MCKESSON CORP

We operate in many highly regulated environments and are subject to oversight by various federal, state, and local governmental entities in the U.S. and elsewhere. We incur significant expense and make large capital expenditures and investments to enable us to comply with laws and guidance promulgated by governmental entities.

The regulatory framework affecting our business and industry is continuously evolving and influenced by conditions such as public policy developments; shifts in governmental priorities, initiatives, and focus areas, including due to changes in federal, state, and local representation; and varied interpretations of laws and agency rulemaking conventions. These conditions create uncertainties for our business, and we are unable to predict the impact of future changes to the regulatory framework, or any prolonged uncertainty, on our operations and compliance costs.

See “Risk Factors” in Item 1A of Part I below for information regarding material risks associated with our compliance with governmental regulations.

Operational Licenses and Permits; Controlled Substances: We are subject to the operating and security standards of the U.S. Drug Enforcement Administration (“DEA”), the U.S. Food and Drug Administration (“FDA”), the U.S. Department of Health and Human Services (“HHS”), the Centers for Medicare & Medicaid Services (“CMS”), various state boards of pharmacy, state health departments, and comparable agencies in the U.S. and other countries. Certain of our businesses may be required to register for permits and/or licenses with governmental agencies, depending upon the type of operations and location of product development, manufacture, distribution, and sale. For example, we are required to hold valid DEA and state-level registrations and licenses, meet various security and operating standards, and comply with the Controlled Substances Act and its accompanying regulations governing the sale, marketing, packaging, holding, distribution, and disposal of controlled substances. We maintain extensive controlled substance monitoring and reporting programs at considerable expense in order to help us meet those standards.

Government Contracts: Our contracts with governmental entities typically are subject to procurement laws that include socio-economic, employment practices, environmental protection, recordkeeping and accounting, and other requirements. These statutory and regulatory requirements complicate our business and increase our compliance burden. We are subject to audits, investigations, and oversight proceedings about our compliance with contractual and legal requirements.

Healthcare Program Regulation: Federal, state, and local governmental entities in the U.S. and elsewhere continue to strengthen their position on, and scrutiny of, practices that may indicate fraud, waste, and abuse affecting government healthcare programs such as Medicare and Medicaid. Our relationships with pharmaceutical and medical-surgical product manufacturers, healthcare providers, and other companies and individuals, as well as our provision of products and services to governmental entities, subject our business to statutes, regulations, and government guidance that are intended to prevent fraud and abuse. Among other things, those laws: (1) prohibit persons from soliciting, offering, receiving, or paying any remuneration in order to induce the referral of an individual for, or to induce the ordering or purchasing of, items or services that are in any way paid for by Medicare, Medicaid, or other government healthcare programs; (2) prohibit physicians from referring certain “designated health services” to an entity with which they have a financial relationship, unless an exception applies; and (3) prohibit knowingly submitting, or causing to be submitted, a false or fraudulent claim for payment to the government; and (4) require certain entities to report and return an overpayment by Medicare or Medicaid within 60 days of identifying the overpayment.

Many of these healthcare fraud and abuse laws are vague or indefinite and are often subject to varied and evolving interpretations by courts, regulators, and enforcing agencies and, as such, may be interpreted or applied by a prosecutorial, regulatory, or judicial authority in a manner that could require us to make changes in our operations at added expense.

In the U.S., the Patient Protection and Affordable Care Act (“ACA”) significantly expanded health insurance coverage to uninsured Americans and changed the way healthcare is financed by both governmental and private payors. The implementation of the Inflation Reduction Act of 2022 (“IRA”) has begun to change benefit design and how Medicare pays for drugs, which are all intended to reduce the price of drugs. Three central features of the IRA have authorized the government to negotiate drug prices for certain Parts B and D drugs over time, establish an inflation rebate program, and cap patient cost sharing under Medicare Part D.

Provincial governments in Canada that provide partial funding for the purchase of pharmaceuticals and independently regulate the sale and reimbursement of drugs have sought to reduce the costs of publicly funded health programs. For example, provincial governments have taken steps to reduce consumer prices for generic pharmaceuticals and, in some provinces, change professional allowances paid to pharmacists by generic drug manufacturers.

McKesson continues to advocate for policies that would improve drug cost transparency under a patient's drug plan to better inform prescribing decisions, and also address access to care, affordability, and treatment regimen adherence, all designed to improve clinical outcomes and reduce the health spending burden.

FDA Regulation and Supply Chain Integrity: In the U.S., the FDA is the principal federal authority that regulates the safety, efficacy, quality, testing, premarket approval, manufacture, labeling, storage, distribution, and post-market surveillance of healthcare products, such as drugs and medical devices, foods, and cosmetics.

