Australian Competition and Consumer Commission v Bupa HI Pty Ltd

This was an ACCC enforcement case about how Bupa handled customer entitlements under private health insurance policies. The commercial issue was not whether every treatment in a hospital admission had to be covered. It was that some admissions and claims involved a mix of covered treatment and excluded treatment, and some claims included at least one Medicare Benefits Schedule item number that did not map to a standard clinical category in Bupa’s claims assessment system.

Under the policies in force during the relevant period, members were still entitled to benefits for the covered treatment. The admitted problem was that Bupa repeatedly represented that members were not entitled to any benefits at all in those situations. According to the Court’s declarations, that happened on at least 7,589 occasions between May 2018 and August 2023.

The case also involved a separate process failure that the Court treated as unconscionable conduct. Bupa had previously relied on a zero benefits report, typically generated weekly, to identify incorrectly automatically assessed hospital mixed coverage claims. Between June 2020 and February 2021, Bupa failed to generate and manually review that report. The Court recorded that Bupa did not have other processes in place to ensure those claims were identified and correctly paid in all cases, did not advise all potentially affected hospitals and members, and knew manual review was necessary and that improper assessment of certain such claims was a probable outcome.

The ACCC launched its investigation in November 2020. Bupa cooperated with that investigation. The matter then proceeded on agreed facts and admissions, so the Court was not resolving a factual contest after trial. Instead, it had to decide whether the agreed penalties and other orders were appropriate.

The judgment is easier to follow if you separate the conduct into the categories used in the Court’s declarations.

First, there were mixed coverage eligibility checks. These were enquiries made before treatment by or on behalf of a member about eligibility for benefits for a potential claim that would include both covered treatment and excluded treatment during a hospital admission.

Second, there were medical mixed coverage claims. These were claims for treatment provided by a medical provider working in the hospital, such as a surgeon or anaesthetist, where the claim included both covered treatment and excluded treatment.

Third, there were hospital mixed coverage claims. These were claims for services provided by the hospital itself, where the claim included both covered treatment and excluded treatment.

Fourth, there were medical uncategorised item claims. These were claims by a medical provider that included at least one treatment with a Medicare Benefits Schedule item number that did not map to a standard clinical category in Bupa’s claims assessment system.

Fifth, there were hospital uncategorised item claims. These were hospital claims that included at least one treatment with an item number that did not map to a standard clinical category in Bupa’s system.

Across all of those categories, the admitted representation was materially the same: that the member was not entitled to payment of benefits towards any part of the treatment, when in fact the member was eligible for benefits for the covered treatment.

The Court also recorded the different ways those representations were made. They occurred through customer-facing advice during eligibility checks, through Bupa’s automatic claims assessment system incorrectly rejecting or assessing claims as having zero benefits payable, through some incorrect manual assessments of held claims, and through some later advice to members or their delegates after a claim had already been rejected.

Because Bupa admitted the conduct, the Court was not deciding whether the events happened. The main task was to decide whether it was appropriate to make the consent orders sought by the ACCC and Bupa, including declarations, penalties totalling $35 million, an injunction, a compliance program, costs and confidentiality orders.

The admitted contraventions were framed under three Australian Consumer Law provisions. The first was section 18, which deals with misleading or deceptive conduct. The second was section 29(1)(m), which deals with false or misleading representations concerning the existence, exclusion or effect of a condition, warranty, guarantee, right or remedy. The third was section 21, which deals with unconscionable conduct.

The unconscionable conduct issue was narrower than the misleading representation issues. It focused on the period from June 2020 to February 2021 and on Bupa’s failure to generate and manually review the zero benefits report, together with the incorrect automatic assessment of at least 388 hospital mixed coverage claims in the circumstances described in the declaration.

The Court also had to apply the principles relevant to agreed penalties. Justice O’Callaghan said the Court does not simply act as a rubber stamp, but should recognise that an agreed penalty usually reflects compromise, pragmatism and the regulator’s assessment of deterrence and litigation risk. After considering the agreed facts, written submissions and oral argument, the Court concluded that the proposed orders were appropriate.

Justice O’Callaghan approved the agreed outcome. The Court declared that, during the period from May 2018 to August 2023, Bupa had on at least 7,589 occasions represented that members were not entitled to payment of benefits towards any part of treatment in the five categories identified in the orders, when in fact the member was eligible for benefits for the covered treatment. On each occasion, Bupa engaged in misleading or deceptive conduct contrary to section 18 of the ACL and made a false or misleading representation contrary to section 29(1)(m).

