Henry Schein 2013 Annual Report Download - page 50

41
Regulated Software; Electronic Health Records
The FDA has become increasingly active in addressing the regulation of computer software intended for use in
health care settings, and has been developing policies on regulating clinical decision support tools and other types
of software as medical devices. Certain of our businesses involve the development and sale of software and related
products to support physician and dental practice management, and it is possible that the FDA could determine that
one or more of our products is a medical device, which could subject us or one or more of our businesses to
substantial additional requirements with respect to these products.
Certain of our businesses involve access to personal health, medical, financial and other information of
individuals, and are accordingly directly or indirectly subject to numerous federal, state, local and foreign laws and
regulations that protect the privacy and security of such information, such as the privacy and security provisions of
the federal Health Insurance Portability and Accountability Act of 1996, as amended, and implementing regulations
(“HIPAA”). HIPAA requires, among other things, the implementation of various recordkeeping, operational,
notice and other practices intended to safeguard that information, limit its use to allowed purposes, and notify
individuals in the event of privacy and security breaches. Failure to comply with these laws and regulations can
result in substantial penalties and other liabilities. As a result of the federal Health Information Technology for
Economic and Clinical Health Act (“HITECH Act”), which was enacted in 2009, some of our businesses that were
previously only indirectly affected by federal HIPAA privacy and security rules became directly subject to such
rules because such businesses serve as “business associates” of HIPAA covered entities, such as health care
providers. On January 17, 2013, the Office for Civil Rights of the Department of Health and Human Services
released a final rule implementing the HITECH Act and making certain other changes to HIPAA privacy and
security requirements. Compliance with the rule was required by September 23, 2013, and increases the
requirements applicable to some of our businesses.
In addition, federal initiatives, including in particular the HITECH Act, are providing a program of incentive
payments available to certain health care providers involving the adoption and use of certain electronic health care
records systems and processes. The HITECH initiative includes providing, among others, physicians and dentists,
with financial incentives if they meaningfully use certified electronic health record technology (“EHR”). Also,
eligible providers that fail to adopt certified EHR systems may be subject to Medicare reimbursement reductions
beginning in 2015. Qualification for the incentive payments requires the use of EHRs that are certified as having
certain capabilities for meaningful use pursuant to standards adopted by the Department of Health and Human
Services. Initial (“stage one”) standards addressed criteria for periods beginning in 2011. CMS has also issued a
final rule with more demanding “stage two” criteria for periods beginning in 2014 for eligible health professionals
(including physicians and dentists), and has indicated that it will delay rulemaking on more rigorous “stage three”
criteria until 2014, and has stated that it will delay implementation of stage three measures until 2017. Certain of
our businesses involve the manufacture and sale of certified EHR systems and other products linked to incentive
programs, and so must maintain compliance with these evolving governmental criteria.
Also, HIPAA requires certain health care providers, such as physicians, to use certain transaction and code set
rules for specified electronic transactions, such as transactions involving claims submissions. Commencing July 1,
2012, CMS required that electronic claim submissions and related electronic transactions be conducted under a new
HIPAA transaction standard, called Version 5010. CMS has required this upgrade in connection with another new
requirement applicable to the industry, the implementation of new diagnostic code sets to be used in claims
submission. The new diagnostic code sets are called the ICD-10-CM. They were originally to be implemented on
October 1, 2013, but CMS recently issued a final rule that extended the implementation date until October 1, 2014.
Certain of our businesses provide electronic practice management products that must meet those requirements, and
while we believe that we are prepared to timely adopt the new standards, it is possible that the transition to these
new standards, particularly the transition to ICD-10-CM, may result in a degree of disruption and confusion, thus
potentially increasing the costs associated with supporting this product.
There may be additional legislative initiatives in the future impacting health care.