EMR Integration

HIPAA Compliant Texting for Cerbo Direct-Care Practices

Written by Mira Gwehn Revilla | Aug 6, 2026, 4:00:02 PM
💡 HIPAA compliant texting for Cerbo direct-care practices means routine patient messages move by regular SMS. A vendor signs a BAA and logs every thread. Cerbo keeps the clinical record, and Curogram adds the texting layer beside it. Members reply from the lock screen instead of hunting for a portal password.
  • Patients text your practice number. Nothing to install, no account to set up.
  • Curogram signs a BAA, keeps an audit trail, and handles opt-out requests.
  • Cerbo's Open REST API and webhooks feed appointment data to the texting layer.
  • The portal still holds lab documents, consents, and invoices.
  • Staff work one shared inbox instead of a voicemail queue.
Gartner has cited SMS open rates as high as 98%. ASTP/ONC found that 34% of adults logged into a portal six or more times in 2024.

34% of U.S. adults logged into a patient portal six or more times in 2024. That figure comes from ASTP/ONC's analysis of the HINTS survey. Six logins in a year is what counts as frequent use. Once every two months.

Set that against what a concierge member pays for. Fast answers. A doctor who knows their protocol by heart.

Cerbo handles the clinical side well. It was built for integrative and functional medicine. Custom questionnaires, supplement tracking, and subscription billing all sit in one system. Its portal carries secure messages, invoices, lab documents, and appointment requests.

One step sits in front of all of it. A login.

So a member with a question about her magnesium dose opens the portal, can't recall her password, and calls the front desk. She gets voicemail. Someone calls back at 4:10 PM and misses her. An eight-second answer turns into a two-day loop.

Multiply that by a panel of 400 members who pay for access. Your phone line becomes the real message queue. Staff spend the afternoon working it, and the portal inbox sits nearly empty.

That's the gap this article is about. The clinical system is fine. The front door in front of it is where members give up.

Our position is direct. Routine questions don't belong behind a password. Cerbo should keep the record. The daily back-and-forth should move to text, through a platform that signs a BAA and logs what it sends.

Below, we walk the Cerbo workflow step by step. Where the question stalls, how a texting layer attaches to Cerbo's API, and what the front desk hour looks like after.

The Locked Conversation: Why Portal Messages Sit Unread

Cerbo tracks supplements, in-house dispensary stock, and prescriptions from one place. It connects with Fullscript for practices that sell through an online storefront.

Custom questionnaires let a functional medicine intake run 60 questions deep without a workaround. Subscription support matches how membership practices bill.

The patient portal is well stocked too. Log in as a patient and you find secure messages, appointment requests, invoices, forms, lab documents, vitals, medications, and a supplement list. For a practice managing a 14-supplement protocol, that's real infrastructure.

None of what follows argues against any of it. Cerbo is a strong clinical system for the practices it was built around. Swapping EHRs is not the fix we're proposing.

Six Logins a Year Counts as Frequent

ASTP/ONC's 2024 figures put portal habits in context. 77% of adults were offered online access. 65% got in at least once that year. Only 34% logged in six or more times.

Apply that to a functional medicine panel. A new member might have four visits, two lab reviews, one protocol change, and a handful of side-effect questions in six months. That's a dozen moments where she wants an answer.

Each one asks her to log in. Each login is a chance to forget a password, mistype an email, or decide it can wait. One forgotten password sends the whole conversation to your phone line.

Trace One Question Through a Tuesday

A member wants to know if she can take berberine with food. She tries the portal, hits the password wall, and calls. Your front desk is checking in two patients, so it rings to voicemail.

An assistant listens at 2:15 PM and pages the provider, who is mid-visit in a 60-minute follow-up. The callback goes out at 4:10 PM while the patient is driving. She calls back at 4:52 PM, after the phones have rolled over.

Wednesday morning, the loop restarts. Two staff members have now touched a question a provider could answer in eight seconds.

A practice fielding 40 to 80 calls a day runs some version of this loop constantly. Enough of those calls are phone tag that the afternoon goes to returning messages instead of working the schedule. Front desk staff know the pattern by name, and they know which three patients will be on the callback list again tomorrow.

High-Touch Panels Generate More Contact

Integrative and functional medicine patients reach out more between visits than a standard primary care panel does. Longer protocols, more lab reviews, more supplements to titrate, more mid-course adjustments. Each one produces contact.

Direct care raises the stakes on every touch. Someone paying $250 a month expects the access they bought. A message sitting unanswered for two days becomes the thing they mention to the friend who asked about your practice.

Renewal season is where this surfaces. Nobody cancels over one slow reply. People cancel after a quarter of them, and the exit survey usually says "hard to reach."

The Personal Cell Phone Becomes the Backup Channel

Watch what happens when the official channel stalls. A physician who built her practice on relationships starts handing her mobile number to the members who complain loudest. It solves their problem and creates four of hers.

Threads on a personal phone can't be searched by the practice. They can't be exported for a records request. A covering provider can't pick them up on a Friday. No BAA covers that device, and there's no audit trail behind it.

Add a partner or an associate later, and the relationship still lives on one phone. That's a hard thing to hand off, and it caps how large the practice can grow.

Practices rarely choose this arrangement. It arrives by default, one exception at a time, starting with the member who complained twice.