The Court also declared that, during the period from June 2020 to February 2021, Bupa engaged in unconscionable conduct on at least 388 occasions in connection with incorrectly automatically assessed hospital mixed coverage claims. The conduct comprised failing to generate and manually review the zero benefits report and incorrectly automatically assessing those claims in the circumstances described in the declaration.

The Court ordered Bupa to pay total pecuniary penalties of $35 million. The penalty was broken into components: $7 million for the mixed coverage eligibility check representations, $5 million for medical mixed coverage claim representations, $5 million for hospital mixed coverage claim representations, $3 million for medical uncategorised item claim representations, $3 million for hospital uncategorised item claim representations, and $12 million for the unconscionable conduct.

The Court also granted a five-year injunction restraining Bupa from representing that members are not entitled to payment of benefits towards any part of a mixed coverage eligibility check, mixed coverage claim or uncategorised item claim when the member is in fact eligible for benefits for covered treatment. In addition, the Court ordered Bupa to review, update and maintain an ACL compliance program for three years, ordered Bupa to pay $250,000 towards the ACCC’s costs, and made a confidentiality order for one exhibit.

The judgment gives a clear picture of the factors that drove the seriousness assessment. First was scale and duration. The Court referred to at least 7,589 false or misleading representations over about five years and 388 occasions of unconscionable conduct over an eight-month period.

Second, the Court noted that the conduct was allowed to continue even after Bupa’s senior managers became aware that system changes were necessary to avoid incorrectly rejecting claims. That matters because it moves the case beyond a one-off mistake or isolated frontline error.

Third, the Court placed weight on the fact that Bupa chose to discontinue the zero benefits report, which had previously been put in place to mitigate aspects of the contravening conduct. Removing a known safeguard without an effective replacement was a major feature of the unconscionable conduct finding.

Fourth, the Court emphasised the risk of harm to members. The judgment says the conduct exposed members to the risk of wide-ranging harm, including serious harm to health and wellbeing and significant financial harm resulting from denial of benefits to which they were entitled. The Court also recorded that in many cases that risk in fact eventuated.

Fifth, the Court noted that Bupa benefited from the conduct. The judgment identifies retained unpaid benefits, increased premiums from members who upgraded cover after being incorrectly told they were not entitled to receive any benefits, and delayed or deferred costs of system upgrades and training.

The Court also took into account factors in Bupa’s favour. These included remediation of customers in the amount of $14.3 million as at 5 November 2025, an undertaking to complete its existing and ongoing remediation program, cooperation with the ACCC investigation and the proceeding, the absence of relevant prior contraventions, and approximately $5.6 million invested to rectify systems and processes since the conduct was identified. Those matters did not remove the seriousness of the conduct, but they were relevant to the overall penalty assessment.

Although this case arose in private health insurance, the practical reading is much broader. Many businesses sell products or services that involve partial entitlements. A customer may be entitled to some parts of a package but not others. A warranty may cover parts but not labour. A subscription may include some features but not premium add-ons. A refund policy may allow one form of remedy but not another. A service bundle may include standard work but exclude extras. In all of those settings, there is legal risk if staff or systems collapse a mixed answer into a blanket no.

The case is also a warning about exception handling. Standard transactions are often not where the real risk sits. Problems usually emerge in edge cases: mixed claims, bundled services, unusual item codes, products that do not map neatly to a system category, or customer scenarios that require manual judgment. If your process depends on an exception report, a manual review queue or a specialist escalation path, that control should be treated as part of your compliance framework, not just an operational convenience.

Another important point is that customer communications and system outputs should match the underlying legal or contractual position. If the customer is entitled to something, your scripts, templates and automated messages should not say they are entitled to nothing. If the answer is uncertain, the safer path is usually to escalate for review rather than issue a definitive denial.

The judgment also shows that management decisions about controls can become central in litigation. The Court paid close attention to what Bupa knew, what safeguards existed, whether replacement processes were in place, and whether affected customers and hospitals were told about the issue. That is a reminder for directors and senior managers to document how exception controls work and what happens if they are changed or removed.

This case is a reminder that courts look at the whole operating picture, not just one document. The admitted conduct involved policy terms, pre-treatment enquiries, automated assessment logic, manual review practices, later customer communications and internal control settings. In other words, the legal problem sat across documents, systems and conduct.

