Denver Health Medical Plan reports vendor breach affecting 238,000 members

What happened

• The breach involved a third‑party vendor that mishandled protected health information.
• More than 238,000 plan members were notified of the incident.
• HIPAA breach notification requirements apply.

Why it matters

Other health plans should review vendor security controls and ensure breach‑notification procedures are ready, as regulators may scrutinise similar incidents.

Business impact

Potential civil penalties and reputational damage could arise if the breach is found to violate HIPAA security rules.

What to check

1. 1

   review vendor contractsHigh priority

   Confirm that Business Associate Agreements include required security and breach‑notification clauses.

2. 2

   conduct risk assessmentMedium priority

   Assess the scope of the breach and identify any gaps in current security controls.

3. 3

   update incident response planHigh priority

   Incorporate lessons learned from the breach and test notification timelines.