Denver Health Medical Plan has disclosed a data breach tied to a healthcare analytics vendor that exposed the protected health information of 238,083 current and former members. The vendor, SquareML, had inadvertently posted an active access key on a publicly accessible website, and it sat there for nearly 14 months before anyone noticed.
According to the HIPAA Journal, the key was added to the public site on June 27, 2025, and remained live for more than a year. Denver Health Medical Plan learned the key had been discovered on the public website on August 14, 2026, and deactivated it four days later, on August 18, 2026. As Claim Depot reports, the breach was reported to the U.S. Department of Health and Human Services on October 1, 2026.
The access key could have allowed entry into a SquareML-maintained database holding information on Denver Health Medical Plan members, but the plan says the compromised account was read-only. That means whoever had the key could view data but could not download, export, delete, or alter anything in the database, per the same account from the HIPAA Journal.
What Information Was in the Database
The potentially exposed information is extensive even without financial details. It includes full names, cities, states, and ZIP codes, demographic information, and dates of birth, the outlet reports. Health-related data potentially exposed includes provider names, hospital admission, discharge, and transfer information, health plan eligibility data, and health metrics such as BMI, HbA1c, and eGFR.
Denver Health Medical Plan, a nonprofit health insurer serving the Denver area, said financial information and Social Security numbers were not exposed, according to official disclosures cited by the HIPAA Journal. The plan also said it has not identified any evidence that the key was actually misused.
Notifications and Next Steps
Denver Health Medical Plan has posted a notice on its own website about the incident and says it is notifying individuals whose information may have been compromised, per the Denver Health Medical Plan site. The plan has mailed letters to affected individuals detailing the incident and outlining protective steps they can take. Those with questions or seeking a Substitute Notice can call the plan's incident hotline at 1-888-766-0023.
The plan says it is evaluating additional remedial actions with SquareML going forward. Colorado's data breach law requires entities to notify Colorado consumers when their personal information may have been compromised, generally within 30 days of determining that a breach occurred and could lead to misuse, according to the Colorado Attorney General. Separately, the federal Office for Civil Rights investigates all breaches of protected health information affecting 500 or more individuals, per its own breach portal guidance — a threshold this incident clears by a wide margin given the number of members involved.
