MCKESSON CORP

Litigation and Regulatory Risks

We experience costly and disruptive legal disputes.

We are routinely named as a defendant in litigation or regulatory proceedings and other legal disputes, which may include asserted class action litigation, such as those described in Financial Note 17, “Commitments and Contingent Liabilities,” to the consolidated financial statements included in this Annual Report. Regulatory proceedings involve allegations such as false claims, healthcare fraud and abuse, and violations of competition laws. Civil litigation proceedings involve commercial, employment, environmental, intellectual property, tort, and other claims. Despite valid defenses that we assert, legal disputes are often costly, time-consuming, distracting to management, and disruptive to normal business operations. The uncertainty and expense associated with unresolved legal disputes might harm our business and reputation even if the matter ultimately is favorably resolved. The outcome of legal disputes is difficult to predict, and outcomes may occur that we believe are not justified by the evidence or existing law. Outcomes include monetary damages, penalties and fines, and injunctive or other relief that requires us to change our business operations, practices, or arrangements and incur significant expense. Accordingly, legal disputes might have a materially adverse impact on our reputation, our business operations, and our financial position or results of operations.

We experience losses not covered by insurance or indemnification.

Our business exposes us to risks that are inherent in the distribution, manufacturing, dispensing, and administration of pharmaceuticals and medical-surgical supplies, the provision of ancillary services, the conduct of our payer businesses, practice support services, and the provision of products that assist clinical decision-making and relate to patient medical histories and treatment plans. For example, pharmacy operations are exposed to risks such as improper filling of prescriptions, mislabeling of prescriptions, inadequacy of warnings, unintentional distribution of counterfeit drugs, and expiration of drugs. Although we seek to maintain adequate insurance coverage, such as property insurance for inventory and professional and general liability insurance, coverages on acceptable terms might be unavailable, or coverages might not cover our losses. We generally seek to limit our contractual exposure, but limitations of liability or indemnity provisions in our contracts may not be enforceable or adequately protect us from liability. Uninsured or non-indemnified losses might have a materially adverse impact on our business operations and our financial position or results of operations.

We experience costly legal disputes, government actions, and adverse publicity regarding our role in distributing controlled substances such as opioids.

The Company is a defendant in many litigation matters alleging claims related to the distribution of controlled substances (opioids), as described in Financial Note 17, “Commitments and Contingent Liabilities,” to the consolidated financial statements in this Annual Report. We are sometimes named as a defendant in similar, new cases. The plaintiffs in those cases include governmental entities (such as states, provinces, counties, and municipalities) as well as businesses, groups, and individuals. The cases allege violations of controlled substance laws and other laws, and they make common law claims such as negligence and public nuisance. Many of these cases raise novel theories of liability and can have unexpected outcomes that we believe are not justified by evidence or existing law. Legal proceedings such as these often involve significant expense, management time and distraction, and risk of loss that can be difficult to predict or quantify. It is not uncommon for claims to be resolved over many years. Outcomes include monetary damages, penalties and fines, and injunctive or other relief that requires us to change our business operations and incur significant expense. Although the Company has valid defenses and is vigorously defending itself, some proceedings have been, and others may be, resolved by negotiated outcome. For example, we are subject to consent decrees issued by state courts that govern our distribution of controlled substances. Not all proceedings, however, are resolved by settlement. Our reputation has been and may continue to be impacted by publicity regarding opioids litigation and related allegations. An adverse outcome of any such legal proceedings might have a materially adverse impact on our business operations and our financial position or results of operations.

We are subject to extensive, complex, challenging, and frequently changing healthcare, environmental, and other laws, and may experience increased costs to distribute controlled substances such as opioids.

