

Cody Ebberson Cody Ebberson

DICOM moved from Alpha to Beta this month, and the announcement post covers the reasoning in full. The short version: a modality on a hospital network can send a study to Medplum over the DICOM network protocol, the study is stored as ordinary Medplum resources under the project's existing access policies, and a DICOMweb viewer reads it back — with no image server in the middle. August's work was about making it hold up under real data:

  • Ingestion at volume — Stored instances are de-duplicated, study-level aggregates are computed so a study summarizes without walking every instance, and search results paginate
  • Bulk upload — The CLI uploads directories and glob patterns via STOW-RS, so an existing archive can be moved in without a per-file script
  • On-premise ingest — DICOMweb was added to the Agent, which is how a modality inside a hospital network reaches Medplum without exposing the server
  • Viewing — Studies open in the OHIF viewer directly from the chart

Provider App​

David Yanez David Yanez and Noah Silas Noah Silas

The Provider App picked up a billing surface, patient-mediated record import, and a round of interaction polish (roadmap):

  • Billing settings — A billing settings area with a payer directory, behind a feature flag while it settles. Claims can carry an explicit billing provider, and eligibility checks run from the Provider App using CoverageEligibilityRequest/$submit rather than a separate tool
  • SMART Health Links — A modal for creating and sharing SMART Health Links, plus an import page for bringing a shared record in. This is the patient-mediated exchange path: a patient hands over a link, and the record arrives in the chart
  • Labs — A revoked status for lab results, completed DiagnosticReport criteria widened so more finished reports are recognized as finished, a branded PDF fallback when a lab supplies its own report layout, and DiagnosticReportDisplay surfaced in encounters and tasks where the result matters
  • Encounters — Encounters moved to ResourceBoard, and encounter edits use PATCH instead of a full update, which avoids clobbering concurrent changes to the same encounter
  • Quick actions — A spotlight command surface with keyboard shortcut hints, so common actions are reachable without hunting through menus
  • Consistent modals — A shared modal component adopted across the Medplum App and Provider App, replacing several one-off implementations
  • Patient summary — Goals and immunizations now appear in the patient summary
  • Fixes — An infinite redirect in the patient Messages tab was resolved (with a regression test), the e-prescribe sync toast dismisses when leaving the Meds tab (Finn Bergquist), and a loader shows while the e-prescribe iframe is loading
Billing settings with the payer directory in the Provider App SMART Health Link creation modal in the Provider App Spotlight quick actions with keyboard shortcut hints

Terminology​

Matt Willer Matt Willer

August was the 2026 terminology refresh, and the post has the full detail. The theme was internationalization and getting large code systems to behave:

  • Multi-language displays — Database migrations for terminology i18n, and a fix to the displayLanguage filter on ValueSet/$expand, so a code system can carry displays in more than one language and expansion returns the right one
  • SNOMED-to-ICD mapping — ConceptMap/$import and ConceptMap/$translate were prepared for SNOMED-to-ICD mapping, which is the translation most billing and quality-reporting workflows need
  • Expansion at scale — $expand queries run against the reader database, a maximum token count bounds typeahead expansions so an unbounded query cannot saturate the writer, and extended statistics on coding properties help the planner choose better plans
  • Resolution order — Terminology resource resolution order was updated so the intended code system wins when several could match

Revenue Cycle and Billing​

David Yanez David Yanez

Revenue cycle work continued closing the loop between a submitted claim and its resolution:

  • Claim status tracking — Claim status is reported through ClaimResponse, so a submitted claim's progress is readable from the resource rather than from a vendor console
  • Payer directory — A directory of payers behind the billing settings surface, so a claim is built against a known payer rather than free text
  • Eligibility refinements — Service type code handling in the eligibility path, with a sensible default category when a request arrives without a service type code, so an eligibility check does not fail on an omission the caller cannot always supply
  • Claims routing — Billing and rendering providers resolve from the Claim itself across every configured claims processor, so the same claim produces the same result regardless of which clearinghouse handles it
  • Preauthorization permissions — Preauthorization no longer requires client read permission (Maddy Li)

