MCKESSON CORP

We operate in many highly regulated industries and are subject to oversight by various federal, state, and local governmental entities in the U.S. and elsewhere. We incur significant expense and make large capital expenditures and investments to enable us to comply with regulations and guidance promulgated by governmental entities. See “Risk Factors” in Item 1A of Part I below for information regarding material risks associated with our compliance with governmental regulations.

Controlled Substances: We are subject to the operating and security standards of the U.S. Drug Enforcement Administration (“DEA”), the U.S. Food and Drug Administration (“FDA”), the U.S. Department of Health and Human Services (”HHS”), the Centers for Medicare & Medicaid Services (“CMS”), various state boards of pharmacy, state health departments, and comparable agencies in the U.S. and other countries. Certain of our businesses may be required to register for permits and/or licenses with government agencies, depending upon the type of operations and location of product development, manufacture, distribution, and sale. For example, we are required to hold valid DEA and state-level registrations and licenses, meet various security and operating standards, and comply with the Controlled Substances Act and its accompanying regulations governing the sale, marketing, packaging, holding, distribution, and disposal of controlled substances. We maintain extensive controlled substance monitoring and reporting programs at considerable expense in order to help us meet those standards.

Government Contracts: Our contracts with government entities typically are subject to procurement laws that include socio-economic, employment practices, environmental protection, recordkeeping and accounting, and other requirements. These statutory and regulatory requirements complicate our business and increase our compliance burden. We are subject to audits, investigations, and oversight proceedings about our compliance with contractual and legal requirements.

Federal, state, and local governmental entities in the U.S. and elsewhere continue to strengthen their position and scrutiny of practices that may indicate fraud, waste, and abuse affecting government healthcare programs such as Medicare and Medicaid. Our relationships with pharmaceutical and medical surgical product manufacturers, healthcare providers, and other companies and individuals, as well as our provision of products and services to government entities, subject our business to statutes, regulations, and government guidance that are intended to prevent fraud and abuse. Among other things, those laws: (1) prohibit persons from soliciting, offering, receiving, or paying any remuneration in order to induce the referral of an individual for, or to induce the ordering or purchasing of, items or services that are in any way paid for by Medicare, Medicaid, or other government healthcare programs; (2) impose many restrictions upon referring physicians and providers of designated health services under Medicare and Medicaid programs; and (3) prohibit the knowing submission of a false or fraudulent claim for payment to, and knowing retention of an overpayment by, a federal healthcare program such as Medicare and Medicaid. Many of these laws are vague or indefinite and are often subject to varied and evolving interpretations by courts, regulators, and enforcing agencies and, as such, may be interpreted or applied by a prosecutorial, regulatory, or judicial authority in a manner that could require us to make changes in our operations at added expense.

Healthcare Program Regulation: In the U.S., the Patient Protection and Affordable Care Act (“ACA”) significantly expanded health insurance coverage to uninsured Americans and changed the way healthcare is financed by both governmental and private payors. The implementation of the Inflation Reduction Act of 2022 (the “IRA”) has begun to change benefit design and how Medicare pays for drugs, which are all intended to reduce the price of drugs. Three central features of the IRA have authorized the government to negotiate drug prices for certain Parts B and D drugs over time, establish an inflation rebate program, and cap patient cost sharing under Medicare Part D.

Provincial governments in Canada that provide partial funding for the purchase of pharmaceuticals and independently regulate the sale and reimbursement of drugs have sought to reduce the costs of publicly funded health programs. For example, provincial governments have taken steps to reduce consumer prices for generic pharmaceuticals and, in some provinces, change professional allowances paid to pharmacists by generic drug manufacturers.

McKesson continues to advocate for policies that would improve drug cost transparency under a patient's drug plan to better inform prescribing decisions, and also address access to care, affordability, and treatment regimen adherence, all designed to improve clinical outcomes and reduce the health spending burden.

