At least 1,700 patients may have been harmed by an admin blunder that meant thousands of patient records in England were left to pile up in a warehouse.
The number at risk is likely to rise, as only two thirds of the 700,000 notes found had been checked, officials said.
Cancer test results and child protection notes were among the documents that were missing.
The National Audit Office said there were serious questions to answer about the handling of the incident.
Its review of the issue looked at the role of the government and the company responsible for the mix-up, which is part-owned by the Department of Health.
The company, NHS Shared Business Services (SBS), was employed in the East Midlands, South West and north-west London to redirect mail for the health service.
It was meant to pass on documents that had either been incorrectly addressed or needed re-routing because the patient had moved to a new GP surgery.
But between 2011 and 2016 a backlog of 709,000 pieces of correspondence piled up in a NHS SBS warehouse.