Cook County Administrator addresses PHHS data breach

In a pair of press releases on Sept. 11, Cook County and the Grand Portage Band of Lake Superior Chippewa made public announcements about a data breach that took place in the Cook County Public Health and Human Services department.

Notices to individuals impacted by the breach were sent out earlier this week. Administrator Kristen Trebil-Halbersma told WTIP that 48 county residents were sent notices.

The press release from the Grand Portage Band clarified that the Band was not involved in the breach, and was announcing the breach in order to “ensure that our community members have the support they need.”

The data breach was a single employee,  Dana Logan, viewing records within the PHHS social services management system that she was not authorized to access. Logan was an adult mental health case manager for PHHS until her employment was terminated in August.

Trebil-Halbersma said, “Cook County became aware that we had an employee that was accessing information without proper authorization on May 22 and we worked with a forensic firm to help us to understand what happened, determine the scope, and helped us to look at each individual so we could provide as much information as we could about the information that was accessed by this this individual.”

PHHS maintains records for a wide variety of services they provide. Trebil-Halbersma said the notices that went out to impacted residents would include information about what type of data Logan accessed in each case. Information accessed may have included names, social security numbers, diagnostics, date of birth, and service notes. The exact data items accessed for each individual varied.

“We don’t have a full understanding of why the employee was accessing the data,” Trebil-Halbersma added. “But what we do know is that the individuals that she was accessing, she did not have authority or business reason or work reason to be accessing that information.”

Trebil-Halbersma confirmed that the data breach was the subject of one of the investigations that has been conducted in PHHS. The investigations began following employee grievances filed within the department in April. While several other employees resigned over the summer, related to the investigations, Logan was the only PHHS employee to be terminated.

In addition to removing Logan from her role, Trebil-Halbersma said the county is evaluating how to address data security in the future.  “Due to this data breach, we are and have been working on ensuring that we have the controls in place that are necessary to mitigate against future unauthorized access of protected information,” she said.

For those who received a letter and have questions, Trebil-Halbersma encouraged them to reach out to her directly. She can be reached at 218-387-3687, or by email at kristen.trebil@co.cook.mn.us. She said that impacted residents do not need to take further action, but that the notice includes more information on what their options are to protect their data moving forward.

The press release from the Grand Portage Band directs band members who received a letter to contact Hilja Iverson for support in navigating the impacts of the data breach. Iverson can be reached by phone at 218-996-1356, or by email at hilja.iverson@grandportage.com.

Over the past several weeks the county has discussed how to ensure continuity and quality of PHHS services, while also assessing the needs of the department. The Cook County Board of Commissioners recently opted to contract with two consultants to that aim.

Public information about the investigations into PHHS has been limited thus far. However, Trebil-Halbersma said that more information will be presented at the PHHS Board meeting on Sept. 16, addressing both the data breach investigation and others conducted over the summer.

WTIP’s Kirsten Wisniewski spoke with Administrator Kristen Trebil-Halbersma about the PHHS data breach. Audio of that interview is below.

Kirsten Wisniewski September 12, 2025