McKesson 2016 Annual Report Download - page 22

McKESSON CORPORATION
distribution system in order to prevent the introduction of counterfeit, adulterated and/or mislabeled drugs into
the pharmaceutical distribution system, otherwise known as pedigree tracking. In November 2013, Congress
passed and the President signed into law the Drug Quality and Security Act (“DQSA”). The DQSA establishes
federal standards requiring supply-chain stakeholders to participate in an electronic, interoperable, lot-level
prescription drug track and trace system. The law also preempts state drug pedigree requirements. The DSQA
also establishes new requirements for drug wholesale distributors and third party logistics providers, including
licensing requirements in states that had not previously licensed such entities.
In addition, the Food and Drug Administration Amendments Act of 2007, which went into effect on
October 1, 2007, requires the FDA to establish standards and identify and validate effective technologies for the
purpose of securing the pharmaceutical supply chain against counterfeit drugs. These standards may include
track-and-trace or authentication technologies, such as radio frequency identification devices and other similar
technologies. On March 26, 2010, the FDA released the Serialized Numerical Identifier (“SNI”) guidance for
manufacturers who serialize pharmaceutical packaging. We expect to be able to accommodate these SNI
regulations in our distribution operations. The DQSA and other pedigree tracking laws and regulations could
increase the overall regulatory burden and costs associated with our pharmaceutical distribution business, and
could have a material adverse impact on our results of operations.
Privacy: State, federal and foreign laws regulate the confidentiality of personal information, how that
information may be used, and the circumstances under which such information may be released. These
regulations govern the disclosure and use of confidential personal and patient medical record information and
require the users of such information to implement specified privacy and security measures. Regulations
currently in place, including regulations governing electronic health data transmissions, continue to evolve and
are often unclear and difficult to apply. Although we modified our policies, procedures and systems to comply
with the current requirements of applicable state, federal and foreign laws, including the Health Insurance
Portability and Accountability Act of 1996 (“HIPAA”) and the Health Information Technology for Economic
and Clinical Health (“HITECH”) Act portion of the American Recovery and Reinvestment Act of 2009, new
laws and regulations in this area could further restrict our or our customers’ ability to obtain, use or disseminate
personal or patient information, or could require us to incur significant additional costs to re-design our products
or services in a timely manner, either of which could have a material adverse impact on our results of operations.
In addition, the HITECH Act expanded HIPAA privacy and security requirements and increased financial
penalties for violations. It also extended certain provisions of the federal privacy and security standards to us in
our capacity as a business associate of our payer and provider customer. These standards may be interpreted by a
regulatory authority in a manner that could require us to make a material change to our operations. Furthermore,
our failure to maintain the confidentiality of personal information in accordance with applicable regulatory
requirements could expose us to breach of contract claims, tort damages, fines and penalties, costs for
remediation, media attention and harm to our customer relationships and reputation.
Healthcare Reform: The Affordable Care Act significantly expanded health insurance coverage to uninsured
Americans and changed the way healthcare is financed by both governmental and private payers. While certain
provisions of the Affordable Care Act took effect immediately, others have delayed effective dates or require
further rulemaking action or regulatory guidance by governmental agencies to implement and/or finalize (e.g.
nondiscrimination in health programs and activities, excise tax on high-cost employer-sponsored health
coverage). We do not currently anticipate that the Affordable Care Act or any resulting federal and state
healthcare reforms will have a material impact on our financial position and results of operations. However,
given the scope of the changes made and under consideration, as well as the uncertainties associated with
implementation of healthcare reforms, we cannot predict their full effect on the Company at this time.
Interoperability and Meaningful Use Requirement: There is increasing demand among customers, industry
groups and government authorities that healthcare information technology products provided by various vendors
16