Henry Schein Inc

29

termination ofy our demand  any waiting period under the Hart-Scott-Rodino Act              and certain for products,eign regulatory approvals.              The

Partnership Agreement may have unintended consequences, such as a result of applicable forced lab              uncertainty about our management, operations,

or future strategic direction, which could result in the loss of future business opportunities or negatively impact our

legismay

continue to invest in customers, suppliers, joint venture partners, or other entities that have relation and regulations. ships with the

acceptance with acceptable margins.

Our future success depends on our ability to timely develop (or obtain the right              to sell) competitive and innovative

affect ourte risks and challenges. If investments in such emerging

technologies are less successful at attracting and relationships with taining customers as well as our reputation.              With respect to certain softwthan              similar investments by our competitors,

will be avve AI that rapidly surpasses our organizational ability to understand              associated risks and

opportunities (including employees failable, adequate or enforceable in a timely mannure to comply with policies governing              AI usage) could endanger toour

intellectual protect our software or e-services productsperty, lead to misuse of data and cause reputational harm.

Risks inherent in acquisitions, dispositions and joint ventures could offset the anticipated benefits.

One of our business strategies has been to expand our domestic and international markets in in part through

26

is risk that one or more may not

succeed. We cannot be sure, for example, that we will achieve the benefits of

revenue growth that we expect from

these acquisitransactions or joint ventures or tthat we will avoid unforeseen additional

costs, taxes,  or expenses. Our ability to successfully

implement our acquisition and joint venture  strategy depends

upon,  among other things, the following:

the availability of suitable acquisition or joint venture candidates at acceptable prices;

our ability to consummate such transactions, which could potentially be prohibited due to U.S. or

foreign

antitrust regulations;

the liquidity of our investments and the availability of financing on acceptable terms;

our ability to retain customers or product lines of the acquired businesses or              joint ventures;

our ability to retain, recruit and incentivize the management of the companies we acquire; and

our ability to successfully integrate these companies operations, seystems, services,               products and personnel

with

our culture, management policies, legal, regulatory, and compliance  policies, cyinformation technology

and cybersecurity systems and

policies, internal procedures, working capital  management, financial, and  

operational and internal controls and

strategies.

Furthermore, some of our acquisitions and future acquisitions may give rise to an obligation to make contingent

payments or to satisfy certain repurchase obligations, which payments could have material adverse impacts on our

financial results individually or in the aggregate. 

 Additionally, when we decide to sell assets or a business, we may

encounter difficulty in finding buyers or

timely executing alternative exit strategies  on acceptable terms in a timely manner, which

could delay  the accomplishment

of our strategic objectives. Alternatively, we may dispose of assets or a business at a price or on terms that are less

than we had anticipated. Dispositions may also involve continued financial

30

involvement  in a divested business,

such as through transition service agreements,  indemnities or other current               or

contingent financial obligations. 

Under these arrangements, performance by the acquired or divested business, or other conditions outside our

control, could affect our future financial results.

Certain provisions in our governing documents and other documents to              which we are a party may discourage

third parties from seeking to acquire us that might otherwise result in                            in our stockholders receiving a premium

over the market price of their shares.

The provisions of our certificate of incorporation and by-laws may make it more difficult for a third-party to

acquire us, may discourage acquisition bids and may impact the price that certain investors might be willing to pay

in the future for shares of our common stock. These provisions, among other things require (i) the affirmative vote

of the holders of at least 60% of the shares of common stock entitled to vote              to approve a merger, consolidation, or

a sale, lease, transfer or exchange of all or substantially all of our assets; and (ii) the affirmative vote of the holders

of at least 66 2/3% of our common stock entitled to vote to (a) remove a director; and (b) to amend or repeal our

by-laws, with certain limited exceptions. In addition, certain of our employee incentive plans provide              for

accelerated vesting of stock options and otherequity awards upon termination without               cause within               two years following a

change in

control, or grant the plan committee discretion to accelerate  awards  upon a change of control.              Further,

certain

agreements between us and our executive officers provide for increased severance              payments and certain

benefits if

those executive officers are terminated without cause by us or if they terminate              for good reason, in each

case within

two years following a change in control or within ninety days prior  to the               effective date of the change in

control or

after the first public announcement of the pendency of the change in control.

Adverse changes in supplier rebates or other purchasing incentives could negatively affect our business.

