McKesson 2011 Annual Report Download - page 20

McKESSON CORPORATION
14
Final regulations under the federal Prescription Drug Marketing Act requiring pedigree and chain of custody
tracking in certain circumstances became effective December 1, 2006. This latter regulation has been challenged in
a case brought by secondary distributors. A preliminary injunction was issued by the United States District Court
for the Eastern District of New York that temporarily enjoined implementation of this regulation. This injunction
was affirmed by the Court of Appeals for the Second Circuit in July 2008. In December 2008, both parties agreed to
delay this litigation, pending the outcome of certain U.S. congressional legislative initiatives. In addition, the Food
and Drug Administration Amendments Act of 2007 (“FDAA”), which went into effect on October 1, 2007, requires
the FDA to establish standards and identify and validate effective technologies for the purpose of securing the
pharmaceutical supply chain against counterfeit drugs. These standards may include any track-and-trace or
authentication technologies, such as radio frequency identification devices and other similar technologies. On
March 26, 2010, the FDA released the Serialized Numerical Identifier (“SNI”) guidance for manufacturers who
serialize pharmaceutical packaging. We expect to be able to accommodate these SNI regulations in our distribution
operations. Nonetheless, these pedigree tracking laws and regulations could increase the overall regulatory burden
and costs associated with our pharmaceutical distribution business, and could have a material adverse impact on our
results of operations.
Privacy: State, federal and foreign laws regulate the confidentiality of sensitive personal information, how that
information may be used, and the circumstances under which such information may be released. These regulations
govern the disclosure and use of confidential personal and patient medical record information and require the users
of such information to implement specified privacy and security measures. Regulations currently in place, including
regulations governing electronic health data transmissions, continue to evolve and are often unclear and difficult to
apply. Although our policies, procedures and systems are being updated and modified to comply with the current
requirements of applicable state and foreign laws, including the Health Insurance Portability and Accountability Act
of 1996 (“HIPAA”) and the Health Information Technology for Economic and Clinical Health (“HITECH”) Act
portion of the American Recovery and Reinvestment Act (“ARRA”) of 2009, evolving laws and regulations in this
area could restrict the ability of our customers to obtain, use or disseminate patient information, or it could require
us to incur significant additional costs to re-design our products in a timely manner, either of which could have a
material adverse impact on our results of operations. In addition, the HITECH Act expanded HIPAA privacy and
security requirements and increased financial penalties for violations. It also extended certain provisions of the
federal privacy and security standards to us in our capacity as a business associate of our payer and provider
customers. These standards may be interpreted by a regulatory authority in a manner that could require us to make a
material change to our operations. Furthermore, failure to maintain confidentiality of sensitive personal information
in accordance with applicable regulatory requirements could expose us to breach of contract claims, fines and
penalties, costs for remediation and harm to our reputation.
Health Care Reform: The Affordable Care Act significantly expanded health insurance coverage to uninsured
Americans and changed the way health care is financed by both governmental and private payers. Further federal
and state proposals for healthcare reform are likely. While we do not currently anticipate that the Affordable Care
Act will have a material impact on our business, financial condition and results of operations, given the scope of the
changes made and the uncertainties associated with the its implementation, we cannot predict its full impact on the
Company at this time.
Interoperability Standards: There is increasing demand among customers, industry groups and government
authorities that healthcare software and systems provided by various vendors be compatible with each other. This
need for interoperability is leading to the development of standards by various groups, and certain federal and state
agencies are also developing standards that could become mandatory for systems purchased by these agencies. For
example, the HITECH Act requires meaningful use of “certified” healthcare information technology products by
healthcare providers in order to receive stimulus funds from the federal government. Effective September 27, 2010,
CMS issued a rule that utilizes a staged approach for defining meaningful use criteria. In “Stage 1,” CMS defined
the initial criteria for meaningful use, and has stated that it intends to update these initial criteria with additional
“Stage 2” criteria by the end of calendar 2011, and with additional “Stage 3” criteria by the end of calendar 2013.
We may incur increased development costs and delays in upgrading our customer software and systems to be in
compliance with these varying and evolving standards. In addition, these new standards may lengthen our sales and
implementation cycle and we may incur costs in periods prior to the corresponding recognition of revenue. To the
extent these standards are narrowly construed or delayed in publication, or that we are delayed in achieving
certification under these evolving standards for applicable products, our customers may postpone or cancel their
decisions to purchase or implement our software and systems.