Bupa approved to access sensitive medical records as campaigners question patient consent for release.
Private health firms, including Bupa, can pay £140 to identify potentially millions of patients and then access their health records, detailing intimate medical histories, under a new national arrangement in the NHS, the Guardian can reveal.
The records, which include sensitive information about hospital visits, such as a mother's history of still births, patients' psychiatric treatment and critical care stays, allow individuals to be identified by use of postcode, gender and age as well as their socioeconomic status.
On Monday the government slipped out the news that private insurer Bupa was approved to access England's "sensitive or identifiable" patient data, housed centrally by the Health and Social Care Information Centre (HSCIC).
It is now among four private firms that have passed the government's vetting procedures.
The prime minister has argued that companies such as Britain's key life sciences firms should be able to benefit from the NHS's vast collection of patient data. But critics argue that this amounts to putting the NHS "up for sale".
Like millions of other patients, I'm certain I never gave my consent for that."
The Guardian has established that private companies are already attempting to access patient records which can identify individuals.
In July a private research firm Civil Eyes was granted access to sensitive "consultant code" data.