(1) A registered undertaking shall, in respect of each health insurance contract that provides for the making of in-patient indemnity payments and that is effected by it on or after 1 January 2009, make all reasonable efforts to obtain the relevant information in respect of each insured person.

(2) A registered undertaking may, for the purposes of obtaining, in respect of a health insurance contract referred to in subsection (1), the relevant information in respect of each insured person, request in writing the policy holder to furnish the undertaking with the relevant information in respect of each insured person not later than 30 days from the date of receipt of the request.

(3) A request under subsection (2) shall be accompanied by a copy of this section.

(4) The policy holder, the subject of a request under subsection (2), shall comply with that request.

(5) A registered undertaking which has obtained relevant information for the purposes of subsection (1) shall not make use of, or disclose, the relevant information except -