Relating to rapid DNA analysis by certain law enforcement agencies, the establishment of a related pilot program, and the content of certain DNA databases.

Contracts

• Master Services Agreements (MSAs): Vendors selling Rapid DNA hardware must amend MSAs to indemnify agencies against "loss of authorization" caused by equipment failure or software non-compliance.
• Service Level Agreements (SLAs): Contracts for the Pilot Program must explicitly guarantee a 2-hour processing turnaround. Failure to meet this statutory metric constitutes a material breach.
• Outsourcing Amendments: If a private entity is contracted for sample collection, the agreement must legally bind the contractor to DPS preservation and shipment rules (Section 5).

Hiring/Training

• Validation Specialists: Technology vendors must deploy staff capable of conducting and documenting validation studies that satisfy FBI Quality Assurance Standards (QAS) to prove equipment proficiency to DPS.
• Collection Staff: Phlebotomists and intake staff (including contractors) must be retrained on the specific, yet-to-be-published DPS protocols for Rapid DNA sample preservation.

Reporting & Record-Keeping

• Digitized Chain of Custody: Paper logs are insufficient for Rapid DNA integration. Systems must automatically generate digital chain-of-custody records compatible with CODIS interfaces.
• Validation Documentation: Vendors must maintain and provide accessible records of FBI proficiency testing for all deployed units.
• Collection Logs: Entities collecting samples must maintain specific records of collection and preservation until the sample is forwarded, subject to DPS audit.

Fees & Costs

• Capital Expenditures: While the state has allocated ~$2M for initial device and software acquisition in 2026, vendors should anticipate absorbing the costs of required validation studies and FBI compliance testing.
• Insurance: Review Professional Liability and Errors & Omissions (E&O) policies. Ensure coverage extends to regulatory audits and liability for data privacy breaches (e.g., inadvertent upload of PII to CODIS).