Denver Health Medical Plan Breach Exposed Data of 238,000 Members for 14 Months - Hoodline

Denver Health Medical Plan has disclosed a data breach affecting 238,083 current and former members due to an exposed access key from vendor SquareML that remained public for 14 months. The key was added to a public website on June 27, 2025, and wasn't discovered until August 14, 2026, when it was deactivated four days later.

According to the HIPAA Journal, the breach was reported to the U.S. Department of Health and Human Services on October 1, 2026. While the compromised account was read-only, potentially allowing viewing but not downloading or altering data, the exposed information is extensive.

Exposed Information

The database contained full names, addresses, demographic information, dates of birth, and health-related data including provider names, hospital admission/discharge information, health plan eligibility data, and metrics such as BMI, HbA1c, and eGFR. Financial information and Social Security numbers were not exposed.

Response and Investigation

Denver Health Medical Plan has posted a notice on its website and is mailing letters to affected individuals with protective steps. The plan has not identified evidence the key was misused but is evaluating additional remedial actions with SquareML.

Colorado's data breach law requires notification within 30 days of determining a breach could lead to misuse. The federal Office for Civil Rights is investigating as the breach affects more than 500 individuals.