Health chiefs are facing calls to stop sharing patient information with the Home Office, which uses the data as part of efforts to locate suspected illegal migrants.
MPs urged NHS Digital to immediately withdraw from an agreement under which immigration enforcement authorities have made thousands of requests for "non-clinical" details held by health bodies, such as names and addresses.
A "memorandum of understanding" published last year set out how information can be shared as part of efforts to trace those in the country unlawfully.
But the Commons Health Committee claimed there had been "inadequate consultation" during the formulation of the memorandum.
There have been warnings that some undocumented migrants are avoiding seeking healthcare as a result of the scheme.
Committee chairwoman Dr Sarah Wollaston said: "We are seriously concerned about the way NHS Digital has approached its duty to respect and promote confidentiality.
"Whilst we recognise the public interest in assisting on a case-by-case basis where a serious crime is being investigated, we do not agree with NHS Digital's assertion that their current arrangements for the purpose of immigration-tracing requests constitute case-by-case data sharing.
"There has been a failure to appreciate the wider implications of their actions for the individuals concerned, for clinicians, and for wider public health."
Dr Wollaston has written to Sarah Wilkinson, chief executive of NHS Digital, to request that the body immediately withdraws from the memorandum of understanding and ceases sharing data with the Home Office for immigration-tracing purposes while a review is carried out.
Information can be requested in relation to those who have failed to comply with reporting restrictions, absconded from immigration control, escaped from detention, exceeded their time limit to stay in the UK or sought to obtain leave to remain by deception.
Under the agreement, the Home Office can only request data in cases where the person in question is not in contact with authorities and "other reasonable and appropriate efforts to locate them have failed".
NHS Digital can refuse a request if it is not satisfied it is in the public interest.
In cases where the Home Office suspects an immigration offence has been committed, it provides what details it has to NHS Digital to check against its own records.
If there is a match and the request is accepted, NHS Digital will disclose information from its databases, such as names, dates of birth and last known addresses.
Figures show the Home Office made 1,775 requests for non-clinical data from September to November.
In 1,355 cases details were traced, in 330 there was no trace, while 90 requests were turned down.
An NHS Digital spokeswoman said: "We can confirm we have received a letter from the chair of the Health Select Committee.
"We will consider it carefully and will respond fully in due course."