Denver Health Medical Plan Discloses SquareML vendor breach affecting 238,083 members

238,083 current and former members of Denver Health Medical Plan, the Denver-area nonprofit health insurer, experienced a data breach involving healthcare analytics vendor SquareML, Hoodline reported Oct. 26, 2026.

Hoodline said SquareML accidentally put a live access key on a publicly accessible website. An access key is a credential that grants entry to a system, and a live key is one that still works.

Hoodline reported that the HIPAA Journal said the access key appeared on the public site on June 27, 2025. It remained on the public website for nearly 14 months before anyone noticed. Denver Health Medical Plan discovered it on the public website Aug. 14, 2026, according to Hoodline. The plan deactivated the access key Aug. 18, 2026.

Denver Health Medical Plan reported the breach to the U.S. Department of Health and Human Services on Oct. 1, 2026. Notification to the U.S. Department of Health and Human Services came after the plan deactivated the key.

Hoodline reported that the HIPAA Journal reported the disclosure Oct. 26, 2026. Public disclosure came more than a year after SquareML posted the key on the public site. Disclosure followed the plan’s discovery and deactivation of the key.

According to Hoodline, the plan said the compromised account provided read-only access. Read-only means anyone can view the data but not change it. Anyone holding the key could view the data but could not download, export, delete, or change anything in the database. The plan has found no evidence that anyone misused the key.

Hoodline reported that exposed details may include full names, cities, states, and ZIP codes, along with demographic information and dates of birth. Exposure may also have included provider names, details covering admission, discharge and transfers, health plan eligibility information, and health metrics including BMI, or body mass index, HbA1c, a blood-sugar measure, and eGFR, a kidney-function measure. The plan said no financial information or Social Security numbers were exposed.

This incident traces to a vendor error by SquareML.

Under Colorado’s breach notification statute, organizations must tell Colorado residents within 30 days of deciding that a breach may expose personal information and enable misuse, Hoodline reported. The federal Office for Civil Rights reviews every protected health information breach affecting at least 500 people. The number of affected members puts this incident well beyond that threshold.

Denver Health Medical Plan posted a notice about the incident on its own website, according to Hoodline. The plan is reaching out to individuals whose information the incident might have compromised. The plan mailed affected individuals letters describing the incident and listing protective steps.

Anyone with questions or a need for a Substitute Notice can call the incident hotline at 1-888-766-0023, according to Hoodline. The plan and the vendor are reviewing further corrective steps going forward.