Data from GPs and hospitals are being stored on the database.
A new government body called the Health and Social Care Information Centre (HSCIC) will handle the sales via a database called care.data.
The data will go through a process called "pseudonymisation" aimed at making it anonymous, but the HSCIC says anonymity is not a cast iron certainty as drug and insurance companies may be able to match their own data against the government's data to identify patients.
Privacy safeguards are not clear.
The sale of NHS patient data is expected to start this summer.