SquareML Access Key Public for 14 Months Exposes 238,000 Denver Health Medicaid Records

The incident originated when SquareML, a no-code healthcare analytics vendor, published credentials on a public website. DHMP received notice on August 14, 2026, and the account was read-only with no confirmed downloads or exports. Password resets followed, yet no independent log review or external audit has been disclosed to verify whether queries occurred during the exposure window.

Procurement records and similar incidents show analytics platforms routinely receive broad read access without enforced key rotation or network restrictions. Related cases at Quest Diagnostics and Paradigm Healthcare reveal identical third-party exposure patterns where vendors hold Medicaid and clinical data yet operate outside the covered entity's direct controls. The 14-month window indicates absence of automated secret scanning or monitoring, a systemic failure across contracted healthcare IT suppliers.

This case underscores how vendor negligence shifts breach risk onto health plans while official notices emphasize lack of evidence of misuse without releasing access logs. Regulatory filings from comparable events show delayed notifications often precede enforcement actions under state data protection statutes. Expect Colorado regulators to demand forensic evidence beyond vendor self-reporting.

Next steps include potential class actions and contract audits of SquareML's other clients. Health plans must implement mandatory key vaulting and quarterly access reviews to prevent recurrence.