Serious patient safety issues are being buried in confidential hospital reports, BBC Panorama has found.
Freedom of Information requests revealed 111 reports, written by medical royal colleges, which NHS trusts have a duty to share.
Eighty reports were given to the BBC but only 26 had been shared in full with regulators, and 16 published.
The Department of Health would not comment on whether it might change the law to ensure publication.
'A great disappointment'
Since the 2015 Morecambe Bay maternity scandal in which 11 babies and a mother died, NHS Trusts are supposed to publish summaries of external reviews, and share them with the regulator.
An earlier review into the hospital had previously identified concerns but had not been made public.
Dr Bill Kirkup, who led a 2015 investigation into the Morecambe Bay scandal, said Panorama's findings were a "great disappointment".
"People should know that there is something that is important enough to be looked at and they should know what the results of that scrutiny are.
"I can't understand what the rationale would be for withholding the existence of a report or the findings of the report. These are important matters of accountability in the public service."
James Titcombe, who became a patient safety campaigner after his baby son Joshua died due to failures of care at Morecambe Bay, said by not publishing reports "there are possibly risks out there that the regulator is unaware of, and ultimately those risks can have tragic consequences".
Freedom of Information (FoI) requests were sent to all NHS Trusts in the UK requesting any Royal College reviews of services in the last five years.
The colleges set standards of care and can be commissioned to review how a health care provider is performing.
Of the 80 reports released to the BBC, just 16 are in the public domain, and only 26 were shared in full with the regulators.
In another 22 cases the regulator was only aware of the review or had only seen part of it. Sixty-five of the 80 contained potential or actual patient safety concerns.
Though the BBC had been told about 111 reports, the Royal Colleges told Panorama they had carried out about 260 reviews in the same period.
Prof Helen Stokes-Lampard, who chairs the Academy of Medical Royal Colleges, said she was "dismayed" summaries of reports were not being made public, and it had published guidance in 2016 saying reports dealing with safety or care concerns should be made public.
"If things are not being shared, and if that has implications for patient safety, that must be put right. The fact that a review is done should never be secret and indeed a summary of the findings should always be published".
The vasculitis department at the Royal Liverpool Hospital treats people with a disease affecting the blood vessels.
In 2015, after concerns were raised by other clinicians, the Royal College of Physicians (RCP) was called in.
The college recommended there should be an audit of patients treated during the previous two years "without delay" to ensure they were on the correct treatment.
FoI requests reveal there were 400 patients under the care of the unit at that point.
But 18 months after the review, less than a quarter had been checked.
Out of a group of 26 who were on powerful medications, two were found to have been given them "inappropriately", four were given "possibly excessive" doses and three had died while suffering side effects from the drugs.
BBC Panorama has seen emails from the RCP threatening to tell the regulator, the Care Quality Commission (CQC), if the audit wasn't completed, but it did not follow through.
In addition, the CQC was never told by the hospital or the college about the concerns or given the full report. Instead it was only told a review had happened.
The CQC said if it had known an audit was required, it would have monitored the outcomes.
And the RCP said it was "satisfied that the trust made reasonable attempts to complete the audits" but was "very disappointed with the speed of response and progress", adding that the trust "had a clear obligation to share serious ongoing concerns with patients and the regulator".
The Royal Liverpool Hospital said it was "committed to providing safe and excellent care" and that the recommendations identified within the RCP's 2015 report have since been "successfully implemented, or are part of longer-term actions currently in progress".
The CQC does not currently have the legal power to compel trusts to share the reports or make the trust implement recommendations.
Prof Ted Baker, the CQC's chief inspector of hospitals, said: "Both hospital trusts and the professional bodies undertaking invited reviews have a responsibility to ensure that any serious patient safety issues raised in an invited review are shared with CQC.
"It is extremely disappointing that despite this very clear expectation, we continue to see examples of a lack of transparency."
Dr Kirkup said a legal duty may have to be placed on trusts compelling them to disclose royal college reviews.
NHS England and NHS Improvement said there are "robust and transparent systems to ensure hospitals and other care providers learn and improve services".
It said "all independent reviews should be made available" to health commissioners and regulators and it "expects trusts to take prompt action to address recommendations made".
Out of 111 reports the BBC was made aware of, 100 came from NHS trusts in England.
The NHS in Wales, Northern Ireland and Scotland all emphasised the usefulness of the Royal College review system and stressed the importance of openness and transparency in healthcare.
BBC News asked the Department of Health whether they would consider a change in the law to enforce publication and sharing with regulators but they declined to comment.
You can watch Panorama: Hospital Secrets Uncovered on BBC One at 19:30 BST or afterwards on BBC iPlayer.