E-Procurement for Hospitals and the Public Sector

Forty departments place orders through twelve channels, each specialized department has its own budget, and the administration is asking whether a procurement platform is even permissible under public procurement law. The knot unravels as soon as two questions are answered separately: What legal framework applies to your organization, and how do you map out approvals by department without slowing down operations? This article answers both.

For hospitals and public institutions, e-procurement systems are suitable if they do three things: map approvals separately for each department, adopt existing framework agreements as-is, and provide a data processing agreement in accordance with the GDPR. Whether public procurement law applies is determined by your governing body—not the system.

Key points at a glance:

• Whether you’re a public contracting authority depends on your organization’s governing body and determines the entire procurement process.
• A procurement platform does not replace the procurement process—it digitally maps framework agreements that have already been awarded.
• Indirect procurement does not involve patient data. The aspects relevant to the GDPR are employee data and the data processing agreement.
• Approvals on a per-department basis only work if the budget, product range, and approval level can be controlled separately.
• With a hundred ordering wards, the licensing model has a greater impact on cost-effectiveness than the item price.

A hospital’s central purchasing department faces a dilemma: it is expected to manage the process without delaying patient care. If the ward is held up every time it orders a pack of disposable gloves, it will find a workaround—and the problem will simply shift rather than disappear. We have been developing procurement processes for indirect needs for 26 years and will outline below the questions you should clarify before selecting a provider and the reasons why projects in this area typically fail.

First question: Are you even a public contracting authority?

This question determines everything that follows—and is surprisingly often overlooked. Hospitals are not automatically public contracting authorities; private operators are generally not subject to public procurement law.

Tip: Clarify the issue of the contracting authority in writing with your legal department before entering into discussions with vendors. The answer determines whether you can contract a platform directly or must go through a procurement process – and thus the timeline for your entire project.

This classification is not a substitute for a legal review. However, it helps you ask the right question before half a year of project time has passed.

A platform does not award contracts – it merely maps out what has already been awarded

The most common objection in public institutions is: If we order through a platform, aren’t we circumventing procurement law? The answer depends on how the platform operates.

On an open marketplace, you buy from different vendors at varying prices. This poses challenges under procurement law because each purchase constitutes a separate contract award. The situation is different if the platform digitally replicates your existing framework agreements: You’ve issued a request for proposals, you’ve awarded the contract, you’ve negotiated terms—the platform turns this into a digital catalog featuring exactly these suppliers and exactly these prices.

Definition: A framework agreement in procurement specifies the supplier, product range, and terms for a defined period. An individual order is then a call-off from this agreement and does not constitute a new contract award.

This is exactly what simple system is designed for. We do not act as a retailer, do not engage in proprietary trading, and do not favor any product range through rankings. Your regular suppliers remain your regular suppliers, with the terms you have agreed upon. In addition, over 1,000 suppliers are listed in simple system’s supplier directory should you need to cover requirements for which you do not have an existing contract.

For procurements below the thresholds, simplified rules apply, such as those under the Sub-Threshold Procurement Regulation. The extent to which direct awards are permitted in your organization is governed differently by the federal government, the state, and your own procurement guidelines—this, too, is a question for your procurement office, not the software provider.

Approvals by Department: Manage Separately, Don’t Hinder Separately

A hospital does not have a single purchasing organization; it has forty. Every ward, every specialty department, and every institute orders different items, has different budgets, and requires different approval processes.

Definition: In the public sector, a department is an organizationally distinct unit with its own authority and budget—in hospitals, this typically corresponds to a ward, a specialty department, or an institute.

For this to work, three things must be adjustable independently of one another. If they are lumped together, the result is either chaos or gridlock.

The mistake we see most often: Everything is governed by a single approval threshold. Then the ward has to wait three days for bandages because the same rule applies as it does for a capital investment. If you clearly separate the product range from the budget, you can set the approval threshold significantly higher—control then lies in the catalog, not in the holding pattern.

We’ll cover how such approval workflows can be implemented in purchasing in a separate section.

GDPR in Indirect Procurement: What It’s Really About

This is where the biggest misconception lies in the hospital setting. Indirect procurement does not process patient data—ordering disposable gloves, office supplies, or replacement parts does not generate health data as defined by Article 9 of the GDPR.

Instead, two other points are relevant. First, every procurement platform processes employee data: who placed the order, who approved it, and under which cost center. This is personal data and requires a data processing agreement under Article 28 of the GDPR. Second, it must be clarified where this data is processed and which subcontractors are involved.

Tip: Request the data processing agreement, the list of subcontractors, and details regarding the processing location from the provider—in writing, not as a verbal statement. These three documents are decisive for the data protection review.

From a technical standpoint, access control is key. With Single Sign-On via SAML 2.0, the login process is handled entirely through your identity provider, including multi-factor authentication. simple system does not store passwords for SSO users. If an account is deactivated in the directory service, access is immediately blocked—a practical consideration given staff turnover in hospitals. All login attempts are logged and can be exported. We describe in detail which evidence is actually required during an audit in our article on e-procurement and audit requirements in regulated industries.

The licensing model determines cost-effectiveness

In facilities with many ordering departments, the cost isn’t driven by the item price but by user costs.

A hospital with 40 wards and several administrative departments can quickly have 150 to 300 people who need to be able to place orders. With a per-user pricing model, this results in a cost that eats up any savings in process costs—with the consequence that ordering rights are artificially restricted and bulk ordering by verbal request makes a comeback.

With simple system, there are no limits on users, orders, or your own suppliers. The Basic package starts at 99 euros per month and provides access to the platform; details can be found in the Overview of Packages and Prices. For an organization with many departments, this is the difference between a true rollout and a siloed solution for centralized procurement.

Checklist: Requirements for Hospitals and Public Institutions

• The governing body and the applicability of public procurement law have been clarified in writing.
• Existing framework agreements can be mapped as-is with negotiated terms.
• The provider does not engage in proprietary trading and does not give preference to its own product range.
• Product range, budget, and approval levels can be configured separately for each department.
• Cost centers are automatically included when placing an order.
• The data processing agreement, list of subcontractors, and processing location are available as documents.
• Login is handled through the organization’s own identity provider; deactivation results in immediate suspension.
• The pricing model does not charge per user.
• Order history and logs are retained even after personnel changes.

Fewer than seven checkboxes: The project will get stuck in the internal review process, not because of the feature set.

Conclusion: Clarify the framework first, then the software

In hospitals and public institutions, procurement projects rarely fail because of the software. They fail because the governing body, procurement framework, and approval structure are clarified during the project rather than beforehand. If you have these three points in writing beforehand, you can implement a platform in weeks instead of quarters.

→ 15-minute consultation: Map out your framework and approval structure

You describe the governing body, departments, and existing framework agreements; we’ll tell you frankly what can and cannot be accommodated.

FAQ – Frequently Asked Questions About Procurement in Hospitals and Public Institutions