We are subject to extensive, complex, challenging, and frequently changing healthcare, environmental, and other laws. As described in “Government Regulation” in Item 1 of Part I above, our industry is highly regulated and subject to a regulatory framework that is continually evolving. Legislative, regulatory, or industry measures related to the distribution of pharmaceuticals and controlled substances could affect our business in ways that we may not be able to predict. Further regulation of our distribution operations, technology, products, or services, or other aspects of our business, could impose increased costs, negatively impact our profit margins and the profit margins of our customers, delay the introduction or implementation of our new products, place restrictions on or require modifications to our practices or arrangements, limit our strategic options, or expose us to litigation and regulatory investigations, reviews, or other proceedings. We are subject to routine and ad hoc inspections and requests for information by governmental agencies to determine compliance with various statutes and regulations. We also incur remediation costs, and may incur additional costs, under environmental laws. Any noncompliance by us with applicable laws, or any failure to maintain, renew, or obtain necessary permits and licenses, could result in enforcement actions, fines, penalties, or other sanctions. In addition, certain states have enacted, and others continue to consider, legislation that would impose taxes, assessments, or similar charges on the distribution of controlled substances, including prescription opioids. Any such taxes, assessments, or other related compliance obligations could increase our costs, require changes to our distribution practices, or lead to adverse publicity. The scope, application, and financial impact of these measures vary by jurisdiction and may be difficult to predict. Any of the foregoing risks might have a materially adverse impact on our reputation, our business operations and our financial position or results of operations.

We are subject to extensive and frequently changing laws relating to healthcare fraud, waste, and abuse.

As described in “Government Regulation” in Item 1 of Part I above, federal, state, and local governmental entities in the U.S. and elsewhere continue to strengthen their position on, and scrutiny of, practices that may indicate fraud, waste, and abuse affecting government healthcare programs such as Medicare and Medicaid. Those laws may be interpreted or applied in a manner that could require us to make changes in our operations at added expense. Alleged failures to comply with those laws, including the federal Anti-Kickback Statute, expose us to federal or state government investigations or qui tam actions, and to liability for damages and civil and criminal penalties. Such failures might result in the loss of licenses or our ability to participate in Medicare, Medicaid, or other federal and state healthcare programs, or pursue government contracts. These sanctions might have a materially adverse impact on our reputation, our business operations and our financial position or results of operations.

We might lose our ability to purchase, store, or distribute pharmaceuticals, including controlled substances, and medical products.

As described in “Government Regulation” in Item 1 of Part I above, we are subject to the operating, quality, regulatory, and security requirements of the DEA, the FDA, various state boards of pharmacy, state health departments, CMS, and other agencies. Noncompliance with these requirements can result in inspectional observations, warning letters, product recalls, withdrawals or other market action, fines, seizures, injunctions, and other administrative, civil, and criminal enforcement actions. Noncompliance, enforcement actions or adverse decisions by regulators, or the inability to obtain, maintain, or renew permits, licenses, or other regulatory approvals needed for the operation of our businesses might have a materially adverse impact on our reputation, our business operations and our financial position or results of operations.

Privacy, cybersecurity, data protection, and AI laws and guidance increase our compliance burden and expose us to risks.

As described in “Government Regulation” in Item 1 of Part I above, we are subject to a variety of privacy, cybersecurity, and data protection laws that change frequently and have requirements that vary from jurisdiction to jurisdiction, as well as to rapidly developing and potentially divergent AI laws and guidance. Some of our contractual obligations might be breached if we fail to comply with privacy and data security laws. The use of AI solutions by our employees or third parties on which we rely could also lead to the misuse of data or public disclosure of confidential information (including personal data or proprietary information) in contravention of our internal policies and safeguards, applicable laws, contractual requirements, or third-party intellectual property rights. Our efforts to comply with privacy, data security, and AI laws and guidance complicate our operations and add to our costs. Any failure or perceived failure by us or any third-party providers to comply with these laws and guidance could subject us to regulatory enforcement activity, fines, investigations, legal proceedings (including private litigation such as class actions), liability, reputational impacts, and costs. Any of the foregoing risks might have a materially adverse impact on our reputation, our business operations, and our financial position or results of operations.

Anti-bribery and anti-corruption laws increase our compliance burden and expose us to risks.

We are subject to laws prohibiting improper payments and bribery, including the U.S. Foreign Corrupt Practices Act, the U.K. Bribery Act, and similar regulations in other jurisdictions. Our failure to comply with these laws might subject us to civil and criminal penalties that might have a materially adverse impact on our reputation, our business operations, and our financial position or results of operations.