FDA Regulation and Supply Chain Integrity: In the U.S., the FDA is the principal federal authority that regulates the safety, efficacy, quality, testing, premarket approval, manufacture, labeling, storage, distribution, and post-market surveillance of healthcare products, such as drugs and medical devices, foods, and cosmetics.

Certain federal and state laws regulate the pharmaceutical drug supply chain in order to prevent the distribution of counterfeit, stolen, contaminated, or otherwise harmful prescription drugs in interstate commerce. At the federal level, the Drug Supply Chain Security Act (“DSCSA”) requires standardized, unit-level traceability of pharmaceutical products along the entire drug supply chain and requires all trading partners to cooperate in an electronic, interoperable prescription drug traceability system. In August 2023, the FDA established a one-year stabilization period to certain DSCSA requirements that allows trading partners to implement, troubleshoot, and mature their electronic interoperable systems until the stabilization period ends on November 27, 2024. The FDA has also issued a proposed rule that would establish national standards for the licensure of wholesale drug distributors and third-party logistic providers and other requirements applicable to these entities. These federal and state regulatory requirements increase our compliance burden and our distribution costs.

Cybersecurity, Data Security, and Privacy: We are subject to many cybersecurity, privacy, and data protection laws that change frequently and have requirements that vary from jurisdiction to jurisdiction. Our efforts to comply with these laws complicates our operations and adds to our costs. We are subject to significant compliance obligations under privacy laws such as the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), the General Data Protection Regulation (“GDPR”) in the European Union, the Personal Information Protection and Electronic Documents Act (“PIPEDA”) in Canada, and an expanding list of comprehensive state privacy laws in the U.S. Some privacy laws prohibit the transfer of personal information to certain other jurisdictions or otherwise limit our use of data. Many of these laws also require us to provide access or other data rights (modification, deletion, portability, etc.) to consumers’ and patients’ individual personal data records within specified periods of time. Cybersecurity laws such as the federal Cyber Incident Reporting for Critical Infrastructure Act of 2022, proposed Federal Acquisition Regulations, and recent amendments to SEC reporting requirements may require us to provide notifications of certain cybersecurity incidents before our investigations are complete and within short timeframes. Regulations and guidance targeting critical infrastructure entities, including McKesson, continue to be a focus of regulators. We are subject to privacy and data protection compliance audits or investigations by various government agencies. The introduction of new technologies, such as AI, may result in additional regulation.

Environmental Regulation: We are subject to many environmental and hazardous materials regulations, including those relating to radiation-emitting equipment operated at U.S. Oncology Network practices. Additionally, our operations are subject to regulations under various federal, state, local and foreign laws concerning the environment, including laws addressing the discharge of pollutants into the air and water, the management and disposal of hazardous substances and wastes, and the cleanup of contaminated sites.

We sold our chemical distribution operations in 1987 and retained responsibility for certain environmental obligations. Agreements with the U.S. Environmental Protection Agency and certain states have required and may require environmental assessments and cleanups at several closed sites. These matters are described further in Financial Note 17, “Commitments and Contingent Liabilities,” to the consolidated financial statements included in this Annual Report.

Climate Change Regulation: Governments in the U.S. and abroad have adopted or are considering new or expanded policies and laws to address climate change. Such policies and laws may require or necessitate reductions of greenhouse gas (“GHG”) emissions, mandates that companies implement processes and controls to monitor and disclose climate-related matters, additional taxes or offset charges on specified energy sources, and other requirements. Compliance with climate-related policies and laws may be further complicated by disparate regulatory approaches in various jurisdictions. Methodologies for reporting climate-related information may change and previously reported information may be retroactively adjusted, if required. New or expanded climate-related policies and laws could impose costs on us, including capital expenditures to develop data gathering and reporting systems, costly third-party attestations, and additional GHG reduction measures. Until the timing and extent of climate-related policies and laws are clarified, including due to legal challenges, we cannot predict their potential effect on our capital expenditures, results of operations, or competitive position.