Title 9 Part 6192

Executive Law section 995-b(9) states that “After reviewing recommendations from the Division of Criminal Justice Services, the commission, in consultation with the DNA subcommittee, shall promulgate a policy for the establishment and operation of a DNA identification index consistent with the operational requirements and capabilities of the Division of Criminal Justice Services.” This policy ensures that procedures related to all legal and programmatic obligations of Executive Law, section 995-b have been set forth in order to properly govern the establishment and operation of the DNA databank. This policy was adopted by the commission based on the recommendations of the division and in consultation with the DNA subcommittee.

Nothing in this section shall preclude an investigating agency and the appropriate prosecutor from requesting a familial search of an unidentified profile meeting the criteria set forth in the policy which is associated with a case in which a defendant was previously convicted.

The accuracy and completeness of all DNA records maintained as part of the DNA databank will be assured through compliance with laboratory accreditation standards as promulgated by the commission in Part 6190 of this Title. In addition, accuracy and completeness of all DNA records maintained as part of the DNA databank will be assured through compliance by all forensic DNA laboratories with the requirements of the NDIS Operating Procedures. Each DNA profile submitted must be certified by the submitting laboratory as being associated with the appropriate controls and blanks. Copies of all official correspondence between the DNA databank and participating laboratories will be maintained in the appropriate division file.

The server on which the DNA databank resides shall be located in a secure area to prevent unauthorized physical access in accordance with NDIS requirements. All forensic DNA laboratories which use or contribute data to the DNA databank shall choose CODIS compatible software and hardware designs which prevent unauthorized access to DNA records. Each participating laboratory must have a written information systems plan which specifies the architecture of the laboratory's computer hardware and the structure of security comprising the access control component of the computer software employed. The information systems plan must demonstrate that an electronic audit trail is maintained for activities related to the entering or editing of DNA records. In addition, the information systems plan shall conform with all applicable information security rules, regulations, and policies. The division, in consultation with forensic DNA laboratory directors, shall develop model documents to assist forensic DNA laboratories in complying with the requirements of this Part. A final information systems plan shall be submitted by the laboratory for review and approval by the division prior to the laboratory gaining access as a participant in the DNA databank. The division shall determine the acceptability of each laboratory information systems plan. The NYS standards must be designed and applied in such a way as to allow compliant participating forensic DNA laboratories to participate in the FBI’s CODIS program.

At least once per year, audits will be conducted by the division of all forensic DNA laboratories to assure that no illegal disclosures of DNA records have taken place. This audit will verify that all necessary documents required for accessing and controlling DNA records and their associated information have been appropriately completed, and compliance with the laboratory's approved information systems plan. These documents include, but are not limited to, the use and dissemination agreements between the laboratory and user agencies or the division; search request forms and search result forms; and case disposition query forms. In addition, the audit will review the participant laboratory's standard operating procedure (SOP) related to these procedures to ensure that the SOP is complete and up-to-date. The division may develop a standardized audit checklist to assist in completion of the required audits. The division may provide the audit report to the laboratory for remediation of any findings, if necessary. Within 90 days of the completion of the audit, the division shall submit a summary audit report to the chair of the DNA subcommittee, reporting the findings of the audit as well as any response from the laboratory and/or recommendations for changes. The DNA subcommittee shall review the audit report, and forward binding recommendations to the commission for action. Once DNA subcommittee and commission action on the audits are completed, the audit report shall be maintained by the division for three years from the date of the commission's final action related to the audit report, after which the audit report may be disposed. A record of disposition shall be maintained in the permanent files of the division for each forensic DNA laboratory.

Access to record information system facilities, systems operating environments and data file contents (whether while in use or when stored in a media library) shall be restricted to authorized personnel only. These restrictions shall be assured through compliance by the laboratory with the accreditation standards promulgated by the commission in Part 6190 of this Title.

Inquiries, updates, or destruction of DNA records in the DNA databank shall only be made by authorized sources of inquiry, update, or destruction. Inquiries related to DNA records in the DNA databank may be accepted only from a participating, accredited forensic DNA laboratory; a subject of the DNA databank (see Part 6193 of this Title); an agency authorized to make such inquiry pursuant to a properly executed use and dissemination agreement (see Part 6193 of this Title); other authorized CODIS laboratories outside of New York State; or the FBI (see section 6192.10 of this Part). Update or destruction of records shall only be made by an authorized agent of the division or its designee. Any update to, or destruction of, a DNA record in the DNA databank shall be recorded in a log following an electronic or hardcopy form prescribed by the division.

As noted in Executive Law section 995-b(9)(vi), “Operational programs shall be used to detect and store for the output of the division or its designee all unauthorized attempts to penetrate the DNA databank.” The division shall certify to the DNA subcommittee and commission that the DNA databank hardware and software architecture has been appropriately designed, implemented and safeguarded to eliminate the realistic chance that such unauthorized attempts to penetrate the DNA databank could go undetected. This certification shall be made based on conformance of the DNA databank with all applicable information security rules, regulations, and policies. The division shall maintain this certification in a file with the written information system plans from participant laboratories (see section 6192.5 of this Part). A current certification must be on file at the division at all times.

Mutual exchange, use and storage of DNA records within the DNA databank with the system of DNA identification by the FBI shall be allowed, provided that: