Is Flight PHP HIPAA Compliant? Not Fly.io, and What the Framework Leaves to You (2026)

Last updated: September 14, 2026

Flight PHP is not HIPAA compliant on its own, and no framework is. HIPAA regulates the organizations that handle patient data, not the code they use. Flight also gives you less to start with than most frameworks. Its core has zero dependencies and no built-in login, sessions, CSRF protection, or encryption. So a Flight PHP HIPAA compliant app is mostly what you add, plus a host that signs a Business Associate Agreement (BAA). One note first. Search results for Flight PHP often show Fly.io, a hosting company. They are different things, and we explain the difference below. Flight's own security guide shows good patterns for the gaps. You still have to build them, and you have to patch. Seven advisories hit Flight in 2026. Every fact below was checked against Flight's docs and GitHub on September 14, 2026.

TL;DR: Quick answer

• Flight v3 is a micro-framework with zero core dependencies. Its security guide shows how to add CSRF tokens, security headers, CORS rules, and rate limits yourself.

• Flight's plugin list recommends a JWT library, official permissions and session plugins, and Defuse PHP Encryption. It lists no audit log or rate limit plugin.

• Flight published seven security advisories in 2026, six rated High. Run the latest release, 3.19.3 as of September 14, 2026.

• HTTP method override was on by default until 3.19.1. Flight's guide says to disable it.

• Flight PHP is not Fly.io. Fly.io is a host that offers a BAA. Flight is code, and it cannot sign one.

Is Flight PHP HIPAA compliant? The three-layer answer

A Flight PHP HIPAA compliant system has three layers, and each one needs an owner. The first is the contract. Any vendor that stores or processes protected health information (PHI) for a covered entity is a business associate under 45 CFR § 160.103. Under 45 CFR § 164.308(b), you need a signed BAA with that vendor first. Our HIPAA business associate agreement guide explains what it must cover. The second layer is the server. The host runs the physical safeguards, disk encryption, firewalls, backups, and patching. The third layer is your app and your team. The HIPAA Security Rule lists five technical safeguards in 45 CFR § 164.312. They are access control, audit controls, integrity, person or entity authentication, and transmission security. Flight gives you middleware hooks where those controls can run. It does not ship the controls. You also run a risk analysis under 45 CFR § 164.308(a)(1).

Is Flight PHP the same as Fly.io?

No. Flight PHP is an open-source PHP framework for building web apps and APIs. Fly.io is a company that runs apps on its own servers. Because the names look alike, search engines mix them up. Fly.io's compliance page says its BAA is pre-signed and becomes active when you sign it, as we found in our September 11, 2026 review. That BAA covers Fly.io's hosting. A framework like Flight cannot sign a BAA, because it is code, not a vendor. So the Flight PHP HIPAA compliant question is really two questions. Which host will sign? And have you built the missing safeguards? Our comparison of hosts, including Fly.io, is in HIPAA compliant app hosting.

What does Flight v3 give you for the HIPAA technical safeguards?

Very little in core, by design. Here is how Flight v3 maps to each rule in 45 CFR § 164.312. The last column is what a Flight PHP HIPAA compliant app still needs from you or your host.

That table is not a flaw so much as a Flight PHP HIPAA compliant to-do list. Flight's security guide gives working patterns for most rows. The plugin ecosystem is thin, though. The official permissions plugin has about 10 GitHub stars, and the session plugin has about 11. Small packages can be fine, but review them before they guard PHI. That review is part of Flight PHP HIPAA compliant work. A full-stack framework moves several of these rows into the middle column: Laravel ships encrypted casts and Fortify two-factor, as our guide to whether Laravel HIPAA compliant apps are possible sets out, and Symfony ships firewalls and login throttling, covered in our guide to whether Symfony HIPAA compliant apps are possible. Neither ships an audit log either.

Which Flight versions are safe to run?

Version 3.19.3 or later. Flight shipped several releases between August and September 2026, and each fixed real problems. Four April advisories do not list patched versions on the summary we checked, so read each one. A Flight PHP HIPAA compliant app on an older release carries known High-severity flaws.

The method override flaw matters most for Flight PHP HIPAA compliant apps. With the override on, attackers could turn a safe request into a delete request using a header. That enabled cross-site request forgery and bypassed middleware checks. Flight still supports PHP 7.4. The September flaw only affects PHP 7.4 and 8.0, so moving to PHP 8.1 or later adds a safety margin. Record your versions in your HIPAA risk analysis.

The 8 settings that make a Flight app HIPAA-ready

These are the first things we check in Flight PHP HIPAA compliant reviews. Each one comes from Flight's security guide or release notes.

1. Run Flight 3.19.3 or later. It is the latest release, and it includes the confirmed fixes for method override and View::e. Check each advisory page for the rest.

2. Set flight.allow_method_override to false. Flight's guide says to disable it if your app does not need it.

3. Turn off display_errors in production. Log errors on the server instead, as the guide advises.

4. Add CSRF middleware. CSRF protection is not automatic. Store a token in the session and check it on every form post.

5. Add security headers and strict CORS. Use a headers middleware with HSTS and a content security policy. Allow only your own origins.

6. Hash passwords and use short-lived tokens. Use password_hash for passwords and a maintained JWT library with short expiry.

7. Encrypt PHI fields. Use Defuse PHP Encryption, which Flight's plugin list recommends, and keep keys out of the code.

8. Add rate limits and an audit trail. Limit login attempts with a cache counter that returns HTTP 429. Log who viewed or changed PHI, without the PHI itself.

Short token lifetimes tie to HIPAA automatic logoff. Two-factor login ties to HIPAA MFA requirements. With all eight in place, most Flight PHP HIPAA compliant work inside the app is done.

Where do Flight apps leak PHI?

Mostly through defaults and helpers. A Flight PHP HIPAA compliant setup closes each path below. These are the leaks we see most in Flight PHP HIPAA compliant reviews.

• Error pages. The default error handler once exposed sensitive details. Keep errors off screen in production.

• JSONP endpoints. Unvalidated callbacks allowed XSS. Avoid JSONP on any route with PHI.

• Method override. Left on, it lets a header change a request's meaning and slip past checks.

• Logs. Custom logging often captures request bodies. Keep patient fields out.

• Email. Your mail provider needs a BAA. Keep PHI out of email bodies and link to a secure portal instead.

In a micro-framework, developers write most of the safeguards. The basics are in HIPAA training for web developers.

Who signs the BAA for a Flight app, and what does it cost?

Your host does. Flight has no official hosting product, so no Flight vendor signs a BAA. A Flight PHP HIPAA compliant budget starts with a host that will. Our September 11, 2026 review found that AWS signs in AWS Artifact, DigitalOcean signs with a paid support plan, and Fly.io offers a pre-signed BAA. Frameworks with a hosting company behind them give you one more door to knock on, which is why the Laravel and Symfony guides above start with a plan table and this one starts with your host.

We sell the second row, so weigh it as a disclosure.

If you would rather not run the server layer yourself

Flight keeps your code small, but the server under it still needs care. Our managed HIPAA cloud hosting runs Flight PHP HIPAA compliant apps on encrypted AWS servers. Each server comes with a web application firewall, encrypted backups, audit logs kept for six years, and 24/7 monitoring. The BAA is signed within 24 hours. Plans start from $249 per month with migration included. Containerized apps fit our HIPAA compliant Docker hosting at the same price. We run the server layer, keep PHP current, and sign for it. We sell this, so weigh it as a disclosure.

Here is the honest inverse. If your Flight app never handles PHI for a covered entity, HIPAA does not apply, and you do not need us. If your team already runs a server under a signed BAA with an engineer who patches promptly, that works and costs less in cash. For everyone else, our HIPAA compliant hosting plans are public. You can request a quote or tell us what your app does and get a straight answer.

Frequently asked questions

Is Flight PHP HIPAA compliant?

No framework is HIPAA compliant by itself. A Flight PHP HIPAA compliant app needs a host that signs a BAA. It also needs CSRF middleware, security headers, password hashing, field encryption, rate limits, and an audit trail. Flight's core provides none of those, but its guide shows how to add them.

Is Flight PHP the same as Fly.io?

No. Flight PHP is an open-source PHP framework. Fly.io is a hosting company that offers a pre-signed BAA for its platform. A framework cannot sign a BAA. Only vendors that handle your data, such as your host, can.

Does Flight PHP have authentication or sessions?

Not in core. Flight's docs show how to write auth middleware. Its official plugin list includes a permissions plugin, a session plugin, and a recommended JWT library. Review small plugins before they guard PHI.

Which Flight version fixes the 2026 CSRF advisory?

Version 3.19.1 fixed the HTTP method override flaw, CVE-2026-42551, and a follow-up bug in the same setting. Version 3.19.3 fixed an XSS flaw on PHP 7.4 and 8.0. Run 3.19.3 or later and set method override to false.

Do I need a BAA for a Flight PHP app?

Yes, if the app stores or sends PHI for a clinic, health plan, or other covered entity. Every vendor that touches that data needs one, starting with your host. Flight has no official host, so your hosting provider must sign.

Recap: Flight PHP HIPAA compliant

To recap, a Flight PHP HIPAA compliant app needs a host that signs a BAA and a hardened server. Flight v3 gives you routing and middleware hooks, not security controls. You add CSRF middleware, security headers, strict CORS, password hashing, field encryption, rate limits, and an audit trail. Run 3.19.3 or later, set method override to false, turn off error display, and remember that Fly.io is a separate company.

This article is general information, not legal advice. Versions, plugins, and advisories change often. The details here reflect Flight's documentation and GitHub releases and advisories as read on September 14, 2026. Hosting details, including Fly.io, come from our September 11, 2026 review. Confirm current terms with each vendor, consult qualified counsel, and base your safeguards on a documented risk analysis. We sell HIPAA compliant hosting and compliance reviews. Reviewed September 2026.

Sources

• Flight docs: Flight PHP documentation, Security guide, Middleware, and Plugins.

• GitHub: Flight releases and Security advisories.

• GitHub advisories: CVE-2026-42551, Method override applied too late, and XSS in View::e.

• Plugins: flightphp/permissions and flightphp/session.

• Fly.io: Compliance.

• 45 CFR § 164.312 (technical safeguards): law.cornell.edu.

• 45 CFR § 164.308 (administrative safeguards, BAA requirement): ecfr.gov.

• 45 CFR § 160.103 (definitions): ecfr.gov.