Pharmacies share medical data with police without a warrant, inquiry finds