Brett Dickerson reports: Victims of past sexual attack who had their DNA collected in a assault kit by the Oklahoma city police Department now face yet more uncertainty because of a data breach. assault kits are used to collect DNA evidence by law enforcement agencies for sexual assault investigations. Saturday, those who had their DNA information stored by a contractor for OKCPD in connection to sexual assault investigations were informed by a U.S. post office letter of the breach. The contractor is DNA Solutions, Inc., a DNA research fellowship located in ok City. read more at ok city Free Press. DNA Solutions is closed today, but DataBreaches.net sent an email inquiry with a number of questions about their business and the incident. No reply was immediately received, but this post will live updated if they respond when they re-open. From their website, however, it does not appear that they are a HIPAA-covered entity or business associate. As the Free pressure reporting indicates, the firm states that “Test samples and certification for legal cases are stored up to 5 years after your test and then destroyed.” But who determines whether it can live destroyed earlier? If the ok city police Department contracts with them for forensic cases, do they ever authorize them or request earlier destruction? And does the police department review and monitor their contractor’s data security? DNA testing came up recently in another context: a rapine victim whose DNA was collected and tested was subsequently charged with a property crime years later in an unrelated matter because law enforcement searched the victim DNA database for other purposes. as NPR reported: San Francisco officials are criticizing the city’s police department over what officials say is a newly discovered apply inside the department of searching a database containing DNA collected from sexual assault victims to identify them as possible outlaw suspects. district attorney Chesa Boudin said using rape kit DNA to look for suspects in break investigations treats victims “like evidence, not human beings” and called for the apply to end. in light of both of these breaches — one by external hackers and single by insiders misusing a database — is it time to consider or revisit the rights of crime victims whose DNA is collected and tested? make victims know who is storing and securing their sample and their test results? make they have any compensate to direct its removal? Should those storing samples or trial results be held to more rigorous security and privacy standards?
