Is Flight PHP HIPAA Compliant? Not Fly.io, and What the Framework Leaves to You (2026)

Last updated: October 22, 2026

Flight PHP is not HIPAA compliant on its own, and no framework is. HIPAA regulates the organizations that handle patient data, not the code they use. Flight also gives you less to start with than most frameworks. Its core has zero dependencies and no built-in login, sessions, CSRF protection, or encryption. So a Flight PHP HIPAA compliant app is mostly what you add, plus a host that signs a Business Associate Agreement (BAA). One note first. Search results for Flight PHP often show Fly.io, a hosting company. They are different things, and we explain the difference below. Flight's own security guide shows good patterns for the gaps. You still have to build them, and you have to patch. Eight advisories hit Flight in 2026, including a Critical one in October. Every fact below was checked on its primary source on October 20, 2026. The October 21 PHP security release was checked on php.net on October 22, 2026.

TL;DR: Quick answer

• Flight v3 is a micro-framework with zero core dependencies. Its security guide shows how to add CSRF tokens, security headers, CORS rules, and rate limits yourself.

• Flight's plugin list includes a JWT library, official permissions and session plugins, and Defuse PHP Encryption. It lists no audit log or rate limit plugin.

• Flight published eight security advisories in 2026: one Critical, six High, and one Moderate. Run the latest release, 3.19.4 as of October 20, 2026.

• Upgrading alone does not close the Critical flaw. You must also set flight.views.restrict_to_path to true.

• HTTP method override is still on by default in 3.19.4. Flight's guide strongly recommends turning it off unless your app needs it.

• Flight PHP is not Fly.io. Fly.io is a host that offers a BAA. Flight is code, and it cannot sign one.

Is Flight PHP HIPAA compliant? The three-layer answer

A Flight PHP HIPAA compliant system has three layers, and each one needs an owner. The first is the contract. Any vendor that stores or processes protected health information (PHI) for a covered entity is a business associate under 45 CFR § 160.103. Under 45 CFR § 164.308(b), you need a signed BAA with that vendor first. Our HIPAA business associate agreement guide explains what it must cover. The second layer is the server. The data center runs the physical safeguards. Disk encryption, firewalls, backups, and patching sit here too. Check which of these your host runs and which fall to your own engineer. The third layer is your app and your team. The HIPAA Security Rule lists five technical safeguards in 45 CFR § 164.312. They are access control, audit controls, integrity, person or entity authentication, and transmission security. Flight gives you middleware hooks where those controls can run. It does not ship the controls. You also run a risk analysis under 45 CFR § 164.308(a)(1).

Is Flight PHP the same as Fly.io?

No. Flight PHP is an open-source PHP framework for building web apps and APIs. Fly.io is a company that runs apps on its own servers. Because the names look alike, search engines mix them up. Fly.io's compliance page says its BAA is pre-signed and becomes active when you sign it, as checked on October 20, 2026. That BAA covers Fly.io's hosting. A framework like Flight cannot sign a BAA, because it is code, not a vendor. So the Flight PHP HIPAA compliant question is really two questions. Which host will sign? And have you built the missing safeguards? Our ranking of the best HIPAA compliant hosting providers compares hosts, starting with BAA scope.

What does Flight v3 give you for the HIPAA technical safeguards?

Very little in core, by design. Here is how Flight v3 maps to each rule in 45 CFR § 164.312. The last column is what a Flight PHP HIPAA compliant app still needs from you or your host.

That table is not a flaw so much as a Flight PHP HIPAA compliant to-do list. Flight's security guide gives working patterns for most rows. The plugin ecosystem is thin, though. The official permissions plugin has about 10 GitHub stars, and the session plugin has about 11. Small packages can be fine, but review them before they guard PHI. That review is part of Flight PHP HIPAA compliant work.

A full-stack framework moves several of these rows into the middle column. Laravel ships encrypted casts and Fortify two-factor, as our guide to whether Laravel HIPAA compliant apps are possible sets out. Symfony ships firewalls and login throttling, covered in our guide to whether Symfony HIPAA compliant apps are possible. Neither ships an audit log either.

Staying small keeps the same rows open. Slim leaves them to you too, but it follows PSR-15, so any maintained PSR-15 middleware drops straight in. If the package pool decides your framework, our guide to whether Slim Framework HIPAA compliant APIs are possible runs the same table for Slim.

Which Flight versions are safe to run?

Version 3.19.4 or later, with flight.views.restrict_to_path turned on and method override turned off. Flight shipped security fixes in 3.18.1, 3.19.1, 3.19.3, and 3.19.4 between April and October 2026. The October fix closes a Critical flaw, but only after you enable it. A Flight PHP HIPAA compliant app on an older release carries known Critical and High-severity flaws.

