I know basking projects based on their choice of language is controversial, but PHP really is pushing it for me. And for medical data, too. PHP isn't boring technology - Java is boring technology - PHP is downright dangerous.
Medical records is not a website.
Medical records are not a website, so its logic should not be in PHP.
A frontend for medical data? Yes, a HIS? NO
No... you can write secure code in PHP perfectly well. However, a lot of code written in PHP is insecure, and the reason for that is simple - PHP has relatively low barrier of entry, which means a lot of people that know little about security write in PHP.
Is there other decent open source EMR coded with other languages to try out?