Is Laravel HIPAA Compliant? Laravel Cloud's BAA, Encrypted Casts, and the 8 Settings (2026)

Last updated: September 14, 2026

Laravel is not HIPAA compliant on its own, and no framework is. HIPAA regulates the organizations that handle patient data, not the code they write. A Laravel app becomes part of a compliant system when three things hold. A host signs a Business Associate Agreement (BAA). The app uses Laravel's security features correctly. And your team does the required paperwork. So the real question behind "is Laravel HIPAA compliant" is who owns each layer. Laravel's own team says the same thing. Its August 25, 2026 post on Private Cloud ends with a plain line: "The application side is still yours." This guide covers both sides. Every plan, price, and setting below was checked against Laravel's docs and pricing pages on September 14, 2026.

TL;DR: Quick answer

• Laravel 13, released March 17, 2026, ships AES-256-CBC encryption, encrypted Eloquent casts, bcrypt and Argon2id hashing, CSRF protection, and a rate limiter. It has no built-in audit log, which every Laravel HIPAA compliant app needs.

• Laravel Cloud supports HIPAA only on its Enterprise and Private Cloud plans, through a signed BAA. Both are custom-priced. Starter, Growth, and Business ($5, $20, and $200 per month plus usage) do not qualify.

• Laravel Forge and Laravel Vapor make no HIPAA or BAA statement on their public pages as of September 14, 2026.

• Laravel Fortify adds TOTP two-factor authentication and passkeys. Laravel Sanctum API tokens never expire unless you set an expiration.

• Laravel 11 reached end of life on March 12, 2026. Laravel 12 gets security fixes only, until February 24, 2027.

Is Laravel HIPAA compliant? The three-layer answer

A Laravel HIPAA compliant system has three layers, and each one needs an owner. The first layer is the contract. Any vendor that stores or processes protected health information (PHI) for a covered entity is a business associate under 45 CFR § 160.103. Under 45 CFR § 164.308(b), you need a signed BAA with that vendor first. Our HIPAA business associate agreement guide explains what that contract must say. The second layer is the server. The host runs the physical safeguards. It also handles disk encryption, firewalls, backups, and patching. The third layer is your app and your team. The HIPAA Security Rule names five technical safeguards in 45 CFR § 164.312: access control, audit controls, integrity, person or entity authentication, and transmission security. Laravel gives you strong tools for four of the five. You still configure them, and you still run a risk analysis under 45 CFR § 164.308(a)(1). If you sell software to clinics, the full chain of duties is in HIPAA compliant hosting for healthcare SaaS. The short version is simple. A Laravel HIPAA compliant build is a contract, a hardened server, and a configured app, all at once.

What does Laravel give you for the HIPAA technical safeguards?

Here is how Laravel 13 maps to each rule in 45 CFR § 164.312. The middle column is what ships in the framework or its first-party packages. The last column is what a Laravel HIPAA compliant app still needs from you or your host.

Encrypted casts are the feature most Laravel HIPAA compliant apps lean on. Laravel offers the encrypted, encrypted:array, encrypted:collection, and encrypted:object casts, plus AsEncryptedArrayObject and AsEncryptedCollection. Each one encrypts the attribute with your APP_KEY before it reaches the database. That is app-level encryption at rest and in transit on top of the host's disk encryption. Two limits come with it. The column must be TEXT or larger. And Laravel's docs say you cannot query or search encrypted values. So plan your search fields before you encrypt a patient table. That one design choice decides how Laravel HIPAA compliant data models look in practice.

Does Laravel Cloud sign a BAA?

Yes, but only on two plans. For most teams, that is the first Laravel HIPAA compliant decision. Laravel's compliance docs say Laravel Cloud supports HIPAA for customers on its Enterprise and Private Cloud plans, through a signed BAA. The docs tell you to email cloud@laravel.com for a BAA before you deploy any PHI. Laravel's August 25, 2026 blog post is narrower. It says the HIPAA coverage is for Private Cloud customers, not shared plans such as Starter or Growth. Get the plan your BAA covers in writing before you sign. Here is the Laravel product line as published on September 14, 2026.

Private Cloud is a serious product. It gives you a dedicated AWS account, VPC, Kubernetes cluster, and compute nodes, with no shared tenancy. For a team that wants Laravel HIPAA compliant hosting from the framework's own company, it is the direct route. Laravel lists AES-256 encryption at rest, TLS 1.2 or higher in transit, and daily encrypted backups. Laravel Cloud also holds a SOC 2 Type 2 report. Laravel aims to add ISO 27001 in the third quarter of 2026. The shared plans are a different story. Their platform logs are kept for 1, 7, or 30 days depending on plan. That is day-to-day logging, not the audit logging HIPAA requires.

