Medical records appear to have been wrongly given to the insurance industry by the health service, the NHS admits.
Details on hospital admissions from 1989 to 2010 were handed to the Institute and Faculty of Actuaries.
The information was used to produce a report to help insurance firms price their products.
The Health and Social Care Information Centre, which runs the database of records, said "greater scrutiny" should have been applied.
The information given to the Institute contained details on treatments and diagnoses, age, the area the patient lived in, but not their names.
It was handed over in January 2012 and the Institute paid £2,220 to cover the Information Centre's costs in compiling the data.
The Institute is the professional body for actuaries, the risk experts who work for insurance and investment companies.
A spokeswoman for the Health and Social Care Information Centre said: "The HSCIC believes greater scrutiny should have been applied by our predecessor body [the centre was known as the NHS Information Centre at the time] prior to an instance where data was shared with an actuarial society.
"We would like to restate that full postcodes and dates of birth were not supplied as part of this data and that it was not used to analyse individual insurance premiums, but to analyse general variances in critical illness."
It said it would publish details of the bodies to whom it supplied such data later this year.
"We are absolutely committed to the public understanding what is being done with their information," the spokeswoman added.
But the centre was unable to explain to the BBC in what way the rules were not followed.
This development comes amid mounting concern about a new data-sharing project, which will be administered by the Information Centre.
Last week, NHS England agreed to delay the roll-out of Care.data by six months until the autumn amid criticism of how it has run the public information campaign about the project.
The central database will involve taking records from GP practices and linking them with hospital files already stored by the Information Centre.
Experts say it will enable them to assess diseases, examine new drugs on the market and identify infection outbreaks, as well as monitor the performance of the NHS.