The VA's old system (VistA) is that open source solution - but other hospitals didn't want to use or buy it.
I think the EMR industry is driven more by safety, liability, and revenue for hospitals (in that order) than by patient/physician desired features or security.
It's also difficult to build tooling that interconnects across all of the medical specialties - and with the amount of customization that some providers want.