FHIRcast and the Agent​

Derrick Farris Derrick Farris

FHIRcast — the standard for keeping separate clinical applications on the same patient and encounter — got a substantial round of work, alongside the on-premise Agent:

  • Client reconnection — The FHIRcast client's WebSocket reconnects on drop, so a context subscription survives a network blip instead of silently going stale
  • Subscriber event tracking — Each subscriber's events are tracked and confirmed, which turns context synchronization from fire-and-forget into something with a record of what was delivered
  • Version-safe context updates — A context update applies only to the version it was built on, so two applications updating context simultaneously cannot overwrite each other
  • STU3 route aliases — FHIRcast STU3 routes are aliased at /api/hub, and the legacy unsubscribe endpoint field is accepted, so existing clients connect without modification
  • Logical channels on the Agent — A channel can now process messages in parallel through logical sub-channels, which lifts throughput on a busy HL7 interface without running multiple channels
  • Interface configuration guides — New guides for high-throughput HL7 channels and ASTM channel configuration, plus test coverage for a Beckman AU serial record on the byte-stream channel

Enterprise: Sharding, Database, and Scale​

Matt Long Matt Long, Matt Willer Matt Willer, and Karl Pietrzak Karl Pietrzak

Enterprise scale and infrastructure work laid groundwork for horizontal database scale and hardened the shutdown and recovery paths:

  • Logical shard routing — Repository can now hold one connection per shard and route each operation to the right one based on the resource types it declares. Resource types are either global (readable before the project is known) or project-scoped (living on the owning project's shard), and an operation that would span shards throws rather than silently splitting. Production behavior is unchanged — every project resolves to the global shard today — but the routing layer is in place for a second database to become reachable
  • Index operations — A Super Admin endpoint to rebuild database indexes, and an index bloat page for seeing which indexes need it
  • Graceful shutdown — Database pools drain proactively on shutdown and server queues close sequentially, so a deploy finishes in-flight work instead of severing it
  • Reader resilience — The health check passes when the reader database is unavailable, so losing a read replica degrades performance rather than taking the server out of rotation
  • Search performance — Quadratic query string parsing on duplicate parameters was fixed, search filters are de-duplicated, chained search by _compartment works correctly, and MemoryRepository supports chained search so tests match production
  • Throughput — A redundant deepClone was dropped from the subscription worker, attachment rewriting is skipped for resources with no attachments, and Binary reference extraction was re-implemented for performance
  • Data warehouse observability — OTEL metrics for data warehouse sync, so an analytics export can be watched rather than inferred
  • Bulk import — Bulk import recognizes rate limits and retries instead of failing the batch (Cody Ebberson)

Identity and Access​

Cody Ebberson Cody Ebberson and Ian Plunkett Ian Plunkett

  • Project-scoped external JWT authentication — Medplum can accept an externally issued JWT as a bearer token when the target project is identified by a project-scoped API URL. Some external systems issue valid tokens that identify the issuer but carry no Medplum project, membership, or profile — the ONC Inferno CRD validator among them. Previously the same issuer could not be routed safely to different projects without a hardcoded mapping that worked for exactly one tenant. Project-scoped API routes supply the missing signal, and verification settings resolve from a ClientApplication in that project
  • Project-scoped API routes — The /projects/{projectId}/ and /api/projects/{projectId}/ route families that make the above possible
  • Auth regression coverage — End-to-end regression tests for every supported authentication strategy, so a change to one flow cannot quietly break another
  • SCIM alignment — SCIM user updates follow the same project auth permissions as normal updates, removing a divergence between two paths to the same change
  • Email invariants — User.email is enforced lowercase with a profile invariant, closing a class of duplicate-account and failed-login problems
  • Token safety — Access tokens are no longer sent to external URLs in download(), invite serialization conflicts were reduced, and the CLI login scope flag and Access-Control-Max-Age were both corrected

AI​

David Yanez David Yanez

AI work was about the provider layer underneath Spaces:

  • Streaming tool calls — Tool calls stream from the model rather than arriving only when complete, so a long tool-using turn shows progress instead of hanging
  • Provider extraction — The OpenAI provider was extracted behind an interface, which is the prerequisite for running Spaces against a different model provider
  • Base prompt resolution — Spaces documentation now covers how a base prompt is resolved, and the scratchpad surface was renamed to dictation to match what clinicians actually use it for (Andy Stoneman)

