Last EHR

Last EHR is an open-source AI agent layer that sits on top of an existing FHIR backend rather than trying to be a full electronic health record on its own. Its own description is the open-source AI agent layer for Medplum and FHIR. You point it at a Medplum server you already run, and it gives clinicians a permissioned assistant that can read charts and propose updates without ever becoming the system of record itself. The record stays where it already lives, and the agent works against it as a careful helper rather than a replacement.

The problem it addresses is that bolting an AI assistant onto healthcare data is genuinely risky. Patient records demand strict access control, a clear audit trail, and a human in the loop before anything is written, which is exactly where a generic chat tool pointed at a database falls short. An assistant that can silently edit a chart is a liability, and one that copies patient data into a third-party platform is a compliance headache. Last EHR is built so the AI never has free rein over the chart, and so the data stays inside infrastructure the provider already controls.

It works through a small, deliberate set of four tools. The agent can search for patients in your FHIR backend and open a chart to show conditions, allergies, medications, observations, immunizations, and notes in one view. The two write actions, adding a free-text clinical note and recording an observation, are gated behind human approval. The agent proposes a change, a clinician reviews it, approves it, and only then does it reach the chart, so nothing is written silently in the background. Keeping the toolset this narrow is a deliberate safety choice rather than a gap, since every capability is one a clinician can reason about.

Data governance is the point rather than an afterthought. You run it against your own Medplum, hosted or self-hosted, and Last EHR stores no patient data of its own at any point. Everything the agent can see and do is scoped by Medplum's AccessPolicy and runs as the signed-in user, so the AI inherits the exact same permissions the clinician already has instead of a broad service account that can see everything. You bring your own model key from OpenAI or Anthropic, which keeps the choice of model and the spend under your control rather than baked into a vendor's markup.

It's aimed at healthcare teams and developers already invested in Medplum who want AI-assisted workflows without giving up oversight. The same tools also run as an MCP server, read-only by default, so you can wire the chart into Claude Desktop or another MCP client for safe lookups. That makes it a fit both for a clinician using an approval-gated assistant during a visit and for a developer scripting read-only queries against real FHIR data while building something on top. The two modes share the same underlying tools, so what you learn in one carries over to the other.

In day-to-day use the approval gate is what makes the whole thing usable in a clinical setting. A clinician can ask the assistant to pull up a patient, review what it found across conditions, medications, and recent observations, and then have it draft a note or record a reading, all while knowing that draft is a proposal and not a committed change. Nothing lands in the chart until a person has looked at it and said yes, which keeps the clinician firmly in the loop and the record accurate. That single design decision is what separates a helper you can trust with real patients from a chatbot you would never let near a live system. It also means the audit trail reflects human decisions, since every write is tied to an approval by the signed-in user rather than an opaque automated action.

What sets it apart is the posture, not a long feature list. Most AI health tools ask you to move data into their platform and trust their controls, then hope the audit story holds up. Last EHR keeps the record in your Medplum, runs as the user, and forces approval on every write, so the safe path is the default rather than something you have to remember to configure. Being open source under the Apache-2.0 license means the whole approval flow is auditable rather than a black box you take on faith, which matters a lot when the data is clinical.

It's free and open source today, with the code on GitHub and no charge to run it against your own backend beyond the model key you supply. A managed hosted tier with hosted Medplum and a signed BAA is described as in development for teams that would rather not operate the stack themselves and need the paperwork that comes with handling protected health information. For anyone piloting AI in a clinical setting who needs governance from day one, the appeal is that the guardrails come built in instead of being something you bolt on after an incident.