Medical practice depends on reliable data storage and retrieval as well as expert systems, and is unthinkable without confidentiality of patient data. Yet virtually all commercial software packages are untrustworthy, as the source code is not available and their security behavior in networks is therefore unpredictable. GNUMed, to our knowledge the most comprehensive and secure system of its kind, meets all the needs of a paperless medical practice and sets standards in safety, robustness, connectivity, and data interchangeability. Its "three-tier" model isolates the user interface completely and makes WAN administration of patient databases easy. The transaction server keeps a second human-readable transaction log and monitors the database in a background process continuously for integrity. Encryption of all data is handled by plug-ins for the transaction server.