NHS England is investigating whether any patients have been harmed by an administrative mix-up.
Some 500,000 documents containing medical information, including cancer test results, were mistakenly put in storage rather than being sent to the GP or filed in the patients' records.
An investigation is under way, focusing on the estimated 2,500 patients who may have been adversely affected and need further medical checks.
So far, no harm has been reported.
The error occurred when a mail redirection company hired by the NHS failed to pass on documents that had either been incorrectly addressed or needed re-routing because the patient had moved to a new GP surgery.
The company, NHS Shared Business Services, has expressed regret for the failings, which occurred between 2011 and 2016 in the East Midlands, the South West and north-east London.
An NHS England spokesperson said: "A team including clinical experts has reviewed that old correspondence and it has now all been delivered wherever possible to the correct practice."
Speaking in the House of Commons, Health Secretary Jeremy Hunt confirmed that 2,000 of the higher risk cases had now been reassessed by doctors - at a cost of £2.2m - with no harm detected. The remaining 500 are still being assessed.
He said it was "completely extraordinary" that so much data had gone missing unnoticed for so long.
Shadow health secretary Jonathan Ashworth described the "astonishing" failure as an "absolute scandal".
"The news is heartbreaking for the families involved and it will be scarcely believable for these hospitals and GPs who are doing their best to deliver services despite the neglect of the government. We urgently need to know how this was allowed to happen, how many patients were involved and how many have been harmed, and whether patients remain at risk."
Health Secretary Jeremy Hunt first disclosed the data error in July 2016, but, at that time, did not say how many primary care patients had been affected.
Dr Richard Vautrey of the British Medical Association said the error would have meant some GPs were treating patients without all the relevant information that they needed.
"That might mean repeat prescriptions, which would be unnecessary, as they have been taken before. And it might mean delay in diagnosis. If that happened it's at best an inconvenience to the patient, and at worst there's a risk of patient harm."
Katherine Murphy of the Patients Association said the episode had the potential to be hugely damaging to patient care and trust.
"Patients trust the NHS to look after their confidential information and this confidence is now eroded."
Prof Helen Stokes-Lampard, chair of the Royal College of GPs, said: "Patient care and safety must always be the number one priority when awarding private companies contracts for any work in the health service. What we are seeing here is companies bidding for, and being awarded, contracts for work that is much more complex that they originally thought.
"We must learn lessons from this - as we must learn from any errors - and ensure that any initiatives to increase efficiency in the NHS are undertaken with caution, and in the long term best interests of general practice, the wider NHS, and our patients."