October 26, 2026: Denver Health Medical Plan is notifying 238,083 members that their health information was reachable through an access key its vendor, SquareML, had left on a public website. The plan says it has found no evidence that the key was misused. Canonical: denver-health-medical-plan-squareml2026. Primary source: HIPAA Journal's report of the notice, with the plan's website.
The breach is an unusually long one. The key was public for more than a year before the plan learned of it, and that gap is the most important part of the story. Health plans depend on vendors for analytics and reporting, which means a vendor's security practices are part of the plan's own exposure.
What happened
- June 27, 2025: the vendor posted an access key used by SquareML to a public website.
- August 14, 2026: the plan learned of the exposure.
- August 18, 2026: the plan deactivated the key.
- October 26, 2026: the first public report appeared, from HIPAA Journal. The plan says notification letters have been mailed. The letter date is not stated in the report.
Technical analysis
SquareML is an AI and machine-learning analytics platform. The key it used gave access to records held in the environment the key was tied to, and the key sat in public view for the length of the exposure. The plan says it has not found evidence that the key was misused. This article does not describe how the key could be used, because that would amount to a walkthrough. The timeline is worth reading closely: the plan deactivated the key four days after it learned of it, which was the fast part. The slow part was the year before that, when the key was public without anyone at the plan knowing.
Because both the plan and its vendor are involved, members should look for a notice from the plan itself, not only for a third-party report. One investigation site describes the access as read-only. That detail comes from a secondary source and is not confirmed by the plan, so it is not treated as fact here.
What data was exposed
Per reporting on the notice, the records reachable with the key included:
- Names and location details
- Dates of birth
- Plan eligibility information and provider names
- Admission and discharge records
- Health metrics, including BMI, HbA1c and eGFR
Reporting says financial information and Social Security numbers were not exposed. The data covers current and former members.
Verified vs unverified
- Verified (plan notice, as reported): the key exposure, the June 27, 2025 posting date, the August 14 discovery, the August 18 deactivation, the count of 238,083 members, and the statement that no misuse has been found.
- Reported (HIPAA Journal): the list of data fields and the statement that financial information and Social Security numbers were not exposed.
- Unverified: the read-only description of the access, which comes from a single secondary source.
Who is at risk
Current and former members of Denver Health Medical Plan are in scope. The combination of health information, dates of birth and provider names makes medical-billing scams and insurance-themed phishing the most likely follow-on risks. Members who have a relationship with a specific provider may be more convincingly targeted. Former members are included in the count, so people who no longer have coverage with the plan should also read the notice.
What to do
- Read the notice letter carefully and note the phone number and website it lists. Use only those channels to contact the plan.
- Be suspicious of calls about your coverage or a bill that you did not expect, especially if the caller quotes your provider or your admission dates. Hang up and call the number on your member card.
- Do not give your Social Security number or payment details to anyone who calls about a health claim. Legitimate payers rarely need that in an unsolicited call.
- Review your explanation of benefits statements for services you did not receive, and report anything unfamiliar to the plan.
- Ask the plan whether credit monitoring is available if you want it. Reporting does not say whether it has been offered.
What the notice does not say
The reporting does not give the letter date, and it does not say whether the access was logged. It also does not say what contractual steps the plan has taken with the vendor. Members who want those details should ask the plan directly. The difference between data that was reachable and data that was accessed matters here: the plan says it has found no evidence of misuse, which is not the same as saying no record was viewed.
Related reading
For another health data incident where a vendor's exposure reached patient records, see CareCloud's patient-records breach. For a hospital case with a similar pattern of patient data reaching outsiders, see the Madera Community Hospital breach.