Spire Healthcare began investigating the work of Dr Ian Paterson at two private West Midlands hospitals in 2007.
Mr Paterson was suspended by the General Medical Council (GMC) in 2012.
Spire Healthcare has apologised "unreservedly" to all patients.
A number of key events and missed opportunities occurred at Spire Parkway in Solihull and Spire Little Aston in Sutton Coldfield leading to a failure to take action against Mr Paterson, the independent review concluded.
Mr Paterson, who was employed there from 1993 to 2012, "continually breached" Spire's practising privileges policy which, it is claimed, should have been a warning that he was unwilling to comply with procedures.
The private healthcare organisation was alerted by Heart of England NHS Foundation Trust (HEFT) to issues surrounding his work in 2007.
But the review said there was poor communication between the trust and Spire about HEFT's investigation into Mr Paterson.
A total of 15 recommendations for improving procedures were made in the report and all will be implemented, Spire said.
The case was referred to West Midlands Police following Mr Paterson's suspension by the GMC in 2012.
He carried out "cleavage sparing" mastectomies while at the two private hospitals and Solihull Hospital.
The GMC said the procedure, which left a small amount of tissue for cosmetic reasons, breached national guidelines because it risked the return of cancer.
More than 700 patients, who had been treated by the surgeon and subsequently recalled by Spire, were contacted as part of its review.
Mr Paterson was invited to take part but declined to do so, Spire said.
Rob Roger, chief executive of Spire Healthcare, said the report made "challenging reading".
"We give a full and unreserved apology to all of the patients and their families for any distress they have suffered as a result of their treatment by Mr Paterson while he was a surgeon at the Spire Parkway and Little Aston hospitals," he said.
"I would also like to apologise to the professionals who raised concerns at the time Mr Paterson was practising."
In December, an independent review of his work at Solihull found hundreds of breast cancer patients were failed by the trust.
The report said senior managers at the trust did not respond effectively until 2007 and their response was neither sufficiently robust nor rigorous.
In November, a solicitor representing some patients said the NHS has so far paid out Â£3,220,315 in damages, out of 503 claims.
Kashmir Uppal, from Birmingham law firm Thompsons which is representing 400 women, said the firm had settled 10 claims so far.
Frances Perks, had nine operations carried out at Spire by Mr Paterson between 1994 and 2009, including a mastectomy.
"I was [later] told that I didn't need the mastectomy or the reconstruction - there was nothing there at all, all the operations were unnecessary.
"It was very hard to accept it, to get your head around," she said.
A spokeswoman for the Medical Defence Union said Mr Paterson did not want to comment on the Spire report because of his duty of confidentiality and the ongoing investigations.
Two hospitals missed opportunities to take action against a consultant breast surgeon who was performing unnecessary or incomplete operations, a review has found.