Medplum Monthly Update - July 2026

The headline this month: Medplum earned the 2026 FHIRplace Participant emblem from Drummond Group for electronic prior authorization testing, ahead of the January 2027 enforcement date. July was another heavy shipping month — 206 commits from 28 contributors and five patch releases, v5.1.23 through v5.1.27.

On the revenue cycle side, real-time insurance eligibility checks arrived as a FHIR operation of their own, and Claim/$submit learned to route preauthorization requests to their own processor. Elsewhere, server-scoped subscriptions give project-per-tenant deployments one central data-processing flow, a concentrated round of authentication hardening tightened JWT validation, outbound fetch, and MFA, and the Decision Guides are now published natively in the docs. A first DICOMweb implementation also landed in Alpha for teams beginning to work with imaging.

All of this continues to drive forward our 2026 roadmap priorities.

Features

Provider App

David Yanez and Kevin Shaw

The Provider App focused on the lab review and messaging workflows this month, plus a round of consistency work across the inbox surfaces (roadmap):

• Message settings in Messages — Thread-level message settings are now reachable from the conversation itself, so a user can adjust how a thread behaves without leaving it
• Lab review depth — The labs view now includes DiagnosticReport and ServiceRequest resources together, shows result details even when the ordering ServiceRequest cannot be read, and renders an ordering-requester and performing-labs footer on the report (results and review docs)
• Document filters — The patient Documents tab filters by source, separating lab-delivered documents from other uploads
• Consistent detail panes — The thread inbox and tasks views both moved to ListWithDetailPane, and /new routes now work for faxes, tasks, and communications so a user can deep-link straight into a compose screen
• Charting — An encounter can now be created without first choosing a care template (Philip Knott), and address now displays on DiagnosticReportDisplay
• Medplum App polish — Current project shown in the navbar, a resource-type header on the resource list page, elements visually separated from metadata fields, inline errors when an AutoComplete option set is missing, a login link on the registration screen, a keyboard-accessible "View Password" toggle, and a contrast fix in the project picker (all Philip Knott)

Scheduling

Noah Silas

Scheduling work moved from the operation layer to the day-to-day calendar experience:

• Schedule navigation and creation — The Provider App schedule adds a schedule switcher and an inline "Create Schedule" path, so a practitioner without a schedule can create one in place instead of hitting a dead end
• Appointment details — The details drawer now always reveals from the calendar, and shows every appointment participant rather than only the first, which matters for group visits and appointments with multiple practitioners
• Cleaner $find/$book results — Slot.serviceType was removed from $find and $book responses, since service type belongs to the appointment request, not the returned slot
• useSchedulingResources — Scheduling resource loading was extracted into a reusable hook for teams building their own calendar UI

Revenue Cycle and Billing

David Yanez, Cody Ebberson, and Finn Bergquist

Revenue cycle work extended the server-side operation pattern from claims to the two steps that surround them — eligibility before the visit and payer response after it:

• CoverageEligibilityRequest/$submit — A real-time insurance eligibility check as a FHIR operation, so front-desk and intake flows can verify coverage at the point of scheduling instead of batching it
• Prior authorization routing in Claim/$submit — The claim submit operation now accepts a Bundle as well as a bare Claim, and dispatches claims with use: preauthorization to their own configured processor instead of the standard claim path. The core server stays vendor-neutral here: either processor is a custom operation backed by a Bot, so a project points each path at whatever it uses
• Claim response tracking — Documentation and webhook wiring for claim acknowledgements and electronic remittance advice, so a submitted claim's status and payment can be followed to resolution rather than going dark after submission (billing docs)
• CMS-1500 accuracy — Box 25 and Box 24B were reading from the wrong sources on the generated PDF; both now read the correct fields (Andrew Wong)

Identity and Access

Cody Ebberson and Derrick Farris

A concentrated round of authentication hardening, plus admin tooling for the MFA features that shipped in June:

• JWT best practices — Audience validation now follows current JWT best-practice guidance, and the preferred JWKS algorithm moved to ES384
• Basic Auth aligned with client credentials — Basic authentication now follows the same validation path as the client credentials flow, removing a divergence between two ways of authenticating the same client
• MFA administration — A project admin UI for MFA status and password reset, MFA secrets generated on demand at enrollment rather than ahead of time, and project branding applied to MFA emails and authenticator app entries so the second factor looks like the customer's product
• Default access policies — Admin and Practitioner default access policies ship out of the box, with documentation on how they reconcile with project admin
• Client application options — A ClientApplication can skip the scopes consent screen for trusted first-party apps, and $export now works with read-only scopes
• Security hardening — SSRF-safe outbound fetch, a maximum password length enforced across every endpoint, project details on the security sessions tab, and MCP fhir-request pinned to the server origin

Subscriptions, Events, and the Agent

Derrick Farris and Finn Bergquist

The big addition here is a new subscription scope for multi-tenant deployments:

• Server-scoped subscriptions — A rest-hook Subscription that fires across every project on the server, not just its own. Project-per-tenant deployments can now run one central data-processing flow instead of duplicating a subscription into every tenant project. It requires the Super Admin project and a server config flag, so it is self-hosted only, and firings emit system-scoped AuditEvents
• Subscription extensions — Multiple subscription-supported-interaction extensions on a single subscription, and an interaction option in the Resend Subscriptions modal (Maddy Li)
• Bot channel audit trail — AuditEvents are now logged for Bot channel subscriptions, closing a gap in the record of what fired and why (Ian Plunkett)

On the on-premise Agent — Medplum's connectivity service for HL7 interfaces and legacy systems — building on the durable message queue that shipped in June. The Agent documentation covers installation requirements, configuration, and troubleshooting:

• Auto-retry for committed-but-failed messages — Messages that were committed to the durable queue but failed downstream are now retried automatically rather than needing manual intervention, which pairs with how acknowledgement modes decide when a message counts as committed
• $fetch-logs cursor pagination — Log retrieval pages by cursor, so a long-running Agent's logs can be pulled without truncation
• Version handling — A version picker on the Agent Tools page for upgrades, and a fix preventing the reported Agent version from being clobbered by a connect status update
• Log preservation on uninstall — Uninstalling the Agent no longer deletes .log files (devnoct)

Terminology and Search

Matt Willer

Terminology work this month was mostly about making large code systems behave at scale:

• Faster terminology queries — General query performance improvements, plus batched lookup of multiple codes in a single ValueSet/$validate-code call instead of one round trip per code
• Code prefix filtering — ValueSet/$expand supports filtering on a code string prefix, which is how most code-picker UIs actually search
• Import guardrails — CodeSystem/$import now bounds import size and logs oversized imports, and the CodeSystem and ConceptMap import permission models were aligned (Cody Ebberson)
• Better code selection — Complete code systems are preferred over example ones, and retired resources are skipped during lookup (Maddy Li)

On the search side, a server config setting controls which search parameters are enabled, _include and _revinclude now honor the declared target type (Myk), and the SQL and in-memory repositories share a single _include/_revinclude implementation so tests and production behave the same way (Cody Ebberson).

Enterprise: Data Warehouse, Database, and Async Jobs

Karl Pietrzak and Matt Long

Enterprise scale and infrastructure work centered on making the analytics export easier to enable and operate, and the data layer easier to run:

• Faster incremental syncs — The data warehouse export reads its last-updated watermark from Iceberg manifest stats instead of scanning, retrieves watermarks asynchronously, caches them, and defers Postgres connections until needed. Together these cut both the time and the read load of an incremental sync
• Sync robustness — DuckDB connections reset per table with a bounded Postgres reader load, missing meta.project values are coalesced during sync, and DuckDB now sets an application_name so warehouse queries are identifiable in Postgres monitoring
• Async batch maturity — Async batch became reentrant, stopped redownloading result chunks it already has locally, and resets processor state correctly on transaction retry (Matt Willer)
• Job observability — Per-queue in-flight and completed job metrics, queue active counts, async batch entry throughput, and a bullmq globalConcurrency setting for tuning worker load
• Database operations — Additional database configuration options, repository resource-type access tracking, direct DB manipulation moved off the Repository path, cloned repositories for out-of-band saves, and history tombstones enriched with metadata
• Reliability details — Reading a Binary with no content is handled gracefully, and the FHIR quota in-memory block maintains its reset timestamp correctly (Matt Willer)

