Presentation
Human Factors in Open-Source Medical Software: Compliance Barriers, AI/LLM Adoption, and Community Dynamics
SessionPoster Session 1
DescriptionBackground, Application, and Overview
Background
Open-source medical applications (OMA) have become a central force in the digital health ecosystem, encompassing electronic health record (EHR) systems, medical imaging (MI) platforms, training datasets, artificial intelligence (AI) utilities, including large language models (LLMs), and modular frameworks for developing healthcare software. Their widespread adoption reflects their potential to democratize access to digital health innovation, reduce development costs, and accelerate the pace of clinical and research advancements. By enabling distributed teams to build and customize health IT tools, OMAs lower entry barriers for small organizations and foster global collaboration. However, their integration into clinical environments has been constrained by complex regulatory requirements—most notably HIPAA, GDPR, FHIR, and DICOM—alongside data privacy concerns and persistent usability challenges. These barriers create tension between the promise of OMAs to transform healthcare and the necessity for them to meet rigorous safety, privacy, and usability standards.
To investigate this tension, we examined how regulatory compliance, AI/LLM adoption, and community support intersect in prominent OMA projects. We conducted a structured search on GitHub, the world’s largest open-source development platform, using two keyword strategies. Domain-focused terms (“medical,” “health,” “healthcare”) captured general OMA projects, while compliance-focused terms (“GDPR,” “HIPAA,” “FHIR,” “DICOM”) identified projects engaging with regulatory standards. Eligible repositories had at least 1,000 stars, indicating visibility and community endorsement, and showed evidence of active maintenance. This search yielded 12 diverse repositories spanning EHR systems, MI tools, healthcare datasets, AI/LLM utilities, and software frameworks designed for medical applications. We analyzed metadata from each repository—including stars, forks, contributor activity, programming languages, explicit mentions of compliance frameworks, and documentation of AI/LLM integration. While metadata analysis has inherent limitations, it offers a scalable approach to characterizing development practices and identifying trends across projects. By focusing on well-established repositories, we aimed to capture representative challenges and practices that shape the current OMA ecosystem.
Application
Our analysis centers on the developer community, an often-overlooked yet pivotal stakeholder group in health information technology (health IT). Developers are the primary agents who translate complex regulatory frameworks, technical standards, and user requirements into functional software systems. Their design and implementation decisions profoundly influence the safety, usability, and compliance of digital health tools. Yet, their challenges and perspectives are rarely prioritized in discussions of health IT safety, which typically emphasize clinicians or patients. By foregrounding developers, our study addresses how systemic barriers in the open-source ecosystem affect the quality and reliability of the tools that ultimately reach clinical environments.
For developers, the findings reveal substantial barriers that impede innovation and increase the risk of errors. Integrating compliance frameworks such as HIPAA and GDPR demands interpreting dense legal and technical documentation, often without formal training or institutional support. This high cognitive burden can lead to inconsistent implementations, security vulnerabilities, or inadvertent regulatory violations. For regulators, our results highlight where compliance adoption lags in practice, suggesting the need for clearer, developer-friendly guidelines and better integration resources. Current regulations are primarily framed for institutional compliance officers, not software developers, leaving a gap between policy and practice that could be bridged by providing modular, reusable compliance components.
Human factors (HF) researchers also have a critical role to play. Our findings indicate a need to translate text-heavy compliance mandates into actionable, context-aware guidance that aligns with developers’ workflows and cognitive models. Prior research has shown that usability and safety failures often stem not from technical incompetence but from misalignments between developers’ mental models and the requirements imposed by regulatory frameworks. Embedding compliance support within development tools and platforms could significantly reduce these mismatches. Finally, while clinicians and end users are not directly involved in software development, they stand to benefit indirectly from safer, more usable systems. Improving the conditions under which OMAs are developed will directly improve the quality of the tools that clinicians rely upon, enhancing patient safety and care outcomes.
Overview / Takeaway Points
Three major patterns emerged from our analysis, with implications for the future of open-source medical software development. First, compliance adoption remains uneven across OMA projects. Nearly half of the repositories examined showed no explicit implementation of major regulatory frameworks despite having large user bases and substantial community engagement. Among projects that did reference compliance, GDPR was the most frequently mentioned, especially in developer-focused tools that target the European Union, while HIPAA, FHIR, and DICOM were less consistently addressed. This suggests that many developers either lack awareness of or struggle to prioritize compliance in the early stages of project development, particularly in volunteer-driven contexts without institutional oversight.