The terms  on which  we purchase  or sell  products from  many suppliers               may               entitle               us to               receive a               rebate or               other

purchasing incentive based on the attainment of certain growth  goals.              Suppliers may reduce or eliminate rebates or

incentives  offered  under  their  programs, or  or increase  the               growth               goals              or               or other               conditions              we               must               meet              to               to earn

rebates or  or incentives to  to levels  that we  we cannot  achieve.              Increased               competition               either               from               generic              or               or equivalent

branded products  could result  in us  failing to  earn rebates  or incentives              that are               conditioned upon               achievement of

growth goals. Additionally, factors outside  of our control, such as customer               preferences, consolidation of suppliers

or supply issues, can have a material impact on  our ability to achieve  the growth goals established by               our suppliers, 

27

which  may  reduce the  amount of  rebates or  or incentives we  receive.              The              occurrence              of              any              of              these events              could

have an adverse impact on our business, financial 

Sales of condition or operporating results.

Sales of corporate bre brand products and products entthat we manufacture              entail additional risks, including the risk

that such sales could  materially adversely affect

our relationships with suppliers.

We offer certain corporate brand products that are available exclusively  from us.              The sale of such products subjects

us tocorporate brand

products and the risks generally encountered by entitiesale of products that source,we market and sell corporate brand products, including but

not limitednufacture subject us to potential product  liability risks,  mandatory or               

voluntary product  recalls, potential  supply chain  and

distribution  chain disruptions,  and  potential  intellectual               

property  infringement  risks. Any failure to adequately

address some or all of these risks could have an adverse effect              on              our              business, financial              condition              or              operating

result, among other risks. In  addition, an  an increase in  in the               sales              of               of our               corporate               brand              d products

and our own manufactured products  may  negatively  affect  our  sales               of

products  owned by our  suppliers which,

consequently,  could adversely impact certain  of our supplier relationships.             

Our ability to locate qualified,

economically stable suppliers who satisfy our requirements, and to  to acquire sufficient

products in  a timely  and

effective  manner,  is critical  to ensuring,  among other  things, that               customer confidence               is

not diminished. In

addition, we  are exposed to  the risk  that our competitors  or our large               customers may               introduce

their own  private

label,  generic, or  low-cost products  that compete  with our  products at              lower price               points.              Such

products could  

capture significant  market share  or decrease  market prices  overall, eroding              our sales               and margins.             

Any failure  to

develop sourcing  relationships with a  broad and deep  supplier base could              have an adverse              effect               could have a material adverse effect on our

business, financial condition or operating results. 

Our business could be affected by activist investors.

We actively engage in discussions with our stockholders. In other cases, stockholders can engage in certain

divisive activist tactics, which can take many forms (including potential proxy contests).              Some stockholder

activism has resulted in, and could in the future result in, substantial costs, such as professional fees, and the

diversion of managements and our Board of Directors attention and resources from our businesses and strategic

Index to Financial Statements

our business, financial condition or operating results31

plans. Additionally, it could cause uncertainty about our management, operations or future strategic direction,

which could result in the loss of future business opportunities or negatively impact our ability to attract and retain

qualified talent. Activists or other stockholders holding a large portion of our outstanding shares              could also have

the ability to exert influence on actions requiring a stockholder vote, including the election of directors and the

approval of certain extraordinary business transactions. These risks could cause volatility in the trading price of our

common stock based on factors other than the fundamentals of our business.             

INDUSTRY RISKS

Security risks generally associated with our information systems and our              technology products and services have

in the recent past adversely affected our business and results of operations, and could              in the future materially

adversely affect our business and our results of operations if such products, services,              or systems (or third-party

systems we rely on) are interrupted, damaged by unforeseen events, are subject              to cyberattacks or fail for any

extended period of time.

We rely on information systems (IS) in our business to obtain, rapidly process, analyze, manage and store

customer, product, supplier and employee data to, among other things:

maintain and manage worldwide systems to facilitate the purchase and distribution of thousands of

inventory items from numerous distribution centers;

receive, process and ship orders on a timely basis;

manage the accurate billing and collections for our customers;

process payments to suppliers; 

provide products and services that maintain certain of our customers electronic              medical or dental

records

(including protected health information of their patients); and

maintain and manage global human resources, compensation and payroll systems.

There could be an adverse impact on our business, financial condition or operating results if we do not maintain an

adequate information and technology infrastructure (

e.g.