AI

David Yanez and Maddy Li

AI work refined the Spaces workspace rather than expanding it:

• Real-time questionnaire responsiveness — The AI real-time questionnaire form handles narrow viewports and mid-session layout changes, which matters for documenting on a tablet during a visit
• Voice controls — useWhisper supports mute, so a clinician can pause capture without ending the session
• Docs search in chat — An Algolia search button in the chat surface, so a question about Medplum itself can be answered without leaving the workspace

Imaging and DICOM (Alpha)

Cody Ebberson

A first implementation of the DICOMweb service suite landed this month, so imaging studies can live in the same datastore, under the same access policies, as the rest of a patient's record:

• DICOMweb services — QIDO-RS for querying studies, series, and instances; WADO-RS for retrieving studies, series, frames, and metadata; STOW-RS for storing instances; and WADO-URI for direct object access
• Three new resource types — DicomStudy, DicomSeries, and DicomInstance model the DICOM hierarchy as Medplum resources with their own search parameters
• Viewer integration — Studies can be opened in the OHIF viewer, and a background worker handles instance ingestion and metadata extraction

Alpha

DICOM support is an Alpha feature. The API shape and behavior may change between releases without a migration guide, so treat it as a prototyping and early-feedback surface rather than something to build production imaging workflows on yet. If you are working with imaging, we would like to hear from you at hello@medplum.com.

Developer Experience

Noah Silas and Finn Bergquist

Work aimed at teams building on the React component library:

• @medplum/storybook — Storybook moved into its own package with a deploy script, separating component documentation from the @medplum/react build
• Theme presets — A set of theme presets in Storybook, so a team can preview Medplum components against something closer to their own brand before committing to a theme
• resourceModified events — MedplumClient emits resourceModified events, giving apps a hook for cache invalidation and live UI updates without polling
• Testing ergonomics — MockClient control methods moved into a .mock namespace to keep the mock surface distinct from the real client API, plus new toHaveStatus and toContainExactly matchers (Matt Long) and safer EventTarget listener exception handling
• Component props — An additionalColumns prop on SearchControl, and questionnaire-optionExclusive support in QuestionnaireForm (Derrick Farris, David Yanez)

Compliance

Reshma Khilnani and Cody Ebberson

Medplum earned the 2026 FHIRplace Participant emblem from Drummond Group for our work in electronic prior authorization testing. CMS-0057-F and HTI-4 require payers and providers to support FHIR-based electronic prior authorization with enforcement beginning January 2027, and Medplum handles ePA transactions on both sides. The full post has the details. Other compliance work this month:

• Electronic prior authorization — Continued progress on electronic prior authorization toward the HTI-4 requirements, ahead of the January 2027 enforcement date
• ONC certification criteria — Updated documentation on which ONC criteria Medplum addresses and how
• Inferno testing — The CapabilityStatement now advertises the token introspection URL, which the Inferno certification suite requires. Our SMART App Launch guide covers pointing an Inferno client at a Medplum project, and the ONC documentation tracks which criteria we address
• Patient/$match — Patient matching documentation was aligned with the actual behavior of the match operation, following June's move to CMS matching criteria. The docs now lay out the approved CMS matching combinations — the identity-attribute sets strong enough to return a certain match — along with the uniqueness gate that governs when a record is released and the match grades applied to everything else. Note that the CMS framework is a draft proposal and subject to change as the guidelines evolve
• Supply chain and hardening — Workflow permissions corrected for the OpenSSF Scorecard run, a transitive dependency advisory resolved, and the JWT, SSRF, and password-length hardening described above. Current scores and badges are published on our security page, including OpenSSF Best Practices and Security Scorecard

