What Is This About?

If you received an email or letter about a data breach from Denver Health Medical Plan (“DHMP”), your personal and protected health information may be at risk from a data breach. Our firm is investigating this incident and can help you understand your rights and legal options.

What Happened?

On June 27, 2025, SquareML, a healthcare analytics vendor used by DHMP, inadvertently published credentials (an active access key) on a publicly accessible website that could be used to access a database containing information about DHMP members. DHMP was informed about this on August 14, 2026, after the compromised credentials had remained publicly available for nearly 14 months. Upon learning of the situation, DHMP began an internal investigation and worked with SquareML to secure the affected data. Passwords were reset and the access key was deactivated on August 18, 2026.

On October 1, 2026, DHMP notified the U.S. HHS Office for Civil Rights of the breach, indicating that protected health information for all 238,083 plan members was compromised by the incident. DHMP has also posted a public notice to its website. DHMP has mailed letters to affected individuals.

What Information Was Impacted?

According to DHMP’s public notice, the following categories of information were involved:

• Names;
• Dates of birth;
• Contact information;
• Demographic information;
• Health information including health metrics and tests results;
• Health insurance information; and
• Other protected health information.

What Action Can You Take?

Levi & Korsinsky, LLP is investigating whether affected persons are entitled to compensation. If you received a notice letter or email from Denver Health Medical Plan, there is no cost or obligation to participate. Follow the link below to find out about your rights and potential legal remedies available.