A doctor sent me a Facebook ad recently and asked one question: is this legit?
It was an ad for an EMR I had never heard of. Polished video, confident claims, glowing testimonials. It did not take long to see what was off. Nothing in it checked out. The video was generated, the smiling doctors in the testimonials had no PRC records I could find, and the landing page could have been ours with the logo swapped.
I have been building healthcare software in the Philippines for 10 years, and copycats are nothing new. What is new is how cheap they got. A copycat operation used to need a designer, a copywriter, and a few weeks of effort. It now needs one person, AI tools, and a free afternoon. Everything can be produced on demand except the software itself.
That ad is why this guide exists. Choosing an EMR was already a hard decision. In 2026 it starts one step earlier: making sure the company behind the ad is real. Here is the full process I would use if I were a doctor choosing where years of patient records will live.
Step 1: Check the company before you check the features
Feature lists are the easiest thing in the world to fake. A company’s paper trail is not. Before you sit through any demo, spend fifteen minutes on the company itself.
Look for a registered business. A legitimate Philippine vendor is registered with the SEC (or DTI for sole proprietors), and will tell you the registered name when you ask. If the ad has no company name at all, or the name changes between the ad and the payment page, stop there.
Look for named humans. Who founded it? Who runs support? Real companies have people with faces, LinkedIn histories, and talks or interviews going back years. If every face on the site could be AI-generated and no named person is reachable, that is not a software company. That is a landing page.
Look for a history. Ads can be created overnight; a track record cannot. Search the product name plus “review.” Look for posts, help articles, app store updates that stretch back years. A vendor that claims thousands of users but has three months of internet history deserves hard questions. I wrote about why boring, proven software wins in healthcare in why I bet on boring; the short version is that in an EMR, a long, uneventful history is exactly what you are shopping for.
Look up the testimonial doctors. This one is very Philippine-specific and very fast: every licensed doctor is searchable on the PRC verification site. A doctor endorsing software you will trust with patient records should, at minimum, exist. If the testimonials use only first names or stock-photo faces, treat them as decoration, not evidence.
Look for the Data Privacy Act basics. Your EMR vendor will process sensitive personal information, which puts it squarely under the Data Privacy Act. Ask whether the company is registered with the National Privacy Commission and who its Data Protection Officer is. A vendor that cannot answer within one email has not thought about the law that governs your patients’ data.
Step 2: Learn the marketing red flags
Once you know the company is real, look at how it sells. Some warning signs I would treat as disqualifying:
- All the proof is generated. AI video, AI photos, AI voiceover, and not a single verifiable human anywhere. The current tells: mouths that do not quite sync with the audio, backgrounds that warp near the edges, and text inside images that turns to gibberish. Checking the hands used to work; the tools have improved past that, so do not rely on it.
- The claims are copied. Paste a distinctive sentence from the landing page into Google. If the same sentence appears on another vendor’s site, someone copied someone, and the copier is rarely the one with the working product.
- Nobody you can talk to. No support, no office address, no response channel except a chat widget. You are choosing a partner for the next decade of your practice; a vendor you cannot reach before the sale will be worse after it.
- Payment goes to a person. Legitimate subscription software bills through official channels with receipts. If the “vendor” asks you to send payment to a personal GCash account, walk away. The Inquirer has documented scammers targeting doctors and health centers with fake accreditation fees collected exactly this way.
- Pressure and countdown timers. “Lifetime license, today only.” Medical software is not a flash sale. I have written before about why the lifetime license model is a red flag in itself: if the vendor’s income stops after your one payment, so does their reason to keep the servers on.
None of this is unique to small unknown vendors, by the way. The AI-content wave has reached the big end of the market too. This is the same pattern I described in my piece on “agentic AI” platforms: impressive-sounding claims, suspiciously familiar substance. The scale is different; the vetting is the same.
If you want to see how professionals verify suspicious health marketing, read a few of Rappler’s fact-checks on the deepfake doctor ads that have been circulating on Facebook. Their method is exactly what this guide teaches: check the registry, check the source, check whether the person in the video exists.
Step 3: Run the demo test AI cannot fake
Here is the good news. Everything an AI can fake lives in the marketing. The product itself cannot be faked, so make the product prove itself.
Ask for a live demo on your own phone, not a recorded video. Then run your actual clinic day through it. Encode a real (or realistic) patient. Write a prescription and print it. Book a follow-up. Look up the patient again the way your secretary would, in a hurry, between two other tasks.
Then repeat one of those tasks on clinic internet at a busy hour. Software that only works on the salesperson’s connection is not ready for your clinic in Quiapo or Quezon City at 4pm.
If the vendor cannot give you a trial account, or keeps steering you back to the video, you have your answer.