The October flaw matters most for Flight PHP HIPAA compliant apps. If a route passes user input to Flight::render() as a template name, an attacker can reach files outside the views folder. A planted file, such as an upload or a log, then runs as PHP. The advisory gives it a CVSS score of 9.8 out of 10. Version 3.19.4 adds the flight.views.restrict_to_path setting, but it is off by default. New projects built from Flight's skeleton turn it on.

The method override flaw comes next. With the override on, a header or a _method field can turn a safe request into a delete request. That enables cross-site request forgery and bypasses middleware checks. Flight still supports PHP 7.4. The September flaw only affects PHP 7.4 and 8.0.

PHP itself needs patching too. On October 21, 2026, PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 fixed two critical flaws that can allow unauthenticated remote code execution. PHP 8.1 and older no longer get updates from the PHP project. Confirm each server runs one of those releases, a later one in the same branch, or a vendor package with both fixes. Record your versions in your HIPAA risk analysis.

The 8 settings that make a Flight app HIPAA-ready

Work through these settings before a Flight app touches PHI. They draw on Flight's security guide, its plugin list, and its release notes.

1. Run Flight 3.19.4 or later, and restrict templates. It is the latest release, and it carries the fixes for all eight 2026 advisories. Set flight.views.restrict_to_path to true, because the October fix is off by default.

2. Set flight.allow_method_override to false. The default is still true. Flight's guide strongly recommends false for any app that does not need the override.

3. Turn off display_errors in production. Log errors on the server instead, as the guide advises. Keep flight.debug at its default of false.

4. Add CSRF middleware. CSRF protection is not automatic. Store a token in the session and check it on every form post.

5. Add security headers and strict CORS. Use a headers middleware with HSTS and a content security policy. Allow only your own origins.

6. Hash passwords and use short-lived tokens. Use password_hash for passwords and a maintained JWT library with short expiry.

7. Encrypt PHI fields. Use Defuse PHP Encryption, which Flight's plugin list includes, and keep keys out of the code.

8. Add rate limits and an audit trail. Limit login attempts with a cache counter that returns HTTP 429. Log who viewed or changed PHI, without the PHI itself.

Short token lifetimes tie to HIPAA automatic logoff. Two-factor login ties to HIPAA MFA requirements. With all eight in place, most Flight PHP HIPAA compliant work inside the app is done.

Where do Flight apps leak PHI?

Mostly through defaults and helpers. A Flight PHP HIPAA compliant setup closes each path below. The first four come straight from Flight's 2026 advisories.

• Error pages. The default error handler exposed sensitive details before 3.18.1. Keep errors off screen in production.

• JSONP endpoints. Unvalidated callbacks allowed XSS before 3.18.1. Avoid JSONP on any route with PHI.

• Method override. Left on, it lets a header change a request's meaning and slip past checks.

• Templates. A template name built from user input can reach files outside the views folder. Turn on flight.views.restrict_to_path.

• Logs. Custom logging can capture request bodies. Keep patient fields out.

• Email. Your mail provider needs a BAA. Keep PHI out of email bodies and link to a secure portal instead.

In a micro-framework, developers write most of the safeguards. The basics are in HIPAA training for web developers.

Who signs the BAA for a Flight app, and what does it cost?

Your host does. Flight has no official hosting product, so no Flight vendor signs a BAA. A Flight PHP HIPAA compliant budget starts with a host that will. As of October 20, 2026, AWS offers its BAA in AWS Artifact, and Fly.io offers a pre-signed BAA. DigitalOcean signs one on request: new customers ask sales, and existing customers ask support. Frameworks with a hosting company behind them give you one more door to knock on. That is why the Laravel and Symfony guides above cover Laravel Cloud and Symfony Cloud, while this one starts with your host.

Teams on CodeIgniter can run the same checks with our guide to whether CodeIgniter HIPAA compliant apps are possible. Teams weighing a move to Slim for a PHI API will find a seven-setting checklist there.

We sell the second row, so weigh it as a disclosure.

If you would rather not run the server layer yourself

Flight keeps your code small, but the server under it still needs care. Our HIPAA compliant Flight PHP hosting runs Flight PHP HIPAA compliant apps on single-tenant AWS servers. Every plan includes a web application firewall, the CloudFront CDN, and encryption at rest and in transit. It also includes six-year audit logging, tested encrypted backups, and EBS storage with 7-day snapshot retention. We sign the BAA within 24 hours of signup, before any patient data moves. It covers the servers and services we run. Outside services that receive PHI, such as your mail provider, need their own BAAs.

