Serco, the leading private contractor of government services, fiddled its data when reporting to the NHS on targets it had failed to meet, according to the National Audit Office (NAO).

The independent watchdog's investigation into Serco's out-of-hours GP service in Cornwall, published on Thursday, comes after the Guardian revealed last May that whistleblowers had concerns that the privatised service was regularly so short-staffed as to be unsafe and that its performance data was being manipulated.

Following those reports, the chair of the parliamentary public accounts committee, Margaret Hodge, asked the NAO to investigate. It found that Serco had regularly had insufficient staff to fill all clinical shifts.

The NAO points out that a review by the NHS commissioner, the Cornwall primary care trust (PCT), found no evidence that the service was systematically unsafe, but concluded safety depended on the service being fully clinically staffed on a regular basis. The watchdog says clinical staffing levels have improved recently.

This picture appears to be contradicted, however, by documents leaked to the Guardian by whistleblowers this week. They show rotas with large numbers of shifts for doctors, nurses and call handlers unfilled throughout February and the first weekend in March. Staff have told the Guardian that shifts are still regularly unfilled. Serco denied this claim and said the information on rotas was inaccurate, and "selectively edited to deliberately misconstrue staffing provision".

Between January and June 2012, Serco staff falsified data 252 times, the NAO report says, based on Serco's own forensic audit of 107,000 patient calls over the period. Serco told the NAO the changes were "unacceptable" and unauthorised and were the work of two individuals in the Cornwall service who had now left. Staff are now banned from using a "dummy account" which enabled them to change raw data in the logs.

Hodge said it was shocking that Serco "did not have enough people on the job". She said: "I find it disgraceful that Serco staff fiddled the figures on an astonishing 252 occasions between January and June 2012. This tampering presented a false, much rosier picture of its poor performance.

"In one instance, Serco falsely claimed that 100% of emergency callers received a face-to-face appointment within 60 minutes when, in reality, it was only 75%, falling short of the performance standard."

The NAO report criticises the PCT's failure to monitor the company closely enough. It fell to whistleblowers to expose the failings through the media, despite a climate of fear in the Cornwall service, it says.

The PCT is now checking the Serco audit, which only covered the first six months of 2012, when the company had already been told it was under scrutiny. The trust said it would ensure all the NAO recommendations were built into its monitoring of the contract.

Staff have told the health regulator, the Care Quality Commission (CQC), that the data manipulation went back four years or more and was much worse before 2012.

Earlier audits by the CQC were severely critical of Serco for failing to meet minimum legal requirements in four areas. While three of these had improved at its most recent inspection in December, it was found to be still failing on staffing levels for call handlers.

Serco's Cornwall manager, Dr Louis Warren, said: "The NAO report has not only substantiated what the CQC has already shown – that the service is safe and well regarded by patients – but also confirms that we have taken decisive action. The only outstanding minor issue noted was that we need to increase the number of health advisers; our recruitment campaign will have this resolved by the end of March."

He said the company had addressed the culture among workers and strengthened whistleblowing policies. "The service is always staffed appropriately to meet demand," he added.

Andrew George, the Liberal Democrat MP for St Ives who blew the whistle on Serco to the CQC, called for the service to be reviewed by the new clinical commissioning group that will replace the PCT when it is abolished. "Failure to staff the service adequately and safely has happened even since Serco was criticised last year," he said.

The parliamentary committee will hold a hearing on the NAO's findings in April.

Serco announced this week that its pretax profits rose by 27% to £302m in the past 12 months.

Andrew Abbott, director of operations for NHS Kernow, said: "Serco has strongly refuted the claims made in relation to unfilled clinical shifts and there is no evidence from the data we receive that indicates otherwise. We will discuss this matter through our regular performance monitoring meeting with Serco, which is also attended by GP leads."