Step 4: The questions to ask before you pay
These are the questions I would want every doctor to ask us, and any vendor, before signing anything.
1. Who owns my patient data, and can I export it?
The answer must be: you own it, and yes. Ask to see an actual export while you watch, and ask what format it comes in. This is the single most important question on this list, because it is the one you cannot fix later. In 10 years I have met doctors who lost a decade of patient records to a flooded clinic or a dead laptop. Losing them to a vendor’s fine print is the same tragedy, except this version is preventable on the day you sign.
2. What happens to my records if I leave, or if you shut down?
A serious vendor has a written answer: how long you can still export after cancelling, what gets deleted and when. A vendor that has never been asked this question has never thought about your worst-case scenario.
3. What does the price include, all in?
Get the full number: per user or per clinic, storage limits, training, support, and which features cost extra. Hidden fees usually hide in modules, storage, and “premium support.” If pricing only exists on a call, ask for it in writing after the call.
4. How do I reach support, and how fast do you respond?
Ask for the actual channels and the actual response time, then test them while you are still a stranger. After a decade of watching support from the vendor side, here is an honest rule: the response you get before you pay is the best response that vendor will ever give you. If pre-sales already takes three days to reply, that is the ceiling, not the floor.
5. How do you handle the Data Privacy Act?
NPC registration, a named Data Protection Officer, where the data is hosted, and how backups work. You are the one facing your patients if this goes wrong; the vendor should make it easy to answer them.
6. How will you migrate my existing records?
Whether you come from paper, Excel, or another EMR, migration is where switching hurts. Ask what they migrate for you, what you must encode yourself, and how long it realistically takes. If you keep paper charts, ask whether you can start with appointments only and bring records in gradually.
7. Will this handle my PhilHealth work?
If PhilHealth programs like YAKAP matter to your practice, ask exactly which workflows the vendor supports and ask for the accreditation or certification behind the claim, then verify it with PhilHealth directly. Accreditation claims are easy to make and easy to check.
8. Can I talk to two of your actual users?
Real vendors have doctors who will vouch for them, doctors you can text, in specialties like yours. This one question filters out every fake vendor at once.
Where I stand in all this
Full disclosure: I co-founded SeriousMD, so I am a vendor in the market this guide covers. I have tried to write it so the advice holds no matter whose software you end up choosing, and the honest test of that is simple. Run every check above on us too. Look up our history, ask us the eight questions, ask for the live demo and the export. Any vendor worth trusting with your patients’ records will welcome that, and the ones who do not have told you something more useful than any ad.
If you are earlier in the decision and still mapping what your options even are, I keep an overview of the different kinds of EMR providers in the Philippines, from notebook-and-Excel setups to full cloud systems, and a separate piece on why I do not recommend free EMR systems as a long-term home for patient records.
Frequently asked questions
How do I know if an EMR vendor in the Philippines is legit?
Check five things: SEC or DTI registration, named founders and staff you can reach, a multi-year public track record, testimonial doctors who appear in the PRC registry, and a live demo with a trial account. A fake vendor fails most of these in the first fifteen minutes.
What are the biggest red flags when choosing an EMR?
Fully AI-generated marketing with no verifiable humans, copied claims, payment to personal accounts, lifetime-license flash sales, and any vagueness about data export. Any one of these deserves a pause; two or more, walk away.
Can I trust the testimonials on an EMR website?
Only after you verify them. Search the doctor’s name on the PRC verification site and check that the person practices in the specialty the testimonial claims. Unverifiable testimonials are marketing copy, not proof.
How can I tell if an ad or demo video is AI-generated?
Look for lip-sync that drifts from the audio, backgrounds that warp or shimmer, and text inside the video or images that dissolves into gibberish. But do not rely on spotting the fake; rely on checks that do not care how good the fake is, like registries, live demos, and talking to real users.
What happens to my patient records if I stop using an EMR?
That depends entirely on the answer you got in writing before you paid. You should own your data outright, with export available during and after your subscription. If a vendor cannot demonstrate an export, do not start.
Are free EMR systems safe to use?
Free tools are how many doctors start, and the good ones are honest side doors into paid plans. The risk is a “free forever” system with no visible business model, because servers and support cost money and something has to pay for them eventually. I wrote a longer piece on why free EMRs worry me.
How much does an EMR cost in the Philippines?
Anywhere from free tiers to monthly subscriptions that scale with users and clinics. The number matters less than its completeness: get the all-in price including storage, support, and training, in writing. A cheap headline price with hidden modules usually ends up as the expensive option.
Should I get a subscription or a lifetime license?
I have a strong view here: subscriptions align the vendor’s survival with your service continuing, while lifetime licenses pay the vendor once and hope. The full argument is in my subscription vs lifetime license piece.
