Pharmaceutical giants and private health firms are among dozens of companies sold NHS patient data, according to a new report.
Some have used the data to formulate marketing strategies, inform their sales teams and work with clients to get new drugs into the NHS.
A list of firms was published by the Health and Social Care Information Centre (HSCIC) and covers contracts agreed with companies from April to December last year.
It includes agreements approved by the HSCIC's predecessor, the NHS Information Centre, but renewed over the last year.
10 of the biggest names who bought the data
4. BMJ Publishing
6. Ernst and Young
8. Nuffield Trust
9. PricewaterhouseCoopers (PwC)
Alongside charities and universities, major names including Bayer, Baxter, AstraZeneca, Bupa and Roche have bought data.
Consultancy firms McKinsey, PricewaterhouseCoopers (PwC) and Ernst and Young are also among those buying data.
The HSCIC said it only charges for the cost of producing the material and does not make a profit.
According to the report, Bupa accessed data that was anonymised but classed as both "sensitive" and "non sensitive".
It asked for sensitive information relating to patients' consultants to enable it to "analyse patterns of variation among consultants within a treatment specialty".
Meanwhile, Bayer bought hospital inpatient and outpatient data "to identify the size of the uterine fibroids market in the UK to feed into the marketing strategy process".
Roche bought data to look at referrals between GPs and hospitals so it could analyse patient numbers and episodes of care at both an NHS trust and hospital level.
The private firm Health IQ Ltd, which works with the NHS and pharmaceutical companies, also accessed data.
On its website it said it had used data to help a client with a pre-launch drug in irritable bowel syndrome (IBS) raise the "priority of IBS on the commissioning agenda".
It said: "We were able to analyse and quantify the true burden of IBS, bringing in not just the directly coded cases, but also a wide range of other factors including indirectly coded and co-morbidities. This new figure could now be fed into the wider market access strategy, resulting in a range of tools which made a compelling case for change."
Today's register lists each organisation, the type of data released, the legal basis for release and the purpose for which the data was provided.
In total, 104 health and social care organisations (such as NHS trusts) and bodies such as universities and charities were included, alongside 56 private firms.
All the agreements have the appropriate legal basis in place under the current legal framework, the HSCIC said.
However, it said it is currently reviewing its data sharing procedures, including applications for new or renewed agreements.
One private firm, IMS Health, works with the pharmaceutical industry and uses data to look at the interaction between disease, treatment and prescribing across GP surgeries and hospitals.
Another, Harvey Walsh, uses hospital data to aid service delivery in the NHS and drug firms, while Northgate said it worked with organisations not limited to England.
"The market may also include commercial organisations," it said in its submission to HSCIC.
Private firm CSL said it specialises "in business intelligence and data management solutions for the healthcare industry".
It added: "We intend to use the data to understand the patient journeys into and through the hospital system. To do this we need to work with individual patient records, hence the need for detailed hospital episode statistics data sets.
"The aim of the analysis will ultimately be to provide data to support cost-benefit arguments to improve patient outcomes and or reduce treatment costs. Our primary customers are service providers to the NHS, principally pharmaceutical companies but also medical supplies/devices companies."
AstraZeneca uses hospital patient data for "insights" into areas such as patient pathways and the patterns, causes and effects of health and disease.
Meanwhile, McKinsey uses pseudonymised but "sensitive" data "as part of our consulting services for clients".
It said: "The majority of these clients will be NHS clients in England, and the data is used to research performance and outcomes, and identify improvement opportunities. The data is used to populate PowerPoint charts and Excel models provided to clients as part of these services."
Otsuka Pharmaceuticals Limited said it would use the data it obtained "to help the NHS plan for the introduction of their drug Samsca".
Meanwhile, Baxter said it needed data so its sales team could assess "where they should concentrate their efforts" for specific surgical products.
It said it needed to look at which hospitals carried out certain procedures "and the frequency/amount so that they (sales team) can plan their time according to the greatest potential".
Meanwhile, Gore Medical requested data to understand which hospitals are carrying out aortic and thoracic procedures in the NHS.
"It will also be used for sales planning activities - ie to assess whether we are making contact with the high volume NHS hospitals," it said.
The Checklist Partnership Limited said it uses data to produce software looking at areas such as how long patients stay in hospital.
"These are all for use by NHS organisations in the UK and healthcare organisations in Canada and Australia who are clients of the company."
Management consultant firm Oliver Wyman uses data for a database looking at areas such as "the number of episodes (in-patient and out-patient) by geography, hospital and the distance travelled for
"Analysis will also cover the patient path taken through the healthcare system and the outcomes of episodes.
"Additionally the data will be used as the basis of market size and growth assessments. Outputs of analysis will include articles and booklets for publication, presentations and varied other tools to communicate insight derived from the analysis."
Fletcher Spaght Inc was granted access to data for a client that is "developing new treatments for aortic valve disease".
Meanwhile, NHIS, which deals in market intelligence, said its "data will be incorporated, in conjunction with other healthcare-related data, in a range of tools and analyses to give online and tailored reports to allow our customers to understand and quantify NHS activity".
Ernst & Young said the data it has "will be used to help organisations understand their performance and to be used as a basis for scenario analysis for decision-making purposes. The data will be analysed at aggregate level and will not be used for isolation or identification of individual patients".
HSCIC chairman Kingsley Manning said of the report: "By placing this register before the public, the HSCIC is taking an important step towards the full transparency needed to help the public gain confidence in the services we provide.
"We are absolutely committed to encouraging scrutiny of our work and we welcome feedback on today's register, which is important towards informing the structure and clarity of future publications and indeed to the organisation as it develops.
"This is about ensuring citizens and patients are clear about how data is used to improve the health and social care received by them directly and by communities as a whole."