Can Change-Evidence Management for Electronic Medical Records Stand Alone as a Service?

What changes after you fix a feature

On May 8, 2026, the Ministry of Health and Welfare (보건복지부), Korea’s national health ministry, revised the Electronic Medical Record System Certification scheme. It merged product certification and use certification into one system and set 59 certification criteria covering functionality, connections with other systems, and security.

Before the revision, participation in use certification was about 11%. In other words, only a little more than one in ten medical institutions took part. The Ministry said product certification and review content overlapped, while the process created a heavy burden.

On October 26, 2026, the Korea Health Information Service (한국보건의료정보원), a public body that supports health-information systems, established change-review guidance and published it the next day. Alongside the guidance, it released forms for reporting feature changes or deletions, self-check results for certification-criteria compliance, and evidence supporting those checks.

Not every software modification must be reported. An organisation that obtained certification must submit a report when it changes or removes a certified feature related to the certification criteria. The certification body may also require a self-check results form.

Failing to report a change, or failing to submit requested self-check results, can lead to an on-site inspection. If a change review finds that a product falls short of the criteria, its certification can be cancelled. But even when a change is judged compliant, the existing certification period—which is generally three years—does not restart.

Manage one change, not the entire electronic medical record system

Consider this scenario. A company with 12 employees supplies electronic medical record software to 40 clinic-level medical institutions, and one product planner handles certification work alongside other responsibilities. This is a customer situation that needs validation first.

When a hospital requests a feature change, the person responsible saves the request email and passes the details to a developer. Once the work is finished, they record which hospital received which version in a separate list, then put screenshots and test results into folders.

The problem begins when a change report may be required. The person responsible must find which of the 59 certification criteria the modification affects, then check whether before-and-after screens and test results came from the same version. If hospitals run different installed versions, even the same feature can have different deployment dates and customer notices.

This is where a service focused on a single change could fit. A user enters the change once, and the service connects the relevant certification criteria, product version, installed hospitals, test results, and approver in one place. It then carries those details into the official report and self-check materials.

When a review request arrives, the person responsible opens that change record instead of searching emails and folders again. They can first see missing screens, test results, and approval records, create a submission file package, and retain a record of which hospitals received update notices.

Existing quality-management software is sold as a package for document approvals, staff training, risk management, design records, and audit preparation because those records connect to one another. But this new Korean guidance makes the trigger—change or deletion—and the official forms clear. That creates a reason to adopt only change-review preparation before buying a full management system.

Some work still has to remain with people. A responsible person must make the final decision on whether a modification relates to certification criteria, confirm that the evidence matches the version actually in operation, and check that no patient information remains visible in screenshots. The service should not replace that judgment. It should stop the basis for the judgment and the submission record from being scattered.

Overseas examples start narrow, then expand

In the United States, YouCompli helps hospitals and medical institutions manage regulatory changes. Specialists read regulatory changes and turn applicability into questions, then connect responsible people, deadlines, completion records, and audit evidence. Its publicly listed starting price is US$300 per month, or about KRW 400,000.

One California healthcare system used the service during the COVID-19 period to track federal and state regulatory changes and withdrawals. It shows an approach that goes beyond legal search and extends to recording what each department did.

In the United States, Greenlight Guru supplied electronic quality-management software to medical-device company BioRESEARCH Associates. The company had managed documents through Microsoft SharePoint folders and paper, then connected document changes, approvals, staff training, risk management, and audit evidence. Its publicly listed starting price is about KRW 16 million per year.

Greenlight Guru said the share of team time spent maintaining quality management fell from about 80% to 25%. This is a supplier-published customer-case figure and needs separate verification. Still, the direction is clear: start with document storage, then sell a system that links changes and training records.

Australian biopharmaceutical company Neuren Pharmaceuticals adopted Egnyte Life Sciences with a team of about 25 employees. It separated spaces for trials, regulatory documents, and general collaboration, and started with document management.

The company later expanded its use to issue causes and actions, audits, and change management. Egnyte said the full implementation took 12 weeks. This is also a supplier statement, but it shows that a small organisation can start with one controlled-document problem rather than changing every function at once.

Four things you could build from this

1. A change-review submission package builder

• A service that bundles a report form, self-check results form, and evidence-file list when a user enters one change.
• It is for suppliers with certified electronic medical record products but only one or two people dedicated to certification work.
• The publication of official forms and evidence templates makes the required input fields and output format concrete.
• The first screen shows active changes, related certification criteria, the number of missing evidence items, and planned submission dates.

2. A hospital-by-hospital installed-version map

• A service that shows which hospital has which version and feature changes, while retaining notification history.
• It is for suppliers that serve multiple clinics and small hospitals with customer-specific versions of the same product.
• The hospitals and timing affected by the same change can differ, increasing the need to link reporting materials with customer notices.
• The first screen shows hospital name, current version, difference from the latest version, and update-notice status.

3. A review-evidence collection desk

• A service with a human support layer: when a person responsible sends change details, it collects test screens, approval records, and result files, then arranges them in a defined name and order.
• It is for small suppliers where developers and planners share certification work without a dedicated quality team.
• Companies that cannot adopt a new software system can still start by paying for one change at a time.
• The first screen shows evidence to collect this week, the person responsible, submission status, and whether patient information has been redacted.

4. A pre-release reporting decision board

• A service that asks questions before a feature is released, then shows related certification criteria and the evidence to prepare.
• It is for suppliers that frequently change features at hospitals’ requests but whose certification lead cannot always attend development meetings.
• Flagging the possibility of a report before release makes it easier to retain screens and test results in time, rather than reconstructing materials after a change.
• The first screen shows planned changes in three states: reporting review needed, under responsible-person review, and not applicable.

Why this matters where you are

These reporting triggers, forms, certification criteria, and possible on-site inspections are Korean conditions under the country’s Electronic Medical Record System Certification scheme. In your market, check whether regulated software changes have similarly defined reporting requirements, evidence formats, and version-by-customer records. If they do, a narrow workflow for one change may be easier to adopt than a full quality-management platform.

What to check today

Ask the certification lead at one electronic medical record supplier to recreate one recent feature change on screen. If finding the change request, deployed hospitals, test results, and approval record takes more than 15 minutes or requires searching more than three places, it is worth testing a first product that bundles change evidence only.