Government faces legal action over £23m deal involving patient data