Developer Experience​

Noah Silas Noah Silas

  • Bot operation returns — Custom Bot operations return Parameters correctly (Cody Ebberson)
  • Publish reliability — Publishing is retryable and manually invokable rather than a one-shot (Cody Ebberson)
  • React Router 8 — react-router upgraded to 8.3.0 (Cody Ebberson)
  • Component fixes — AsyncAutocomplete autosubmit corrections, the deprecation notice removed from <ResourceInput>, unicode handling in the explain operation (Matt Long), and Storybook release build and S3 iframe embedding fixes
  • API surface hygiene — API Extractor and TSDoc warnings cleared in @medplum/core (Cody Ebberson)

Compliance​

Cody Ebberson Cody Ebberson and Matt Willer Matt Willer

Compliance work this month leaned toward machine-readable discovery and payer interoperability:

  • RFC 9727 API catalog — A /.well-known/api-catalog endpoint giving clients one machine-readable starting point for the standards-based APIs Medplum publishes. It lists the major independently usable protocol surfaces — FHIR, OAuth 2.0, OpenID Connect, DICOMweb, and SCIM — and points each at its own native discovery document. It is a discovery bootstrap, not a replacement for the mechanisms it references, so capabilities with their own discovery (SMART App Launch, Bulk Data, CDS Hooks, FHIRcast) are deliberately not top-level entries
  • RFC 9116 security.txt — A /.well-known/security.txt endpoint publishing how to report a vulnerability, alongside the existing disclosure process on our security page
  • PDex network-reference — A new search parameter for the CMS Payer Data Exchange profile, part of the payer interoperability work that CMS-0057-F and HTI-4 require
  • Prior authorization test coverage — A client test suite for the Inferno Coverage Requirements Discovery validator, continuing the electronic prior authorization work ahead of the January 2027 enforcement date
  • Consent documentation — Documentation on modeling consent in Medplum
  • Certification links — The Drummond validated product URL was corrected on the ONC certification page

Documentation​

Maddy Li Maddy Li, Andy Stoneman Andy Stoneman, and Everett Williams Everett Williams

Provider and platform

Integrations

Website

Bug Fixes​

Core and server

  • Return an empty collection from getReferenceKey and getResourceKey on empty input (contributed by Amanda McGivern)
  • Delete stored objects when Binary resources are expunged (contributed by Andrew Wong)
  • Guard against WebSocket subscription messages arriving without a SubscriptionStatus (contributed by Andrew Wong)
  • Enforce TLS verification and load SFTP credentials from the environment (contributed by Nandakishor)

React and app

  • Avoid a state update after unmount in @medplum/react-hooks (contributed by Aditya Praveen)
  • Open Super Admin documentation in a new tab (contributed by raskolnikov-rodion)
  • Add common MockConsole methods (contributed by alexei)

From the Blog​

Longer-form writing published this month:

Videos​

New videos published this month, all on the Medplum YouTube channel.

Hackathon demos (the full playlist of hacks has every submission)

From the Community

  • Everself: Orbit, a custom EHR putting every prescription, note, message, lab, and smart scale reading on one chronological patient timeline
  • Sandy Health: an ambient scribe that drafts the clinical note and codes, then writes both back into Medplum
  • Profile Health: a patient's whole genome fused with a lifetime of records and handed to the physician before the visit
  • Vinta Software: AI Concierge, an AI assistant built on Medplum
  • Deepgram: a voice-driven patient intake application built in a one day hack, with source on GitHub
  • MediMind: an AI-native hospital system, alongside the case study

Product

Releases​

Looking Ahead​

PlumCon 2026 is this Thursday, September 3, in San Francisco. The full agenda is posted, and while general registration has closed, waitlist spots are available. It is the one day a year the people building on Medplum are in the same room, and much of what is in this update will be demoed live. If you are in the Bay Area, come.

Join us on Discord to share feedback or follow along on GitHub. To learn more about anything in this update, or to talk through how it applies to what you are building, contact us at hello@medplum.com.