Forge and Vapor work differently. Forge manages servers you own on a provider you pick, so the BAA that matters comes from that provider. A Laravel HIPAA compliant setup on Forge starts with that contract. Ask counsel whether Forge's own server access needs a BAA too. Vapor runs your app on AWS Lambda in an AWS account you pay for. Lambda is on AWS's eligible list, and the settings are in our guide to whether AWS Lambda HIPAA compliant setups are possible. One more Laravel product needs a warning. Laravel Nightwatch's terms, effective June 16, 2025, forbid sending PHI or HIPAA-covered data to the service.

Which Laravel versions are still safe for PHI?

Only versions that still get security fixes. An unsupported version cannot stay part of a Laravel HIPAA compliant system for long. Laravel gives every major release 18 months of bug fixes and 2 years of security fixes. An old version is a risk your risk analysis must record. Here is the official support table as of September 14, 2026.

Patch level matters as much as version. On June 1, 2026, Laravel published a High-severity flaw in the default email validation rule, CVE-2026-48019, rated 8.9. It is fixed in Laravel 13.10.0 and 12.60.0. On September 10, 2026, a low-severity XSS in the debug page was fixed in 13.30.0 and 12.69.0. That one only matters when APP_DEBUG is on. Write your version and patch cadence into your HIPAA risk analysis. Keeping a Laravel HIPAA compliant app patched is a monthly job, not a launch task.

The 8 settings that make a Laravel app HIPAA-ready

These are the settings we check first when we review Laravel HIPAA compliant builds. Each one names the config key or package from Laravel's docs.

1. Protect APP_KEY. Generate it with php artisan key:generate and keep it out of source control. Rotate it with APP_PREVIOUS_KEYS, so old data still decrypts.

2. Encrypt PHI fields. Put names, dates of birth, diagnoses, and notes on encrypted casts with TEXT columns.

3. Require two-factor for staff. Enable Fortify's two-factor feature and require it for anyone who can see PHI. It works with any TOTP app, such as Google Authenticator.

4. Shorten sessions. SESSION_LIFETIME defaults to 120 minutes. Set it to match your logoff policy, and set SESSION_SECURE_COOKIE to true.

5. Expire API tokens. Sanctum tokens never expire by default. Set the expiration value and schedule sanctum:prune-expired.

6. Throttle login and PHI routes. Fortify throttles login by username and IP address. Add RateLimiter rules for PHI routes, which return HTTP 429 when exceeded.

7. Add an audit trail. Install spatie/laravel-activitylog, with about 5,900 GitHub stars, or owen-it/laravel-auditing, with about 3,500. Log who did what and when, never the PHI itself.

8. Lock production mode. Keep APP_DEBUG false and APP_ENV set to production. Install Telescope only for local development.

Items 3 and 4 map to two addressable rules in 45 CFR § 164.312. The logoff rules are in HIPAA automatic logoff, and the two-factor rules are in HIPAA MFA requirements. Session encryption is off by default too. Setting SESSION_ENCRYPT to true is a cheap extra layer. With all eight in place, most of the Laravel HIPAA compliant work inside the app is done.

Where do Laravel apps leak PHI?

Rarely in the models. Leaks come from the tools around the app. These are the five we see most in Laravel HIPAA compliant reviews.

• Debug mode. Laravel's docs warn that APP_DEBUG set to true in production risks exposing secret config values to users.

• Telescope. Its request watcher records request, header, session, and response data. The docs say the dashboard is public if APP_ENV is not set to production.

• Monitoring services. Nightwatch's terms forbid PHI. Check every error tracker and log shipper for a BAA before it sees a stack trace.

• Queued jobs. Job payloads are serialized and stored. Pass record IDs to jobs, not patient fields.

• Mail and notifications. Your mail provider needs a BAA. Keep PHI out of email bodies and link to a secure portal instead. Our best HIPAA compliant email guide lists providers that sign.

What does HIPAA hosting for Laravel cost in 2026?

A Laravel HIPAA compliant budget starts with routes that can sign a BAA. The cheap Laravel Cloud plans cannot, so they are not in this table. Figures are as published on September 14, 2026.

We sell the last row, so weigh it as a disclosure. The DIY row looks cheapest until you price the person who hardens and patches the server each month. If your database runs on AWS, read is Amazon RDS HIPAA compliant for the settings. The wider picture is in HIPAA compliant database hosting. If you are weighing Heroku, Render, or Vercel instead, we compare them plan by plan in HIPAA compliant app hosting.

