Health secretary Jeremy Hunt was told more than 500,000 missing confidential NHS correspondence a year ago but kept the information secret on official advice.

Hunt faced urgent questions in the Commons after a report in The Guardian that  709,000 letters sent between GPs and hospitals in the five years to 2016 never arrived at their destination. About 500,000 contained confidential clinical data.

Instead, NHS Shared Businesses Services, the company charged with transporting the letters, stored the information in a warehouse, in some case for years.

The missing correspondents could affect thousands of patients, with prescriptions, blood test results, screening data, biopsies and other key medical information not being seen by its intended recipient.

Speaking in the Commons on Tuesday, Labour shadow health secretary, Jon Ashworth, called the missing data a “shambles that has put patient safety at risk” that the Government had then tried to “cover-up”.

“It is an absolute scandal.”

Replying to the urgent questions, Hunt conceded the company had been “totally incompetent” in its handling of the correspondence.

“I think it is completely extraordinary that for such a long period of time that such a huge amount of data went gone missing,” he said.

But Hunt said no confidential data had been lost and all had now been provided to the relevant GPs.

“The data was not lost, it was kept in a secure site….what did happen was it wasn’t past onto the right GP surgeries.”

NHS England has launched an inquiry into the missing data, which has already identified 2,500 cases where further investigation is required to determine whether patients were harmed.

Hunt said 2000 of these cases had been examined so far and no evidence of patient harm had been uncovered.

The data has now been returned to GPs involved, who are spending hours assessing whether the missing information had harmed any of their patients.

“I’m sure it had created extra work for GPs but, so far, in the vast majority of cases patient harm was avoided.”

However, this was at odds with reports of a Department of Health update to MPs on the public accounts committee, which indicated 173 instances of likely patient harm had been identified.

Hunt also confirmed that he was made aware on the misplaced correspondence in March, 2016. However, he did not make the mistake public until June last year on official advice. The full extent of missing data was not revealed until today.

“Going public at a very early stage risk overwhelming GPs.”

NHS Shared Business Services is co-owned by the Department of Health and the French company Sopra Steria. Its main business is managing supplier contracts on the behalf of the NHS.

The scale of the missing files in unprecedented and was criticised by opposition parties and the BMA, which expressed concern about the potential harm to patients.