HITRUST e1 assessment completed.
Concurrence has completed its 2026 HITRUST e1 assessment. Final reports are available for security review through our Trust Center. The assessment is recorded as Amigo AI 2026 e1 under Amigo, Inc., the legal entity behind Concurrence.
Request HITRUST e1 final reportsAssessment scope
What your team should review
The final report defines the assessed system, boundaries, and applicable dates. Ask our security team to map that scope to your proposed deployment, including hosting, model providers, integrations, and processing locations. Platform support for a cloud or data service does not establish its inclusion in the assessment.
Concurrence was formerly known as Amigo and Amigo AI. Amigo, Inc. remains the legal entity, so these names can appear in security reports and agreements. Our team can help reconcile the report identity with your Concurrence procurement review.
The essentials
What HITRUST e1 means
HITRUST’s Essentials (e1) program evaluates foundational cybersecurity controls. It is a distinct assessment level from HITRUST i1 and r2. Security assurance does not establish a clinical AI system’s safety, efficacy, or suitability for a particular patient-care workflow; those require separate evaluation and governance.
Read HITRUST’s e1 program descriptionEnterprise due diligence
Plan your enterprise security review
Match the assessed system to your deployment
Request the final HITRUST e1 reports and confirm the system boundary, report dates, hosting environment, and services relevant to your use case. A supported deployment option is not automatically inside an assessment’s scope.
Review the rest of the evidence
Evaluate the SOC 2 Type II report, HIPAA assessment, penetration-test summary, and current subprocessor list alongside HITRUST e1. Each document addresses a different review question and has its own scope and reporting period.
Agree on data handling and responsibilities
Confirm the DPA, retention and deletion terms, access controls, and hosting and inference locations. For protected health information, execute a BAA and confirm the required security configuration before processing PHI.
Questions & answers
Common security review questions
What is Concurrence’s HITRUST e1 status?
Concurrence has completed its 2026 HITRUST e1 assessment. Final reports are available for security review through our Trust Center. The assessment is recorded as Amigo AI 2026 e1 under Amigo, Inc., the legal entity behind Concurrence.
Does the HITRUST e1 assessment cover every deployment?
The final report defines the assessed system, boundaries, and applicable dates. Ask our security team to map that scope to your proposed deployment, including hosting, model providers, integrations, and processing locations. Platform support for a cloud or data service does not establish its inclusion in the assessment.
Is a HIPAA assessment the same as a certification?
No. HIPAA does not have an HHS-recognized certification program. Concurrence has an independent assessment of the Security and Breach Notification Rules. Using PHI still requires an executed BAA, the required safeguards, and review of your organization’s obligations.
Is Concurrence ISO 27001 or ISO 42001 certified?
No. ISO/IEC 27001 and ISO/IEC 42001 are readiness programs in progress. They are separate from our completed HITRUST e1 assessment, SOC 2 Type II audit, and HIPAA assessment.
Is Concurrence SOC 2 Type II audited?
Yes. The report covers the Concurrence Platform across the Security, Availability, and Confidentiality criteria. Request the current issued report through the Trust Center.
What privacy commitments does Concurrence make?
We maintain privacy controls and contractual protections for personal and health data, covering data-subject rights, international transfers, retention, and deletion. Our Data Processing Addendum and the regional compliance briefs for your jurisdiction are available through the Trust Center; your executed agreement defines the applicable obligations.
Can we use Concurrence with protected health information?
Yes, with an executed Business Associate Agreement and the required security configuration. Your BAA defines which Privacy Rule obligations apply.
Can all models process data in our chosen region?
No. Hosting and inference locations are separate. Model availability, provider routing, and fallback settings determine where AI processes data, and some models are unavailable in a required region.