If you're interested in the security posture here, I saw a good talk on bug-hunting in OpenEMR at BSidesCT last weekend: https://www.youtube.com/watch?v=wSvlhFQzUNg