Pharmaceutical giants and private health firms are among dozens of companies sold NHS patient data, according to a new report.
Some have used the data to formulate marketing strategies, inform their sales teams and work with clients to get new drugs into the NHS.
A list of firms was published by the Health and Social Care Information Centre (HSCIC) and covers contracts agreed with companies from April to December last year.
It includes agreements approved by the HSCIC's predecessor, the NHS Information Centre, but renewed over the last year.
Alongside charities and universities, major names including Bayer, Baxter, AstraZeneca, Bupa and Roche have bought data.
Consultancy firms McKinsey, PricewaterhouseCoopers (PwC) and Ernst and Young are also among those buying data.
The HSCIC said it only charges for the cost of producing the material and does not make a profit.
According to the report, Bupa accessed data that was anonymised but classed as both "sensitive" and "non sensitive".
It said this was to " assist the NHS and Bupa Group companies in the UK to improve the quality of healthcare management and service delivery in England by benchmarking performance against national trends".
It asked for sensitive information relating to patients' consultants to enable it to "analyse patterns of variation among consultants within a treatment specialty".
Meanwhile, Bayer bought hospital inpatient and outpatient data "t o identify the size of the uterine fibroids market in the UK to feed into the marketing strategy process".
Roche bought data to look at referrals between GPs and hospitals so it could analyse patient numbers and episodes of care at both an NHS trust and hospital level.
The private firm Health IQ Ltd, which works with the NHS and pharmaceutical companies, also accessed data.
On its website it said it had used data to help a client with a pre-launch drug in irritable bowel syndrome (IBS) raise the "priority of IBS on the commissioning agenda".
It said: "We were able to analyse and quantify the true burden of IBS, bringing in not just the directly coded cases, but also a wide range of other factors including indirectly coded and co-morbidities. This new figure could now be fed into the wider market access strategy, resulting in a range of tools which made a compelling case for change."
Today's register lists each organisation, the type of data released, the legal basis for release and the purpose for which the data was provided.
In total, 104 health and social care organisations (such as NHS trusts) and bodies such as universities and charities were included, alongside 56 private firms.
All the agreements have the appropriate legal basis in place under the current legal framework, the HSCIC said.
However, it said it is currently reviewing its data sharing procedures, including applications for new or renewed agreements.
One private firm, IMS Health, works with the pharmaceutical industry and uses data to look at the interaction between disease, treatment and prescribing across GP surgeries and hospitals.
Another, Harvey Walsh, uses hospital data to aid service delivery in the NHS and drug firms, while Northgate said it worked with organisations not limited to England.
"The market may also include commercial organisations," it said in its submission to HSCIC.
Private firm CSL said it specialises "in business intelligence and data management solutions for the healthcare industry".
It added: "We intend to use the data to understand the patient journeys into and through the hospital system. To do this we need to work with individual patient records, hence the need for detailed hospital episode statistics data sets.
"The aim of the analysis will ultimately be to provide data to support cost-benefit arguments to improve patient outcomes and or reduce treatment costs. Our primary customers are service providers to the NHS, principally pharmaceutical companies but also medical supplies/devices companies."
AstraZeneca uses hospital patient data for "i nsights" into areas such as patient pathways and the patterns, causes and effects of health and disease.
Meanwhile, McKinsey uses pseudonymised but "sensitive" data " as part of our consulting services for clients".
It said: "The majority of these clients will be NHS clients in England, and the data is used to research performance and outcomes, and identify improvement opportunities. The data is used to populate PowerPoint charts and Excel models provided to clients as part of these services."
Otsuka Pharmaceuticals Limited said it would use the data it obtained "to help the NHS plan for the introduction of their drug Samsca".
Meanwhile, Baxter said it needed data so its sales team could assess "where they should concentrate their efforts" for specific surgical products.
It said it needed to look at which hospitals carried out certain procedures "and the frequency/amount so that they (sales team) can plan their time according to the greatest potential".
Meanwhile, Gore Medical requested data to understand which hospitals are carrying out aortic and thoracic procedures in the NHS.
"It will also be used for sales planning activities - ie to assess whether we are making contact with the high volume NHS hospitals," it said.
The Checklist Partnership Limited said it uses data to produce software looking at areas such as how long patients stay in hospital.
"These are all for use by NHS organisations in the UK and healthcare organisations in Canada and Australia who are clients of the company."
Management consultant firm Oliver Wyman uses data for a database looking at areas such as "the number of episodes (in-patient and out-patient) by geography, hospital and the distance travelled for consultations.
"Analysis will also cover the patient path taken through the healthcare system and the outcomes of episodes.
"Additionally the data will be used as the basis of market size and growth assessments. Outputs of analysis will include articles and booklets for publication, presentations and varied other tools to communicate insight derived from the analysis."
Fletcher Spaght Inc was granted access to data for a client that is "developing new treatments for aortic valve disease".
Meanwhile, NHIS, which deals in market intelligence, said its "data will be incorporated, in conjunction with other healthcare-related data, in a range of tools and analyses to give online and tailored reports to allow our customers to understand and quantify NHS activity".
Ernst & Young said the data it has "will be used to help organisations understand their performance and to be used as a basis for scenario analysis for decision-making purposes. The data will be analysed at aggregate level and will not be used for isolation or identification of individual patients".
HSCIC chairman Kingsley Manning said of the report: "By placing this register before the public, the HSCIC is taking an important step towards the full transparency needed to help the public gain confidence in the services we provide.
"We are absolutely committed to encouraging scrutiny of our work and we welcome feedback on today's register, which is important towards informing the structure and clarity of future publications and indeed to the organisation as it develops.
"This is about ensuring citizens and patients are clear about how data is used to improve the health and social care received by them directly and by communities as a whole."
Emma Carr, deputy director of Big Brother Watch, said: "Patients still aren't being given the full picture. Parliament was told that every agreement made would be published, yet hundreds appear to have been left out. There also appears to be a complete failure to mention details of police access.
"Even from this limited disclosure, it is now undeniable that this information is being used by companies to plan their marketing activity without any clinical benefit to patients. It is essential that the rules that govern this information are clear about who can access existing data and what they are allowed to use it for before any more information, especially GP records, are made available."
Phil Booth, co-ordinator of medConfidential, said: "HSCIC continues in its ridiculous assertion that pseudonymised data is not sensitive or identifiable when tools its customers have built show you can track individuals visit-by-visit through hospital - and information published in press reports, social media posts or the date your child was born make it possible to pick out a named individual and read off their entire record.
"Billions of patient records continue to be sold for commercial use without patients' knowledge or consent, using as justification the very law that minsters have said provides additional safeguards."
The HSCIC said data released by its predecessor, the NHS Information Centre, will be examined separately in another review.
"We have also explained that this register covers data releases where a data-sharing agreement was in place. Data requests by police forces are released either by court order or under the Data Protection Act and therefore will not be included in the register."
Some of the data given to private firms includes small numbers of cases of people with rare conditions that "have not been suppressed".
The HSCIC has insisted that individual patients cannot be identified solely using the data and any firm identifying individual patients would be breaking the law.