A vendor left the door open for 14 months. Now 238,000 Denver Health Medical Plan members are getting breach notices.