The Radio 4 programme, broadcast today, reports that the methods used by private eyes on behalf of journalists go far beyond the phone hacking that has dominated the headlines.
Medical and criminal records, ex-directory phone numbers and itemised phone bills were all requested by newspapers, the report claims.
One anonymous private investigator, who was recorded for the programme, told BBC reporter Jon Manel that she had worked for most of the tabloids and had obtained medical records.
She said she would approach consultants' secretaries and "never pretended to be someone - just phone up and talk with confidence".
"It was a job. I did it. What can I say?" she said. "They came to me. I always thought that if I didn't do it, someone else would."
Private investigator Steve Whittamore, who was convicted in 2005 of illegally obtaining information from the police national computer, said journalists had asked him in the past to obtain medical information about celebrities, but he declined.
"That's one thing I would not do," said Whittamore, who was found to have helped 305 journalists employed by 32 newspapers and magazines obtain private information between 2001 and 2003.
The BBC spoke independently to three former tabloid journalists who said health information about actors, sports stars, musicians and politicians had been obtained by their employers.
The programme describes the evidence as "anecdotal" and says it is not clear how recently the practice has been going on - or whether it is still happening.
The Information Commissioner, Christopher Graham, has described the BBC's evidence as alarming and has called for tougher sanctions, including imprisonment, for anyone breaching the Data Protection Act without a strong public interest defence.
He told the programme: "I find it shocking as I think anybody would. One's medical details are about as personal as personal information gets.
"We have a Data Protection Act which is supposed to make sure that information acquired for official purposes stays private.
"The trouble is that if one can get the evidence together and take a prosecution the penalty in the magistrates' court is very modest - its a #5000 fine.
"This is a very profitable business for private investigators and others."
Press Complaints Commission director Stephen Abell said the body would "rightly be very concerned" if evidence of hacking into medical records came to light.
"Medical records are clearly stated in the [PCC] code to be out of bounds unless there's a public interest argument," he said.
Free daily newsletter
If you like our news and feature articles, you can sign up to receive our free daily (Mon-Fri) email newsletter (mobile friendly).