, hardware, networks, software, people and processes) to

effectively protect and support the current and future information requirements of the business.              In addition to health

information in our customers electronic  medical and dental records,  certain of our IS stores

other sensitive personal

and financial information, such as health care  and other information related               to our

employees and individuals we

service, as well as other sensitive information such as credit card information from our third-party business

partners, that is confidential,  and in many cases subject to privacy laws.             

Our IS are vulnerasusceptible to, among other things, natural disasters,  power               losses, computer viruses, tetelecommunication

failures,

cybersecurity threats and other criminal activity.  Information security risks have significantly increased              in

recent

years in part because of an overall increase in cyber incidents,  their increased               sophistication, and the

involvement of

organized crime, hackers, terrorists and foreign state agents. T In particular, the health care               industry in particular

 has been

targeted by threat actors seeking to undermine companies cybersecurity  defensive               measures.             

We have processes in

place intended to ensure that our security measures keep pace with  new and emerging risks.             

We regularly review,  

monitor and implement multiple layers of security through technology, processes and our

people. We utilize

security technologies designed to protect and maintain the integrity of  our IS and data, and our

defenses are

monitored and routinely tested internally and by external  parties. Despite these efforts, our facilities

and systems

and those of our third-party service providers have been,  and may in  the future be, vulnerable to

privacy and

security incidents, cybersecurity attacks and data breaches,  acts of vandalism               or theft, computer viruses

and other

malicious code, misplaced or lost data, programming and/or human  errors,              attacks or other acts

undermining IS of

third party business partners including our customers,  or other similar events               that could impact

the security,

reliability and availability of our systems. In addition, hardware, software or applications developed 

 internally or

procured from third parties may contain defects  in design or manufacture               or other problems that could

unexpectedly

compromise information security. As a practical matter, so long as we depend on IS to operate our

business, and

our business partners do the same, there can be no guaranty that such measures will successfully stop

any one

particular cybersecurity incident given the constantly evolving  nature of  the threat.              We have incurred and may alsoin

the future incur

substantial costs as we update our cybersecurity defense  systems and our general               computer controls

32

to meet

evolving challenges, and legislative or regulatory action related  to cybersecurity               may increase our costs to

develop

or implement new technology products and services.

A cyberattack that bypasses or compromises our IS cybersecurity / or and/or              general               information technology (IT)

controls (including third-party systems we rely on) causing an IS security breach              may lead, and has in the past led,

to a disruption of our IS business systems (including third-party systems we              rely on), interruption of operations

(including, without limitation, receiving, verifying, and processing customer orders,              customer service, accounts

payable, warehouse management and shipping, and systems tied  to internal               controls over financial reporting), the

loss or alteration of business, financial, and other protected information, a negative impact on our financial

performance, and to an adverse impact on our financial accounting and reporting controls.             

A cyberattack that

bypasses or compromises our IS cybersecurity / and/or general  computer  controls or those of third

parties with whom

we engage may also lead to claims against us by  affected parties and/or governmental               agencies,

and involve fines

and penalties, as well as substantial defense and settlement  expenses. Any of these impacts may

alone, or

collectively, have a material impact on our business. A successful cyberattack has, and may again in the

future,

disrupt our business operations, adversely impact our financial  accounting               and reporting of results of

operations,

divert the attention of management, and adversely impact  our results of               operations.             

In addition, we develop products and provide services to our customers that are technology-based, and a

cyberattack that bypasses the IS supporting our products or services causing              a security breach and/or perceived

security vulnerabilities in our products or services could also cause significant              loss of business and reputational

harm, and actual or perceived vulnerabilities may lead to claims against us by our customers and/or governmental

agencies. In addition, certain of our practice management products and services              purchased by health care

providers, such as physicians and dentists, are used to store and manage patient              medical or dental records, and when

cloud-based approaches are used, we may be responsible for hosting those records.              These

customers a, and in some

cases, we are subject to laws and regulations which require that  they  protect the privacy and security of those

records, and our products may be used as part of these customers comprehensive              data security programs, including

in connection with their efforts to comply with applicable privacy and security laws.             

