Bidders furious after data breach bungle blows up $50 million hospital tender

For five months, one global medical device company had an open window into its rivals’ confidential pricing, in one of the largest bidding processes run by Victoria’s health system every few years. Nobody noticed.

Not the agency tasked with guarding the data. And not seven other multinational device makers competing for a lucrative contract to supply public hospital operating theatres with hip, knee, shoulder, elbow, and wrist implants.

The unnamed firm in the $50 million bid, referred to simply as the “disclosee” in government correspondence to furious competitors, accessed the confidential pricing file on multiple occasions.

It was only in August, after a supplier raised the alarm, that HealthShare Victoria discovered the leak had occurred back in February.

The agency – whose primary job is to run competitive tenders on behalf of Victorian taxpayers – has now terminated the orthopaedic implants tender process.

Confidential government documents reveal the breach stemmed from “human error” that allowed one bidder to open pricing spreadsheets submitted by its rivals.

“We acknowledge the concern [the error] has caused,” said a HealthShare spokeswoman. She would not say how much the botched process had cost the government or bidders to abandon the tender.

Eight multinational firms were bidding for the contract: DePuy, Stryker, Zimmer, Smith & Nephew, Corin, Medacta, Enovis and Amplitude.

All had worked on the bid for several months when probity consultants concluded the company with access to its rivals’ pricing information “may have obtained a competitive advantage”.

Leaked documents show HealthShare required statutory declarations from two individuals who accessed the pricing file, confirming all copies had been deleted and not shared outside the organisation.

The agency said it could not impose contractual or legal penalties on the recipient company – because the breach was HealthShare’s fault.

Another leaked Q&A document shows HealthShare telling bidders the company that obtained competitors’ pricing information could still compete for the contract because the agency had made the mistake.

Bidders will not be compensated for their preparation costs, with HealthShare confirming it expected them to absorb those costs.

One supplier employee, not authorised to talk publicly, said the leak of sensitive commercial spreadsheets had left the multinational device makers furious.

Companies compete fiercely for public health tenders, worth tens of millions of dollars. HealthShare manages supply chains for Victorian public health services and hospitals, aggregating $1.4 billion in annual spending. Implantable devices like those in the abandoned tender account for around $120 million in total contracts across Victorian public hospitals.

The damage may not stop at the state border. Device pricing remains a closely guarded secret in Australia’s tight-knit orthopaedic industry, which the Medical Technology Association of Australia says is worth around $5 billion a year. The association declined to comment on the breach, which involved its members.

HealthShare’s primary purpose under the Health Services Act is to ensure probity and secure value for money for taxpayers.

Rosemary Listing, a medical negligence lawyer with Peter Evans & Associates Solicitors who holds a PhD in product liability, said losing confidentiality destroys the state’s bargaining power for a long period.

“Governments are dealing with some of the largest and most powerful companies in the world when they buy medical devices. These companies have far greater resources and far more information about the market than the public agencies buying from them,” Listing said.

Confidential tendering was one of the few tools to level the playing field for the public good, she said – warning that a bidder who sees rival pricing has no pressure to offer its lowest price, which ultimately drains funds from patient care.

“Competitive tendering is the main way governments protect public money when buying from large companies,” she said. “That protection depends entirely on confidentiality.”

Listing warned that once that secrecy was lost, competitive tension disappeared and could not be restored simply by running the tender again.

The tender failure comes amid broader questions about HealthShare’s procurement performance. A Victorian Auditor-General report released in June 2025 warned the authority could not show its collective agreements, like those being tendered for these prostheses, were delivering measurable cost savings.

The watchdog found HealthShare routinely failed to track whether projected savings were realised after contracts were signed, while almost a quarter of its procurement agreements actually resulted in cost increases.

State Opposition health spokeswoman Georgie Crozier said the abandoned tender showed a “fresh start” was needed at November’s Victorian election. “This botched tender was worth tens of millions of dollars, and is further evidence Labor cannot get the basics right,” Crozier said.

Health Minister Ingrid Stitt confirmed the tender had been abandoned and was now being redone to “support a fair and competitive outcome”.

“The breach of commercial confidentiality in this tender is unacceptable,” her spokeswoman said.

The failed tender will increase pressure on the Carroll government, already facing sustained questioning over unstaffed hospitals and waiting lists, in the final weeks before the election.

For patients, the stakes are real. John Cunningham, an orthopaedic surgeon who operates in Melbourne hospitals, said a tender like this decides which prostheses sit on a hospital’s catalogue, “and therefore which implant a surgeon can offer a particular patient”.

Welcoming the re-tender, he said it should start with the data. “The first requirement of the re-tender should be that every device is screened against National Joint Replacement Registry revision rates before price is considered at all: we have world-leading data on which implants fail and when, and setting it aside to save a few dollars a case means the patient wears the second operation.”

There is no immediate risk to supply as the existing prostheses contract remains active until July 2027.

Start the day with a summary of the day’s most important and interesting stories, analysis and insights. Sign up for our Morning Edition newsletter.