McKesson 2008 Annual Report Download - page 62

McKESSON CORPORATION
FINANCIAL REVIEW (Continued)
55
System errors or failures of our products to conform to specifications could cause unforeseen liabilities.
The software and software systems (“systems”) that we sell or operate are very complex. As with complex
systems offered by others, our systems may contain errors, especially when first introduced. For example, our
Technology Solutions business systems are intended to provide information for healthcare providers in providing
patient care. Therefore, users of our systems have a greater sensitivity to errors than the general market for software
products. Failure of a client’ s system to perform in accordance with our documentation could constitute a breach of
warranty and could require us to incur additional expense in order to make the system comply with the
documentation. If such failure is not remedied in a timely manner, it could constitute a material breach under a
contract, allowing the client to cancel the contract, obtain refunds of amounts previously paid or assert claims for
significant damages.
Various risks could interrupt customers’ access to their data residing in our service center, exposing us to
significant costs.
We provide remote hosting services that involve operating both our software and the software of third-party
vendors for our customers. The ability to access the systems and the data that we host and support on demand is
critical to our customers. Our operations and facilities are vulnerable to interruption and/or damage from a number
of sources, many of which are beyond our control, including, without limitation: (i) power loss and
telecommunications failures; (ii) fire, flood, hurricane and other natural disasters; (iii) software and hardware errors,
failures or crashes; and (iv) computer viruses, hacking and similar disruptive problems. We attempt to mitigate
these risks through various means including disaster recovery plans, separate test systems and change control and
system security measures, but our precautions may not protect against all problems. If customers’ access is
interrupted because of problems in the operation of our facilities, we could be exposed to significant claims,
particularly if the access interruption is associated with problems in the timely delivery of medical care. We must
maintain disaster recovery and business continuity plans that rely upon third-party providers of related services, and
if those vendors fail us at a time that our center is not operating correctly, we could incur a loss of revenue and
liability for failure to fulfill our contractual service commitments. Any significant instances of system downtime
could negatively affect our reputation and ability to sell our remote hosting services.
Regulation of our distribution businesses and regulation of our computer-related products could impose
increased costs, delay the introduction of new products and negatively impact our business.
The healthcare industry is highly regulated. We are subject to various local, state, federal, foreign and
transnational laws and regulations, which include the operating and security standards of the Drug Enforcement
Administration (the “DEA”), the FDA, various state boards of pharmacy, state health departments, the HHS, CMS,
and other comparable agencies. Certain of our subsidiaries may be required to register for permits and/or licenses
with, and comply with operating and security standards of the DEA, the FDA, HHS and various state boards of
pharmacy, state health departments and/or comparable state agencies as well as foreign agencies and certain
accrediting bodies depending upon the type of operations and location of product distribution, manufacturing and
sale.
In addition, the FDA has increasingly focused on the regulation of computer products and computer-assisted
products as medical devices under the Federal Food, Drug and Cosmetic Act. If the FDA chooses to regulate any of
our products as medical devices, it can impose extensive requirements upon us. If we fail to comply with the
applicable requirements, the FDA could respond by imposing fines, injunctions or civil penalties, requiring recalls
or product corrections, suspending production, refusing to grant pre-market clearance of products, withdrawing
clearances and initiating criminal prosecution. Any final FDA policy governing computer products, once issued,
may increase the cost and time to market new or existing products or may prevent us from marketing our products.