If you would rather not run the server layer yourself

Most Laravel teams we talk to do not want to run servers. They want to ship features. They also want to show a clinic a signed BAA this week. Our managed HIPAA cloud hosting runs Laravel HIPAA compliant apps on encrypted AWS servers. Each server comes with a web application firewall, encrypted backups, audit logs kept for six years, and 24/7 monitoring. The BAA is signed within 24 hours. Plans start from $249 per month with migration included. If your Laravel app ships in containers, HIPAA compliant Docker hosting starts at the same price. You keep Laravel, your code, and your deploy process. We carry the server layer and sign for it. We sell this, so weigh it as a disclosure.

Here is the honest inverse. If your company already negotiated Laravel Private Cloud, it covers the infrastructure layer, and you do not need us. If your team runs AWS under AWS's BAA and an engineer owns patching, logging, and backups, that path works and costs less in cash. And if your app never touches PHI for a covered entity, HIPAA does not apply at all. For everyone else, our HIPAA compliant hosting plans are public. You can request a quote or tell us what you are building and get a straight answer.

Frequently asked questions

Is Laravel HIPAA compliant?

No framework is HIPAA compliant by itself. A Laravel HIPAA compliant system needs a host that signs a BAA. The app also needs encrypted casts, two-factor login, short sessions, and an audit log. Your organization completes the risk analysis. Laravel's own August 2026 post says the application side stays with you.

Does Laravel Cloud sign a BAA?

Yes, on the Enterprise and Private Cloud plans only, as of September 14, 2026. Both are custom-priced. For Laravel HIPAA compliant hosting from Laravel itself, request the BAA at cloud@laravel.com before deploying PHI. The Starter, Growth, and Business plans do not include HIPAA support.

Does Laravel encrypt data at rest?

Only the fields you choose. Laravel's encrypted casts encrypt model attributes with AES-256-CBC and a message authentication code before saving them. Encrypted columns must be TEXT or larger and cannot be searched. Disk and backup encryption come from your host.

Does Laravel have an audit log?

No. Laravel has application logging but no built-in record of who viewed or changed PHI. Most teams add spatie/laravel-activitylog or owen-it/laravel-auditing, and pair it with server and database logs from the host.

Are Laravel Forge and Vapor HIPAA compliant?

Neither makes a HIPAA or BAA statement on its public page as of September 14, 2026. A Laravel HIPAA compliant setup on either one depends on the underlying cloud. Forge manages servers you own, so your server provider's BAA matters. Vapor runs on AWS Lambda in your AWS account, which AWS covers under its own BAA when configured correctly.

Recap: Laravel HIPAA compliant

To recap, a Laravel HIPAA compliant app needs three things. It needs a host that signs a BAA, a hardened server, and an app configured for the Security Rule. Laravel 13 gives you encrypted casts, strong hashing, Fortify two-factor and passkeys, CSRF protection, and rate limiting. It does not give you an audit trail, so add one. Laravel Cloud signs a BAA only on Enterprise and Private Cloud. Any other Laravel HIPAA compliant route needs a host that signs. Forge and Vapor leave the BAA to your server provider. Stay on Laravel 12 or 13, patch monthly, and keep PHI out of debug tools, monitoring, queues, and email.

This article is general information, not legal advice. Plans, prices, BAA terms, and support dates change often. The details here reflect Laravel's public docs, pricing, blog, and GitHub advisories as read on September 14, 2026. Confirm current terms with each vendor, consult qualified counsel, and base your safeguards on a documented risk analysis. We sell HIPAA compliant hosting and compliance reviews. Reviewed September 2026.

Sources

• Laravel: Release notes and support policy.

• Laravel Cloud: Compliance and security and Pricing.

• Laravel blog: Laravel Private Cloud is now HIPAA compliant (August 25, 2026).

• Laravel: Forge, Vapor, and Nightwatch Terms of Service (effective June 16, 2025).

• Laravel docs: Encryption, Encrypted casting, Hashing, Fortify, Sanctum.

• Laravel docs: Session, CSRF protection, Rate limiting, Configuration and debug mode, Telescope.

• Laravel skeleton: config/session.php defaults.

• GitHub advisories: CVE-2026-48019 and XSS in debug page.

• Audit packages: spatie/laravel-activitylog and owen-it/laravel-auditing.

• 45 CFR § 164.312 (technical safeguards): law.cornell.edu.

• 45 CFR § 164.308 (administrative safeguards, BAA requirement): ecfr.gov.

• 45 CFR § 160.103 (definitions): ecfr.gov.