A privacy campaign says it is “shocking” the information can be obtained through NHS England’s website.