The Information Commissioner says the government's refusal to publish the full risk assessment of the planned changes to the NHS is unjustified and departs from policy.
Christopher Graham accused ministers of changing government policy on freedom of information.
His report says use of the veto in any future case should be reserved for cases that are "truly exceptional".
It concludes that this was not the case with the NHS risk register.
Health secretary Andrew Lansley used a legal veto to block publication of the NHS "risk register", saying it was in the "public interest".
It is only the fourth time ministers have used their right to veto.
The decision "marks a significant step change" for freedom of information, the Information Commissioner said.
Labour MP John Healey, who first sought to get the register published with a Freedom of Information request in late 2010, said: "This is the third time the government's case for secrecy has been heard and dismissed.
"It's the third damning verdict on their desperate efforts to hide from the public the risks of their huge NHS upheaval."
Mr Lansley told MPs last week that publication was blocked because governments needed a "safe space" to develop policy.
If the register was made public it would be "open to misinterpretation and misuse", he said.
Freedom of Information legislation says the cabinet can only block requests in "exceptional cases". The veto was used to prevent disclosure of minutes from meetings in the run up to the Iraq war.
But in a report to Parliament, Mr Graham said: "None of the criteria for 'exceptional cases'... are met in the present case."
The report said the commissioner wished "to record his concern that the exercise of the veto in this case extends its use into other areas of the policy process".
"It represents a departure from the position adopted in the Statement of Policy and therefore marks a significant step in the government's approach to freedom of information."
A leaked 2010 draft of the "risk register" warned the cost of GP care could rise and ministers could lose financial control of the NHS under the reforms.
A Department of Health spokesperson said: "The circumstances were exceptional in this case. The request was made at a particularly sensitive time when the need for a - safe space - was especially high.
"The Freedom of Information Act was drafted specifically to allow for the Ministerial veto.
"The decision to veto is not just about the specific content of these risk registers but also about preserving risk registers as frank internal working tools, in the interests of good government."
The shadow health secretary, Andy Burnham, said the report was "severely embarrassing" and that "desperate efforts to keep the risks of his NHS re-organisation secret are not justified".
He added: "The Government's continued refusal to release the NHS risk register is simply indefensible. It is time for them to give in and admit defeat.
"They should publish the risk register today and let people have an informed debate about what is happening to the NHS."