The Concierge Channel: Texting That Runs Alongside Cerbo

Cerbo EHR two-way patient texting works best when the two systems keep separate jobs. Cerbo holds the chart, the orders, the lab documents, and the billing. Curogram holds the conversation: reminders, confirmations, quick questions, follow-ups, recalls, and intake forms sent by link.

Teams searching for a Cerbo secure messaging alternative are rarely trying to retire the portal. They want routine traffic to reach patients where those patients already are. Signed consents and lab releases can stay inside the record.

Draw the line by message type. Treatment consents, document exchange, and formal clinical correspondence stay in Cerbo's portal. Dosing questions, arrival times, reschedules, and "did my labs come back yet" move to text.

Building the Cerbo Connection

Cerbo publishes an Open REST API, so the connection is straightforward in principle. A few specifics decide how the build goes.

API credentials in Cerbo are separate from user login credentials. You can't use them to sign into the EHR interface. Cerbo advises granting only the minimum permissions an application needs, which usually means read access scoped to specific resources.

Webhooks live under Admin > Manage > Integrations, and only Superadmin users can change them. You enter a URL and pick each event you want pushed. Appointment changes then reach the texting layer without constant polling.

Cerbo's own documentation flags one more thing. The extended_details endpoint returns a large payload per patient and runs slower than targeted endpoints. A good sync pulls narrow data on a delta schedule instead of dragging the full record each time.

Our implementation team handles the scoping, the event mapping, and the testing. Your staff writes none of it.

Consent, the BAA, and the Opt-Out

HIPAA-compliant texting rests on three things. A signed Business Associate Agreement with the vendor. Documented patient consent. A platform that encrypts and logs what it sends.

Consent shows up twice in the rules. HIPAA governs how PHI gets handled. The TCPA governs automated messages sent to mobile numbers, which is why a texting program needs a clear opt-in and a working opt-out. A patient replies STOP, sending stops, and that request stays on record.

Patients see none of this machinery. They see a normal text from your practice number, in the same thread list as everyone else they text.

Why Direct Care Feels the Difference First

Membership practices sell access. That's the product on the pricing page. A message that arrives without a login matches what the website promised.

Automation helps in a way that sounds backwards until you watch it run. Reminders and confirmations go out on their own at 9 AM. That frees your assistant to answer the two real questions that came in overnight. Patients feel more attention, because staff time shifts to the conversations that need a person.

HIPAA texting for a DPC or concierge practice also protects the physician's evenings. Coverage sits in a shared inbox with a name on every reply. Nobody's personal number becomes the channel of record.

The Open Thread: What Changes on the Schedule

Step

Through the Cerbo portal

Through 2-Way Texting

Patient sends it

Find the link, enter password, reset it if forgotten

Reply in a thread that's already open

Staff see it

When someone opens the portal message queue

Lands in the shared inbox

Patient reads the reply

At the next login, whenever that comes

On the lock screen

Follow-up question

Another login

Same thread

Documentation

Stored in Cerbo

Timestamped, exportable audit trail

 

Gartner has cited SMS open rates as high as 98%, against roughly 20% for email. That gap is the argument for moving routine traffic off a channel patients visit six times a year.

What the Confirmation Numbers Look Like

Based on our internal data, Curogram clients average above a 75% appointment confirmation rate. No-show rates across the client base run 53% below the industry average.

Practice

Before

After

Atlas Medical Center

14.20% no-show rate

4.91% within three months

Covina Arthritic Clinic

Manual confirmation calls

1,100+ appointments confirmed per month

 

Both practices are multi-specialty rather than functional medicine, so read them as proof of the mechanism. The mechanism holds either way. A message that reaches the lock screen gets a reply.

 

Curogram 2-Way Texting for Cerbo Practices

2-Way Texting gives your practice a real phone number patients can text. Behind it sits a shared inbox where your whole team can answer. Patients send a message the way they'd text a sister. Nothing installs, no account gets created, no password stands in the way.

Each conversation in the inbox carries the patient's name and full thread history. An assistant picking up a Friday message can see what the provider wrote on Tuesday. Saved replies cover the questions your team answers 30 times a week: parking, fasting rules, supplement timing, refill windows.

Secure texting for functional medicine practices needs more than an outbound blast tool. Patients write back, and those replies have to reach the right person.

Curogram routes an incoming message to the staff member assigned to that patient. Anyone on the team can step in when someone is out sick.

Every message is stored with a timestamp and a sender name. That gives you the audit trail a personal cell phone can never produce.

Curogram works under a signed Business Associate Agreement. Messages are encrypted in transit and at rest. Consent records and opt-outs are handled on the platform side. Your team keeps working the way it already works, and the channel stops asking the patient for a login.

Conclusion: Keep the Record in Cerbo, Move the Conversation to Text

Your patients pay for access. Every day, they show what access means to them. They answer texts in minutes and log into portals six times a year.

Cerbo earns its place as the clinical record for integrative and functional medicine. It tracks the supplement protocol, the custom intake, the recurring charge. Asking that same system to carry a 15-second dosing question is where the fit breaks down.

A texting layer beside Cerbo closes that gap. No migration, no data conversion, no change to how your providers chart. Your front desk stops chasing callbacks. Members stop needing a back channel.

Stop making a $500-a-visit patient reset a password to say yes. That single step is doing more damage to your renewal rate than any clinical decision you'll make this quarter.

Book your Cerbo integration demo and we'll walk your text experience end to end. You'll see the Cerbo connection, the shared inbox, and the audit trail running on your own workflow.

 

Frequently Asked Questions