For businesses, that means compliance cannot be left only to legal drafting. Clear terms and conditions matter, but they are not enough if customer-facing teams, software rules or claims processes apply those terms incorrectly. A well-drafted contract can still be undermined by a script, a template email, a system rule or a missing exception report.

It also means complaint patterns matter. If customers repeatedly challenge a denial and later turn out to have had at least a partial entitlement, that may indicate a deeper issue in system logic, staff training or escalation design. The Court-ordered compliance program in this case reflects that broader view of compliance.

The Court ordered Bupa to review its existing ACL compliance program, update it in line with Annexure A and maintain it for three years. The annexure is detailed, but the main practical elements can be stated simply.

Bupa must appoint a director or senior manager with suitable compliance qualifications or experience to be responsible for ensuring the program is effectively designed, implemented and maintained. It must also appoint an external compliance professional with expertise in consumer law. That external adviser must conduct a consumer law risk assessment and provide a written report identifying risk areas, likelihood, gaps in existing procedures and recommended actions.

Bupa must issue an updated compliance policy confirming its continued commitment to ACL compliance, explaining how that commitment is put into effect, requiring staff to report compliance concerns, protecting whistleblowers and making clear that internal action may be taken against people knowingly involved in contraventions. It must review and, where necessary, enhance its complaints handling procedures and whistleblower protection mechanisms.

The program must include ACL compliance training at least once a year for relevant officers, employees, representatives and agents, as well as executive and non-executive directors. ACL awareness must also form part of induction for relevant new starters and directors. The compliance officer must report every four months to Bupa’s Health Insurance Risk Committee on the continuing effectiveness of the program.

There must also be an annual independent review for three years. The review must be broad enough to verify that the required elements are in place and to produce a compliance report. That report must address whether the program includes the required elements, whether it adequately covers the risk assessment areas, whether training and induction are effective, whether the complaints handling system is effective, whether whistleblower protections are in place and understood, and whether there are any material deficiencies or material non-compliance. If a material failure is identified, Bupa must provide a work plan to its committee and promptly implement recommendations to address it.

Bupa must also provide compliance reports to the ACCC, keep compliance program documents for at least five years, and provide copies to the ACCC if requested during that period. The annexure also allows the ACCC to make recommendations it considers reasonably necessary to ensure the program continues to be maintained and implemented in accordance with the compliance program requirements.

For a smaller business, the lesson is not that you need a large corporate committee structure. The lesson is that regulators expect ownership, risk assessment, training, complaint visibility, independent checking and follow-through when a control fails.

Does a system-generated outcome count as a representation? In this case, yes. The Court’s declarations and the agreed facts covered incorrect automatic claim assessments that rejected or assessed claims as having zero benefits payable.

Is this only about complete denials of payment? The core issue here was a complete denial where there was actually a partial entitlement. That is what made the representations false or misleading in the circumstances described by the Court.

Can a manual review process solve the problem? Only if it works. The judgment records that some held claims were still incorrectly rejected or assessed, and the unconscionable conduct finding focused on the failure to generate and manually review a report that had been used to catch incorrect automatic outcomes.

What should management focus on? Controls, escalation, complaint visibility, training and what happens when a known safeguard is changed or removed. The Court treated those management-level issues as central to the seriousness of the conduct.

The ACCC filed the proceeding on 30 June 2025. The hearing took place on 7 November 2025. Judgment and orders were delivered on 11 December 2025. The Court’s orders required Bupa to pay the penalties within 30 days of the order date, imposed a five-year injunction from the date of the order and required the compliance program to be maintained for three years from the date of the order.

The judgment records that the ACCC had launched its investigation in November 2020. It also records that Bupa had remediated customers in the amount of $14.3 million as at 5 November 2025 and had invested approximately $5.6 million as at that date to rectify systems and processes since the conduct was identified.

This explainer is based on the Federal Court judgment in Australian Competition and Consumer Commission v Bupa HI Pty Ltd [2025] FCA 1564. The judgment records the orders made by consent, the admitted contraventions, the Court’s reasons for approving the agreed penalties and the terms of the compliance program annexed to the orders.

This page is general information only and not legal advice. If your business uses automated decisions, partial entitlement rules or exception handling in customer-facing processes, legal advice should be tailored to your contracts, systems and complaint history.