McKesson 2010 Annual Report Download - page 25

McKESSON CORPORATION
19
Regulation of our distribution businesses and regulation of our computer-related products could impose
increased costs, delay the introduction of new products and negatively impact our business.
The healthcare industry is highly regulated. We are subject to various local, state, federal, foreign and
transnational laws and regulations, which include the operating and security standards of the Drug Enforcement
Administration (the “DEA”), the FDA, various state boards of pharmacy, state health departments, the HHS, CMS
and other comparable agencies. Certain of our subsidiaries may be required to register for permits and/or licenses
with, and comply with operating and security standards of the DEA, the FDA, HHS, various state boards of
pharmacy, state health departments and/or comparable state agencies as well as foreign agencies and certain
accrediting bodies depending upon the type of operations and location of product distribution, manufacturing and
sale.
In addition, the FDA has increasingly focused on the regulation of computer products and computer-assisted
products as medical devices under the federal Food, Drug and Cosmetic Act. If the FDA chooses to regulate any of
our products as medical devices, it can impose extensive requirements upon us. If we fail to comply with the
applicable requirements, the FDA could respond by imposing fines, injunctions or civil penalties, requiring recalls
or product corrections, suspending production, refusing to grant pre-market clearance of products, withdrawing
clearances and initiating criminal prosecution. Any final FDA policy governing computer products, once issued,
may increase the cost and time to market new or existing products or may prevent us from marketing our products.
We regularly receive requests for information and occasionally subpoenas from government authorities.
Although we believe that we are in compliance, in all material respects, with applicable laws and regulations, there
can be no assurance that a regulatory agency or tribunal would not reach a different conclusion concerning the
compliance of our operations with applicable laws and regulations. In addition, there can be no assurance that we
will be able to maintain or renew existing permits, licenses or any other regulatory approvals or obtain without
significant delay future permits, licenses or other approvals needed for the operation of our businesses. Any
noncompliance by us with applicable laws and regulations or the failure to maintain, renew or obtain necessary
permits and licenses could have a material adverse impact on our results of operations.
Regulations relating to confidentiality of sensitive personal information and to format and data content standards
could depress the demand for our products and impose significant product redesign costs and unforeseen
liabilities on us.
State, federal and foreign laws regulate the confidentiality of sensitive personal information and the
circumstances under which such information may be released. These regulations govern the disclosure and use of
confidential personal and patient medical record information and require the users of such information to implement
specified security measures. Regulations currently in place, including regulations governing electronic health data
transmissions, continue to evolve and are often unclear and difficult to apply. Although our systems are being
updated and modified to comply with the current requirements of state and foreign laws and the Federal Health
Insurance Portability and Accountability Act of 1996 (“HIPAA”) and the HITECH Act, evolving laws and
regulations in this area could restrict the ability of our customers to obtain, use or disseminate patient information or
could require us to incur significant additional costs to re-design our products in a timely manner, either of which
could have a material adverse impact on our results of operations. In addition, in February 2010, certain provisions
of the federal security and privacy standards were extended to us in our capacity as a business associate of our payor
and provider customers. Furthermore, failure to maintain confidentiality of sensitive personal information in
accordance with the applicable regulatory requirements could expose us to breach of contract claims, fines and
penalties, costs for remediation and harm to our reputation.