Fopull LLC

Services

HIPAA-adjacent systems

Intake portals, scheduling, records that sit next to protected health information. Built under a Business Associate Agreement to your security officer's controls, with the audit log, the encryption and the access model in place before launch rather than bolted on for the audit.

Start a scope call
Ty Johnston
Ty Johnston Scopes it, builds it, runs it. Fopull LLC, Knoxville, TN.
Stack
BAA, Audit logging, Encryption at rest, RBAC, Strict CSP, Self-hosted backups, Restore drills
Terms
Scope call, paid discovery, written plan, fixed-bid milestones

How Fopull approaches it

Fopull is not a covered entity. What Fopull is, is the engineering team that builds the system to your compliance standard and walks your auditors through what it does. That begins with a Business Associate Agreement, and with a conversation with whoever owns security on your side about which controls apply.

The default posture is the same on every engagement of this kind. Encryption at rest and in transit. Append-only audit logging on every read and write of a sensitive record, so the question "who looked at this" has an answer. Access tied to provisioned identities, never shared logins, with capabilities granted per person and revoked the same way. Sessions and tokens that expire short. Backups that are self-hosted, encrypted, and restore-tested on a schedule, with the drill written down. An incident playbook before the first real record goes in.

If you are pre-BAA and trying to work out what is in scope, the first step is a written scope: which data is protected, where it flows, and which controls each part of the system therefore needs. That document is useful whether or not Fopull builds the system.

Worked example: the studio's own internal dashboard

fopull.com runs an employee dashboard on a separate hostname with the posture described above, used for the studio's own HR, billing and legal documents. Employees sign in on a guard that is separate from the public site's accounts, so a customer session can never be mistaken for a staff one; a test asserts that an employee session does not render as a site account and the other way round.

The dashboard serves a strict Content Security Policy with no inline scripts, which surfaced a real defect on the day it was applied: the confirmation on the most destructive button on one page had been an inline handler, so it never ran and the button submitted on a single click. Per-employee legal documents and per-project agreements are encrypted at rest, and access to each feature is a capability granted by an administrator to a named person.

None of that is a covered entity's compliance program. It is the same engineering, on the studio's own data, in daily use through 2026.

More of this, dated and with the numbers, in the engineering log.

Questions people ask

Are you HIPAA certified?
There is no such certification, and Fopull is not a covered entity. Fopull works under a Business Associate Agreement and builds to the controls your security officer sets, then documents what the system does so your auditors can check it.
Will you sign our BAA?
Yes, before seeing any protected data. Send yours, or ask for a template.
Can the system be self-hosted?
Yes, and for this kind of data it usually should be. See the self-hosted infrastructure page for how that is done and operated.

How an engagement goes

  1. A scope call

    Thirty minutes on the problem and the constraints.

  2. A written plan

    Short paid discovery, then a document you can take anywhere.

  3. Built in milestones

    Fixed-bid where the scope is clear, hourly where it cannot be.

  4. Handed over with a runbook

    Or run for you under a retainer.

Start a scope call Ask a question first