A Denver nonprofit health plan is telling 238,083 current and former members that an artificial intelligence vendor left its database key sitting on a public website for more than a year.
Denver Health Medical Plan learned on August 14 that the access key used by SquareML, which supplies an AI and machine learning analytics platform, had been exposed. SquareML accidentally published the credential on June 27, 2025, and it stayed reachable until deactivation on August 18, 2026.
The key gave read-only entry to a vendor database holding member names, addresses, demographic details, birth dates, plan eligibility, provider names, admission and discharge records, and clinical metrics including BMI, HbA1c and eGFR. Social Security numbers and financial accounts were not involved. The health plan, affiliated with the Denver Health and Hospital Authority, says it has found no evidence of misuse and that the credential could not have been used to download, export, delete or alter records.
Analytics vendors widen the exposure surface
The case adds a third-party analytics platform to the list of routes by which patient data leaves a covered entity’s control. A machine learning vendor holds clinical data in a form most hospitals never inventory, and a single leaked credential reaches all of it at once. Healthcare organizations contracting analytics services should confirm how vendor keys are stored, who can rotate them, and whether the vendor scans public repositories and websites for its own secrets.
Denver Health Medical Plan mailed notification letters itself rather than leaving the task to SquareML.
