A US private equity firm will take control of NHS patient records in a deal experts say should “ring alarm bells” amid concerns sensitive health data is increasingly being handed to private companies.

The investment firm TPG has bought Optum UK, the healthcare technology business behind the electronic patient record system used by most GP practices in England, in a deal worth about $400m (£300m).

Doctors, campaigners, MPs and human rights groups say the transfer of a company handling millions of NHS patient records to a US private equity firm has taken place with little public scrutiny.

A spokesperson for the campaign group Doctors’ Association UK (DAUK) said: “Private equity now owns the plumbing of English general practice. The GP records of more than half the country sit on a system controlled by a firm whose business model is returns for investors, not care for patients, and the public found out after the fact.”

It added: “We have been here before with Palantir. The difference is that this time the buyer is a private equity giant whose overseas hospitals stand accused of pushing patients into debt … We want the government to set out what safeguards exist, what happens to the data if TPG later sells the asset, and why none of this was put to parliament.”

Helen Morgan, the Liberal Democrats’ health spokesperson, said such deals were “being rubber-stamped without any scrutiny or protections for patients”, adding: “Time and time again, patients are seeing the government hand over sensitive NHS data to US tech firms, leaving our public services dangerously exposed.”

The MP called for the government to listen and “start backing British tech instead”.

Concerns have also been raised about TPG’s track record after hospitals linked to the firm in Africa were accused of pushing patients entitled to free care into poverty through excessive medical bills.

Earlier this year, an investigation by the International Consortium of Investigative Journalists (ICIJ) examined hospitals in Kenya owned by Evercare, a healthcare group backed by TPG’s Rise Fund.

The investigation reported allegations that some patients were left with crippling debts and in some cases were required to provide land deeds as collateral for unpaid medical bills. A spokesperson for TPG said it strongly disagreed “with the facts and characterisation of the allegations in the ICIJ’s report”.

They added: “We’ve made more than $100m of investments across Evercare over six years, which have led to substantial gains in quality, accessibility, and accreditations, as well as patient rights and protections. Any suggestion that TPG or Evercare prioritises profits over patients is incorrect and ignores the extensive clinical governance and patient’s rights policies we’ve instituted.”

The former Oxfam health policy lead Anna Marriott said the deal should “ring major alarm bells”. She said: “It is deeply concerning that a private equity firm with a highly controversial track record in healthcare internationally can take control of sensitive NHS patient data with so little public scrutiny.

“NHS patients have no say over who holds their medical records, which makes it the government’s job to guarantee their safety. This deal should ring major alarm bells. Private equity’s penetration of our health service is fast outrunning the regulatory guardrails needed to protect patients, workers and the public interest.”

TPG acquired Optum UK from the New York-listed healthcare corporation UnitedHealth Group. The business includes EMIS, whose software is used by more than half of GP practices in England, making it one of the NHS’s most significant providers of primary care technology and giving it responsibility for managing the electronic health records of millions of patients.

A spokesperson for EMIS said: “We have a longstanding commitment to the NHS and the wider UK healthcare system. Data security and patient privacy have always been at the core of our operations, supported by rigorous controls, strict access requirements, and compliance with all applicable regulatory and contractual obligations.

“The acquisition was reviewed and approved by the UK government through the applicable channels in accordance with the National Security and Investment Act 2021. Any suggestion that this acquisition changes patient data protections disregards nearly three decades of upholding only the strictest compliance standards – a commitment TPG shares and has a demonstrated record of reinforcing through investment in the systems that further strengthen those safeguards.”

A spokesperson for TPG said: “Assertions that TPG could in any way access, control, maintain, or utilise NHS patient records are entirely false. A change in ownership of the company has in no way changed how patient data is stored, protected, or governed, nor has it altered the legal, regulatory, contractual, and operational safeguards that apply. TPG is committed to upholding and reinforcing EMIS’ independent standards of data protection, patient privacy, and service to the NHS.”

The Department of Health and Social Care did not provide a comment.