In addition to immaterial and unrelated prior incidents at certain of our subsidiaries, in October 2023, Henry Schein

experienced a cybersecurity incident that primarily affected the operations of our              North American and European

dental and medical distribution businesses. Henry Schein One, our practice management software, revenue              cycle

management and patient relationship management solutions business was not affected, and our manufacturing

businesses were mostly unaffected. Once we became aware of the issue, we took steps to assess, contain              and

remediate this incident. We restored affected systems and applications, our distribution operations resumed and we

reactivated our ecommerce platform. We also notified law enforcement and our employees, customers, suppliers

and investors, informing them of both the incident and managements efforts to mitigate its impact on our daily

operations and data maintained on the Companys systems. Subsequently, on or about November 8, 2023, we

determined that the threat actor obtained personal and sensitive information              maintained on our systems belonging to

certain third parties and since that date we have notified affected parties and potentially              affected parties as

appropriate. The scope of personal and sensitive data impacted is still under investigation.              On November 22, 2023,

we experienced a related disruption to our ecommerce platform and related applications, which has since been

remediated. The October October 2023 cybersecurity incident disrupted key               business               operations,

adversely impacted our

financial results for the fourth quarter and full year 2023,  diverted  attention of management,

and caused the

Company to incur significant remediation costs. We continue to review tThe effects of the incident on the

Companys business as we do expect some short-term rehad residual impact on our financial

results in 2024. In January

2024, two putative class actions were filed against us based oncontinue to review the effects of the incident              and one of  these actions is still pending.             

 Companys business. We arhave spending, t,

and plan to expend in the future, additional resources to continue  to protect against, or to address

problems caused

by, business interruptions, and data security breaches. 

In addition, customers and suppliers may impose additional cybersecurity requirements on us as a result of the

incident we experienced in October 2023, and some customers and suppliers              have made such requests to date.                            We

cannot guarantee that we will be able to satisfy such additional requirements,              and failure to satisfy such

requirements could result in a loss of revenue or diminished product availability that could materially affect our

business adversely. We also may be also may be perceived as a more vulnerable target of the

cyber hackers as a result of the

October 2023 incident. If the Company is subject to more attacks in the future as a result of              the recent incident, this

could materially affect our business adversely.

We maintain cyber insurance, subject to certain retentions and policy limitations.              With respect to the October 2023

cybersecurity incident, we have a $60 million insurance policy, following a $5 million retention.

The health care products distribution industry is highly competitive (including, without limitation, competition

from third-party online commerce sites) and consolidating, and we may not              be able to compete successfully.

We compete with numerous companies, including several major manufacturers and distributors.              Some of our

competitors have greater financial and other resources than we do, which could allow them to compete more

successfully. Most of our products are available from several sources and our customers              tend to have relationships

with several distributors. Competitors could obtain exclusive rights to market particular              products, which we would

then be unable to market. Manufacturers also could increase their efforts to sell directly to end-users and              thereby

eliminate or reduce our role in distribution. Industry consolidation among health care product distributors and

manufacturers, price competition, product unavailability, whether due to our inability to gain access to products or

to interruptions in manufacturing supply, or the emergence of new competitors, also could increase competition.             

Consolidation has also increased among manufacturers of health care products, which could have a material

adverse effect on our margins and product availability. We could be subject to charges and financial losses in the

event we fail to satisfy minimum purchase commitments contained in some of our contracts.              Additionally,

traditional health care supply and distribution relationships are being challenged              by electronic online commerce

solutions. 

33

The continued advancement of online commerce by third  parties will reand online              price transparency requires us to cost-

effectively adapt

to changing technologies, to enhance existing services and to differentiate  our business               (including

with additional

value-added services) to address changing demands  of consumers and  our customers on a timely basis.              The

emergence of such potential competition and our inability to anticipate and  effectively respond to changes on a

 a timely basis

could have a material adverse effect on our business, financial condition or operating              results.             

The health care industry is experiencing changes due to political, economic              and regulatory influences that could

materially adversely affect our business. 

The health care industry is highly regulated and subject to changing political, economic, and regulatory influences.             

In recent years, the health care industry has undergone, and is in the process ofbeen undergoing,               significant changes

driven  by various efforts to reduce

costs, including, among other factors: trends  toward managed care; collective 

 purchasing arrangements and

consolidation among office-based health care practitioners;  and changes in

reimbursements  to customers, including

increased attention to value-based payment  arrangements, as well as

growing enforcement  activities (and related monetary

recoveries) by governmental  officials. Both our profitability

and the profitabilityat of our customers may be  materially adversely

affected by laws  and regulations reducing

reimbursement rates for pharmaceuticals,  medical supplies and devices,               

and/or medical treatments or services, or

changes to the methodology  by which reimbursement levels are

determined. If we are unable to react effectively to

these and other changes in the  health care industry, our business

could be materially adversely affected. The ACA

greatly expanded health insurance coverage  in the United States

and has been  the target of litigationegal and

Congressionpolitical reform effortchallenges since its adoption. Any outcome of future court cases thatthese challenges the ACA, in

addition to future legislation, regulation, guidance and/or Executive Orders that do at

changes the same,ACA could have a

significant impact on the U.S. health care  industry and the ability or willingness               of

individuals to engage with it. 

