In my personal experience it's mostly the top two. A lot of the higher tier certifications aren't arrived at by just developing a really cool product that does the job as intended. You pretty have to write the application such that it will pass certification which requires a lot of tedious work for what ends up being a very niche audience.

Obviously things like LDAP servers, Kernels, Web Browsers, etc, etc are all very complicated pieces of software but they have the benefit of being relevant to a large cross section of society as opposed to EHR where you have pretty much just a single market.

So there's not likely going to be some sort of successful open source EHR system unless IBM or Facebook or Google or whomever decide to create one and really go the extra mile to see it through to completion (unlikely given the entrenched and overlapping interests).