Documentation

Maddy Li and Everett Williams

• Should you Self-Host? — A frank guide to evaluating self-hosting: what upgrades, Redis and Postgres operations, and compliance obligations actually cost month to month. Worth reading before committing either way
• Decision Guides — The decision guides are now published natively in the docs rather than as separate documents, covering intake, charting, messaging, access control, referrals, e-prescribing, and revenue cycle — each one a scoping conversation about requirements and FHIR modeling decisions, linked from the corresponding technical docs. PDF and Word downloads are available for sharing with non-technical stakeholders

Provider App and platform

• Rate limits — Clarified rate limit behavior with configuration instructions, and the $rate-limits endpoint now respects a UserConfiguration override
• Default access policies — Documentation on the built-in Admin and Practitioner policies and how they reconcile with project admin
• MFA routes and flows — The full MFA surface documented end to end (Derrick Farris)
• $ccda-export — Parameter documentation and the accompanying UI component
• Self-hosted token exchange and subscription extensions — Both expanded (Finn Bergquist)
• Products page — Redesigned, with the architecture diagram carried over to the docs home page (Kevin Shaw, Everett Williams)
• Project.defaultProfile — A dedicated section on default profiles (Raphael Malikian), plus typo and casing fixes across the docs (Granis87)

Integrations

• Electronic prescribing — The e-prescribe integration moved out of beta in the docs, with new documentation for the multi-medication cart workflow (Andy Stoneman)
• Lab ordering — Eligibility criteria for lab connectivity documented, along with patient profile and diagnosis code requirements (Tim Ray, Maddy Li)
• SMS and messaging — Public documentation for the SMS and telephony messaging integration, including inbound messages (Andy Stoneman)

Bug Fixes

FHIR and billing

• Read the correct sources for CMS-1500 Box 25 and Box 24B (contributed by Andrew Wong)
• Honor the declared target type in _include and _revinclude (contributed by Myk)

Client and CLI

• Use statusOptions in pollStatus so status polls do not resend the request body (contributed by Aidan-Thomas Anderson)
• Fail CLI bot deploy when the server returns an error outcome, instead of exiting successfully (contributed by alexei)
• Improve the error message when the email feature is unavailable (contributed by Agustin Bereciartua Castillo)

Agent

• Preserve .log files during Agent uninstall (contributed by devnoct)

From the Blog

Longer-form writing published this month:

• Everself: Enhanced Obesity Care by Petch Jirapinyo and Finn Bergquist — How Everself built a longitudinal care program around an outpatient endoscopic weight loss procedure, for the million-plus patients a month who drop off GLP-1 medications
• Preparing for 2027 Prior Auth Regulatory Requirements by Reshma Khilnani — What CMS-0057-F and HTI-4 require, and where Medplum's ePA support stands

Releases

• v5.1.23 — July 1
• v5.1.24 — July 6
• v5.1.25 — July 9
• v5.1.26 — July 10
• v5.1.27 — July 24

Looking Ahead

July put the electronic prior authorization work on the record with the FHIRplace emblem, filled in the revenue cycle picture with real-time eligibility and preauthorization routing, and gave multi-tenant deployments a server-wide subscription scope. The authentication hardening and terminology performance work are the kind of changes nobody asks for by name but everybody feels. Imaging is the early one to watch — DICOM is in Alpha now, and feedback from teams working with imaging will shape where it goes.

Two things on the near calendar. Today we are hosting the Agentic Healthcare Hackathon with Y Combinator at the YC office in San Francisco. And PlumCon 2026 is on September 3 — the lineup is posted, and registration is open.

Join us on Discord to share feedback or follow along on GitHub. To learn more about anything in this update, or to talk through how it applies to what you are building, contact us at hello@medplum.com.