Denver Health Medical Plan (DHMP) has alerted approximately 238,000 members about a potential compromise of their personal and health-related data due to a security breach.
As a non-profit managed care entity under the Denver Health and Hospital Authority, DHMP operates in Denver, Colorado, providing Medicaid benefits through its Denver Health Medicaid Choice plan. This plan caters to Health First Colorado members residing in Denver and nearby counties.
Details of the Security Breach
The breach was linked to SquareML, a third-party vendor offering a no-code platform for healthcare analytics. DHMP disclosed that SquareML informed them on August 14, 2026, about a leaked access key on a publicly accessible site.
According to DHMP’s incident report, this access key, revealed online on June 27, 2025, was crucial for accessing a database managed by SquareML, which held data on 238,083 DHMP members. The key was deactivated on August 18, 2026, although during the exposure period, it might have been used to access sensitive member information.
Impact and Data at Risk
The compromised database was read-only, restricting capabilities such as downloading, exporting, deleting, or altering the information. Potentially exposed data includes member names, birth dates, ZIP codes, demographic details, health metrics, and hospital admission records, among others.
Importantly, the database did not contain Social Security numbers or financial data. DHMP has stated there is no current evidence suggesting misuse of the accessed data, though the possibility remains.
Response and Future Measures
In the wake of this incident, DHMP and SquareML have initiated password resets for all accounts accessing the database. They are also implementing further corrective actions to enhance security protocols.
This breach incident aligns with recent trends in healthcare data vulnerabilities, with other notable breaches affecting entities like Quest Diagnostics and Oracle Health. The growing frequency of such incidents underscores the critical need for robust data protection strategies in healthcare.
Moving forward, DHMP emphasizes its commitment to safeguarding member information and mitigating future risks through strengthened security measures.
