Notice of Data Security Incident

The State of Colorado Department of Health Care Policy and Financing (HCPF) is committed to protecting the security and privacy of the information we maintain. On October 16, 2026, HCPF began notification regarding an incident related to the Health First Colorado (HFC) enrollment site.

On August 18, 2026, HCPF - with the assistance of the Colorado Office of Information Technology (OIT), verified the presence of a misconfiguration on an HFC website that permitted certain unauthorized queries to be made on the webpage, which could allow access to certain enrollee data. Upon verification, we immediately took steps to address the misconfiguration. We also engaged third-party cyber security experts to conduct an investigation, which confirmed that certain unauthorized queries were made between April 8, 2026, and July 22, 2026. Through the ongoing investigation, we are working to identify the specific individuals and information that may have been involved in the incident.

The ongoing investigation determined that the some or all of the following information may have been contained in data fields responsive to unauthorized queries for certain HFC enrollees: names, dates of birth, the last four digits (only) of Social Security numbers, mailing addresses, contact information, Case IDs and/or HFC State IDs.

We continue working diligently, through the ongoing investigation, to identify the enrollees whose information may have been involved. Upon completion of the investigation, we will mail notification letters to the individuals whose information may have been involved. We encourage those whose information may have been involved to review the statements they receive from their providers and health insurers. If the statements identify services that were not received, they should contact the provider or insurer that issued the statement immediately.

HCPF takes this incident very seriously. To help prevent something like this from happening again, we have implemented additional safeguards to further protect the HFC enrollment website and the information in its care. For questions, please contact: 800-800-1625 Monday through Friday from 8 a.m. to 4:30 p.m. except for state holidays and the third Thursday of each month from 2 to 4:30 p.m.