Plans start from $229 per month in six sizes, from Starter to Network, and run month to month with no long-term contract. You get 4 hours of migration and configuration included in the first month, then $175 an hour, quoted before work starts. Our guide to moving to HIPAA compliant hosting covers the switch. Containerized apps fit our HIPAA compliant Docker hosting on the Performance tier, from $259 per month. For apps on other stacks, see our managed HIPAA cloud hosting. You keep Flight, your routes, and your middleware. We sell this, so weigh it as a disclosure.

Here is the honest inverse. If your Flight app never handles PHI for a covered entity, HIPAA does not apply, and you do not need us. If your team already runs a server under a signed BAA with an engineer who owns it, that works and can cost less in cash. For everyone else, our HIPAA compliant hosting plans are public. You can request a quote or tell us what your app does and get a straight answer.

Frequently asked questions

Is Flight PHP HIPAA compliant?

No framework is HIPAA compliant by itself. A Flight PHP HIPAA compliant app needs a host that signs a BAA. It also needs CSRF middleware, security headers, password hashing, field encryption, rate limits, and an audit trail. Flight's core provides none of those. Its security guide shows how to add CSRF tokens, security headers, password hashing, and rate limits. Its plugin list includes Defuse PHP Encryption for fields, but the app's audit trail is yours to build.

Is Flight PHP the same as Fly.io?

No. Flight PHP is an open-source PHP framework. Fly.io is a hosting company that offers a pre-signed BAA for its platform. A framework cannot sign a BAA. Only vendors that handle your data, such as your host, can.

Does Flight PHP have authentication or sessions?

Not in core. Flight's docs show how to write auth middleware. Its plugin list includes official permissions and session plugins, plus a JWT library. Review small plugins before they guard PHI.

Which Flight version fixes the 2026 CSRF advisory?

Version 3.19.1 fixed the HTTP method override flaw, CVE-2026-42551, and a follow-up bug in the same setting. The override is still on by default, so set it to false yourself. Version 3.19.3 fixed an XSS flaw on PHP 7.4 and 8.0. Run 3.19.4 or later, and set flight.views.restrict_to_path to true to close the October Critical template flaw.

What is the Critical Flight advisory from October 2026?

On October 7, 2026, Flight disclosed a path traversal flaw in Flight::render(). A route that uses user input as a template name could run a planted file as PHP. Version 3.19.4 adds the fix, but it is off by default. A Flight PHP HIPAA compliant app should set flight.views.restrict_to_path to true during bootstrap.

Do I need a BAA for a Flight PHP app?

Yes, if the app stores or sends PHI for a clinic, health plan, or other covered entity. Every vendor that touches that data needs one, starting with your host. Flight has no official host, so your hosting provider must sign.

Recap: Flight PHP HIPAA compliant

To recap, a Flight PHP HIPAA compliant app needs a host that signs a BAA and a hardened server. Flight v3 gives you routing and middleware hooks, not security controls. You add CSRF middleware, security headers, strict CORS, password hashing, field encryption, rate limits, and an audit trail. Run 3.19.4 or later, turn on flight.views.restrict_to_path, set method override to false, and turn off error display. Also run PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12, a later release in the same branch, or a vendor package with both fixes. Remember that Fly.io is a separate company.

This article is general information, not legal advice. Versions, plugins, and advisories change often. The details here reflect Flight's documentation and GitHub releases and advisories as read on October 20, 2026. Hosting details for AWS, DigitalOcean, and Fly.io were read on their own pages the same day. PHP release details were read on php.net on October 22, 2026. Confirm current terms with each vendor, consult qualified counsel, and base your safeguards on a documented risk analysis. We sell HIPAA compliant hosting. Reviewed October 2026.

Sources

• Flight docs: Flight PHP documentation and Security guide.

• Flight guides: Middleware and Plugins.

• GitHub: Flight releases and Security advisories.

• GitHub advisories: CVE-2026-42551, Method override applied too late, and XSS in View::e.

• October 2026 advisory: Path traversal in Flight::render(), fixed in Flight 3.19.4.

• PHP: Security advisory: Critical remote code execution vulnerabilities (October 21, 2026).

• Plugins: flightphp/permissions and flightphp/session.

• Hosts: AWS HIPAA compliance, HIPAA at DigitalOcean, and Fly.io compliance.

• 45 CFR § 164.312 (technical safeguards): law.cornell.edu.

• 45 CFR § 164.308 (administrative safeguards, BAA requirement): ecfr.gov.

• 45 CFR § 160.103 (definitions): ecfr.gov.