Second, the burden on developers to navigate and implement compliance is high. Prior human factors research has shown that frameworks like HIPAA and GDPR impose significant usability challenges on both developers and clinicians (Zhang & Walji, 2011), and our results confirm these barriers persist in open-source contexts. Developers must often self-interpret complex requirements without dedicated compliance expertise, leading to variability in implementation and potential safety risks. Our analysis also aligns with prior findings by Ye et al. (2021), showing that strong community support is a decisive factor for sustainability and quality in open-source health IT projects. Projects with active, engaged contributor communities were more likely to adopt compliance measures, respond to emerging issues, and maintain comprehensive documentation. This underscores that usability and compliance are not solely technical concerns but also deeply social, dependent on collective practices and sustained collaboration.
Third, while AI/LLM integration is currently limited, it is steadily growing—especially in medical imaging. Most observed implementations remain exploratory, focusing on text processing, data mining, and decision support tasks. This cautious pattern mirrors broader trends in healthcare AI adoption, where issues of trust, explainability, and workflow alignment remain major barriers (Amann et al., 2020). Broader use of AI/LLMs appears constrained by uncertainty about how existing regulations apply to these novel technologies and by the absence of standardized guidance for developers seeking to build compliant AI-enabled tools.
Finally, our analysis highlights the critical role of community support as an enabling factor. The most impactful OMA projects owed their longevity, compliance maturity, and widespread adoption to vibrant contributor communities, often comprising both independent developers and commercial organizations. These communities continuously address emerging security and compliance issues, provide rapid solutions, and lower onboarding barriers for new contributors. This creates a positive feedback loop: stronger communities produce better documentation, faster bug resolution, and more consistent compliance practices, which in turn attract more contributors and users. Fostering such communities may be as important as developing new technical frameworks or regulations if the goal is to ensure that open-source medical applications are safe, usable, and compliant.
References
Zhang, J., Walji, M. (2011). TURF: Toward a unified framework of EHR usability. J. Biomed. Informatics.
Ye, Y., Barapatre, S., Davis, M. K., Elliston, K. O., Davatzikos, C., Fedorov, A., ... & Becich, M. J. (2021). Open-source software sustainability models: initial white paper from the informatics technology for cancer research sustainability and industry partnership working group. Journal of Medical Internet Research, 23(12), e20028.
Amann, J., Blasimme, A., Vayena, E., Frey, D., Madai, V. I., & Precise4Q Consortium. (2020). Explainability for artificial intelligence in healthcare: a multidisciplinary perspective. BMC medical informatics and decision making, 20(1), 310.
Background
Open-source medical applications (OMA) have become a central force in the digital health ecosystem, encompassing electronic health record (EHR) systems, medical imaging (MI) platforms, training datasets, artificial intelligence (AI) utilities, including large language models (LLMs), and modular frameworks for developing healthcare software. Their widespread adoption reflects their potential to democratize access to digital health innovation, reduce development costs, and accelerate the pace of clinical and research advancements. By enabling distributed teams to build and customize health IT tools, OMAs lower entry barriers for small organizations and foster global collaboration. However, their integration into clinical environments has been constrained by complex regulatory requirements—most notably HIPAA, GDPR, FHIR, and DICOM—alongside data privacy concerns and persistent usability challenges. These barriers create tension between the promise of OMAs to transform healthcare and the necessity for them to meet rigorous safety, privacy, and usability standards.
To investigate this tension, we examined how regulatory compliance, AI/LLM adoption, and community support intersect in prominent OMA projects. We conducted a structured search on GitHub, the world’s largest open-source development platform, using two keyword strategies. Domain-focused terms (“medical,” “health,” “healthcare”) captured general OMA projects, while compliance-focused terms (“GDPR,” “HIPAA,” “FHIR,” “DICOM”) identified projects engaging with regulatory standards. Eligible repositories had at least 1,000 stars, indicating visibility and community endorsement, and showed evidence of active maintenance. This search yielded 12 diverse repositories spanning EHR systems, MI tools, healthcare datasets, AI/LLM utilities, and software frameworks designed for medical applications. We analyzed metadata from each repository—including stars, forks, contributor activity, programming languages, explicit mentions of compliance frameworks, and documentation of AI/LLM integration. While metadata analysis has inherent limitations, it offers a scalable approach to characterizing development practices and identifying trends across projects. By focusing on well-established repositories, we aimed to capture representative challenges and practices that shape the current OMA ecosystem.
Application
Our analysis centers on the developer community, an often-overlooked yet pivotal stakeholder group in health information technology (health IT). Developers are the primary agents who translate complex regulatory frameworks, technical standards, and user requirements into functional software systems. Their design and implementation decisions profoundly influence the safety, usability, and compliance of digital health tools. Yet, their challenges and perspectives are rarely prioritized in discussions of health IT safety, which typically emphasize clinicians or patients. By foregrounding developers, our study addresses how systemic barriers in the open-source ecosystem affect the quality and reliability of the tools that ultimately reach clinical environments.
