Denver Health Medical Plan has disclosed a data breach tied to a healthcare analytics vendor that exposed the protected health information of 238,083 current and former members. The vendor, SquareML, had inadvertently posted an active access key on a publicly accessible website, and it sat there for nearly 14 months before anyone noticed.
According to the HIPAA Journal, the key was added to the public site on June 27, 2025, and remained live for more than a year. Denver Health Medical Plan learned the key had been discovered on the public website on August 14, 2026, and deactivated it four days later, on August 18, 2026. As Claim Depot reports, the breach was reported to the U.S. Department of Health and Human Services on October 1, 2026.
The access key could have allowed entry into a SquareML-maintained database holding information on Denver Health Medical Plan members, but the plan says the compromised account was read-only. That means whoever had the key could view data but could not download, export, delete, or alter anything in the database, per the same account from the HIPAA Journal.
What Information Was in the Database
The potentially exposed information is extensive even without financial details. It includes full names, cities, states, and ZIP codes, demographic information, and dates of birth, the outlet reports. Health-related data potentially exposed includes provider names, hospital admission, discharge, and transfer information, health plan eligibility data, and health metrics such as BMI, HbA1c, and eGFR…