1. Reporting; joint rule-making authority. The organization and the Department of Health and Human Services may adopt a joint rule to require the reporting to the organization of data from the cancer-incidence registry established pursuant to section 1404 and data related to the registration of vital statistics pursuant to section 2701. The rule adopted pursuant to this section is a routine technical rule as described in Title 5, chapter 375, subchapter 2?A.

2. Confidentiality of data reported. Data reported to the organization in accordance with subsection 1 is the organization’s data and must be protected by privacy and security measures consistent with health care industry standards. The data is confidential and may be released only in accordance with the organization’s rule on release of data to the public adopted pursuant to section 8707. Any such cancer data or vital statistics data may be released only in accordance with the organization’s rule adopted after the effective date of this subsection.