Federal and state laws regulate the pharmaceutical drug supply chain in order to prevent the distribution of counterfeit, stolen, contaminated, or otherwise harmful prescription drugs in interstate commerce. At the federal level, the Drug Supply Chain Security Act (“DSCSA”), among other things, requires standardized, unit-level traceability of pharmaceutical products along the entire drug supply chain and requires all trading partners to cooperate in an electronic, interoperable prescription drug traceability system. In October 2024, the FDA extended the compliance deadlines for the DSCSA interoperable unit-level traceability requirements to May 27, 2025, for manufacturers, August 27, 2025 for distributors, and November 27, 2025 for dispensers. The FDA stated that these extensions apply to trading partners who meet certain conditions. The Company believes its businesses are eligible for the extensions. The DSCSA also sets forth national standards for the licensure of wholesale drug distributors and third-party logistic providers and other requirements applicable to these entities and the FDA has issued a proposed rule with respect to these requirements. These federal and state regulatory requirements have increased, and may further increase, our compliance burden and distribution costs.

Additionally, federal and state governments may adopt other laws intended to protect the integrity of the supply chain, and those laws could affect our distribution business. For example, the Federal Trade Commission (“FTC”) and HHS issued a request for public comment in 2024 on how the practices of pharmaceutical wholesalers and group purchasing organizations impact generic drug shortages. Various industry stakeholders responded to this request, but no further action has been taken by the FTC or HHS.

Cybersecurity, Data Security, Privacy, and AI: We are subject to many cybersecurity, privacy, and data protection laws that change frequently and have requirements that vary from jurisdiction to jurisdiction. Our efforts to comply with these laws complicate our operations and add to our costs. We are subject to significant compliance obligations under privacy laws such as the Health Insurance Portability and Accountability Act of 1996, the General Data Protection Regulation in the European Union, the Personal Information Protection and Electronic Documents Act in Canada, and an expanding list of comprehensive state privacy laws in the U.S. Some privacy laws may prohibit the transfer of personal information to certain other jurisdictions or otherwise limit our use and disclosure of data. Many of these laws also require us to provide access or other data rights (modification, deletion, portability, etc.) to consumers’ and patients’ individual personal data records within specified periods of time. Cybersecurity laws such as the federal Cyber Incident Reporting for Critical Infrastructure Act of 2022, proposed changes to the Federal Acquisition Regulation, and SEC reporting requirements may require us to provide notifications of certain cybersecurity incidents within short timeframes. Regulations and guidance targeting critical infrastructure entities, including McKesson, continue to be a focus of regulators. We are subject to privacy and data protection compliance audits or investigations by various governmental agencies. There is also an emerging trend of governmental entities proposing and providing regulatory guidance related to AI, including generative AI. If we or our third-party providers are restricted from using AI as a result of any regulatory views, laws or other measures, it could impact our operations, increase our compliance expense and burden, and cause us to incur costs to replace or modify our use of AI.

Environmental Regulation: We are subject to various federal, state, local, and foreign laws concerning the environment, including laws addressing the discharge of pollutants into the air and water, the management and disposal of hazardous substances and wastes, and the cleanup of contaminated sites, as well as laws governing the operation of radiation-emitting equipment at U.S. Oncology Network practices.

We sold our chemical distribution operations in 1987 and retained responsibility for certain environmental obligations. Agreements with the U.S. Environmental Protection Agency and certain states have required and may require environmental assessments and cleanups at several closed sites. These matters are described further in Financial Note 17, “Commitments and Contingent Liabilities,” to the consolidated financial statements included in this Annual Report.

Climate Change Regulation: Governments in the U.S. and abroad have adopted or are considering new or expanded policies and laws to address climate change. Such policies and laws may necessitate reductions in greenhouse gas (“GHG”) emissions; mandate that companies implement processes and controls to monitor and disclose climate-related matters; and impose additional taxes or offset charges on specified energy sources, among other requirements. Compliance with climate-related policies and laws may be further complicated by disparate regulatory approaches in various jurisdictions. Methodologies for reporting climate-related information may change and previously reported information may be retroactively adjusted, if required. New or expanded climate-related policies and laws could impose costs on us, including capital expenditures to develop data gathering and reporting systems, third-party attestations, and additional GHG reduction measures. Until the timing and extent of climate-related policies and laws are clarified, including due to legal challenges, we cannot predict their potential effect on our capital expenditures, results of operations, or competitive position.

Antitrust Laws: Antitrust and competition laws in the U.S. and elsewhere prohibit types of conduct deemed to be anti-competitive. Antitrust enforcement in the healthcare industry remains a focus of the FTC and the U.S. Department of Justice. Some of our strategic transactions may require review by competition regulators, with inherent delays. Violations of the antitrust laws can result in sanctions and other adverse actions, including criminal and civil penalties. Private plaintiffs also may bring civil lawsuits for alleged antitrust law violations, including claims for treble damages. These laws contribute to our compliance efforts and expense, and their enforcement might materially adversely affect our operations and growth strategy.