The original Telegraph article headline was "Hospital records of all NHS patients sold to insurers" (aside from the flatly false headline, the actual content of the article is pretty accurate). The IFoA that actually bought the data and did the research pointed out that they were not an insurer, nor providing any recommendations to insurers beyond the now-publicly-available macro data I linked to. In other words, no private firms - in the insurance industry or otherwise - legally have access to any medical records as a result of this sale, other than the macro research document I linked to, which you might want to read for yourself if you're concerned about what's getting into the public domain.

The link you've just posted has the NHS-linked body in question admitting "greater scrutiny should have been applied" in this instance, but actually reasserts all the points made by IFoA: they're not an insurer, it's a general study on frequencies of illnesses amongst certain demographics and there's no personally-identifiable data accessible to insurers as a result of this. The HSCIC making a hand-wavy non-apology != the NHS confirming that this is an example of a private firm they sold your medical records to