For developers, the findings reveal substantial barriers that impede innovation and increase the risk of errors. Integrating compliance frameworks such as HIPAA and GDPR demands interpreting dense legal and technical documentation, often without formal training or institutional support. This high cognitive burden can lead to inconsistent implementations, security vulnerabilities, or inadvertent regulatory violations. For regulators, our results highlight where compliance adoption lags in practice, suggesting the need for clearer, developer-friendly guidelines and better integration resources. Current regulations are primarily framed for institutional compliance officers, not software developers, leaving a gap between policy and practice that could be bridged by providing modular, reusable compliance components.
Human factors (HF) researchers also have a critical role to play. Our findings indicate a need to translate text-heavy compliance mandates into actionable, context-aware guidance that aligns with developers’ workflows and cognitive models. Prior research has shown that usability and safety failures often stem not from technical incompetence but from misalignments between developers’ mental models and the requirements imposed by regulatory frameworks. Embedding compliance support within development tools and platforms could significantly reduce these mismatches. Finally, while clinicians and end users are not directly involved in software development, they stand to benefit indirectly from safer, more usable systems. Improving the conditions under which OMAs are developed will directly improve the quality of the tools that clinicians rely upon, enhancing patient safety and care outcomes.
Overview / Takeaway Points
Three major patterns emerged from our analysis, with implications for the future of open-source medical software development. First, compliance adoption remains uneven across OMA projects. Nearly half of the repositories examined showed no explicit implementation of major regulatory frameworks despite having large user bases and substantial community engagement. Among projects that did reference compliance, GDPR was the most frequently mentioned, especially in developer-focused tools that target the European Union, while HIPAA, FHIR, and DICOM were less consistently addressed. This suggests that many developers either lack awareness of or struggle to prioritize compliance in the early stages of project development, particularly in volunteer-driven contexts without institutional oversight.
Second, the burden on developers to navigate and implement compliance is high. Prior human factors research has shown that frameworks like HIPAA and GDPR impose significant usability challenges on both developers and clinicians (Zhang & Walji, 2011), and our results confirm these barriers persist in open-source contexts. Developers must often self-interpret complex requirements without dedicated compliance expertise, leading to variability in implementation and potential safety risks. Our analysis also aligns with prior findings by Ye et al. (2021), showing that strong community support is a decisive factor for sustainability and quality in open-source health IT projects. Projects with active, engaged contributor communities were more likely to adopt compliance measures, respond to emerging issues, and maintain comprehensive documentation. This underscores that usability and compliance are not solely technical concerns but also deeply social, dependent on collective practices and sustained collaboration.
Third, while AI/LLM integration is currently limited, it is steadily growing—especially in medical imaging. Most observed implementations remain exploratory, focusing on text processing, data mining, and decision support tasks. This cautious pattern mirrors broader trends in healthcare AI adoption, where issues of trust, explainability, and workflow alignment remain major barriers (Amann et al., 2020). Broader use of AI/LLMs appears constrained by uncertainty about how existing regulations apply to these novel technologies and by the absence of standardized guidance for developers seeking to build compliant AI-enabled tools.
Finally, our analysis highlights the critical role of community support as an enabling factor. The most impactful OMA projects owed their longevity, compliance maturity, and widespread adoption to vibrant contributor communities, often comprising both independent developers and commercial organizations. These communities continuously address emerging security and compliance issues, provide rapid solutions, and lower onboarding barriers for new contributors. This creates a positive feedback loop: stronger communities produce better documentation, faster bug resolution, and more consistent compliance practices, which in turn attract more contributors and users. Fostering such communities may be as important as developing new technical frameworks or regulations if the goal is to ensure that open-source medical applications are safe, usable, and compliant.
References
Zhang, J., Walji, M. (2011). TURF: Toward a unified framework of EHR usability. J. Biomed. Informatics.
Ye, Y., Barapatre, S., Davis, M. K., Elliston, K. O., Davatzikos, C., Fedorov, A., ... & Becich, M. J. (2021). Open-source software sustainability models: initial white paper from the informatics technology for cancer research sustainability and industry partnership working group. Journal of Medical Internet Research, 23(12), e20028.
Amann, J., Blasimme, A., Vayena, E., Frey, D., Madai, V. I., & Precise4Q Consortium. (2020). Explainability for artificial intelligence in healthcare: a multidisciplinary perspective. BMC medical informatics and decision making, 20(1), 310.
Event Type
Poster Presentation
TimeMonday, March 234:45pm - 6:15pm EDT
LocationRhinelander Gallery
Digital Health