30

Expansion of GPOs, DSOs , MSOs or provider networks and the multi-tiered              costing structure may place us at a

competitive disadvantage.

The health care products industry is subject to a multi-tiered costing structure, which              can vary by manufacturer

and/or product. Under this structure, certain institutions can obtain more favorable              prices for health care products

than we are able to obtain. The multi-tiered costing structure continues to expand as many large integrated health

care providers and others with significant purchasing power, such as GPOs , DSOs and DMSOs, demand               more

favorable

pricing terms. Additionally, the formation of provider networks, GPOs , DSOs and DMSOs may shift

purchasing decisions

to entities or persons with whom we do not have a historical  relationship               and may threaten our

ability to compete

effectively, which could in turn negatively impact our financial results. In addition, such

organizations may

establish direct relationships with manufacturers, thereby  either eliminating               or reducing the

services historically

provided by distributors. Although we are seeking to obtain similar terms from manufacturers               

to access lower

prices demanded by GPO , DSO and DMSO contracts or  other contracts,  and to develop relationships

with existing and

emerging provider networks, GPOs , DSOs and DMSOs, we  cannot guarantee that such terms will               

be obtained or contracts

executed. 

Increases in shipping costs or service issues with our third-party shippers              could harm our business.

Our ability to meet our customers expedited delivery expectations is an integral component of our business

strategy for which our customers rely. Shipping is a significant expense in the operation of our business.              We ship

almost all of our orders through third-party delivery services, and typically bear              the cost of shipment.              Accordingly,

any significant increase in shipping rates could have a material adverse effect on our business, financial condition

or operating results. While we have recently experienced increases in the cost of sshipping costs,              we do not expect these

additional expenses to be material to our results. How now, however, it is possible that suchthey costs could be material in the

future. Similarly,

strikes or other service interruptions by those shippers, including at transportation               centers or

shipping ports, could

cause our operating expenses to rise and materially  adversely affect our ability               to deliver

products on a timely basis.

Index to Financial Statements

34

MACRO-ECONOMIC AND POLITICAL RISKS

Uncertain global and domestic macro-economic and political conditions              could materially adversely affect our

results of operations and financial condition.

Uncertain global and domestic macro-economic and political conditions that affect the economy and the economic

outlook of the United States, Europe, Asia, and other parts of the world could have a materially adversely a effect our results

of operations and

business, financial condition. These uncertainties, include, among other th or operatings:

election  results;

changes to laws and policies governing foreign trade, tariffs and sanctions, or greater              restrictions on

imports and exports;

supply chain disruptions;

changes. These uncertainties, in laws and policies governing health care or data privacy;

changes to clude, among othe relationship between the United States and China;

sovereign debt levels;

the inability of political institutions to effectively resolve actual or perceived              economic, currency or

budgetary crises or issues;

consumer confidence;

unemployment levels (and a corresponding increase in the uninsured and r things, those listed

underinsured population);

changes in regulatory and tax regulations;

interest rate fluctuations, and strengthening of the dollar, which have Managements Discussion and will continue to              impact our

results of operations;

availability  Analysis of capital;

increases in fuel and energy costs;

the effect of inflation on our ability to procure products and our ability to increase              prices over time Financial Condition and 

pass through to our customers price increases we may receive;

31

changes in  Results of Operatax rates and the availability of certain tax deducions, Cautions;

increases in labor costs or health care costs;

the threat or outbreak of war, terrorism or public unrest (incluary Note

Regarding, without limitation, the war in

Ukraine, the Israel-Gaza  Forwar and other unrest and threats in the Middle East,              and the possibility of a

wider European or global conflict); and 

changes in laws and policies governing manufacturing, developd-Looking Statement, and              investment in territories and

countries where we do business. s. 

Additionally, changes in government, government debt and/or budget crises may lead to reductions in government

spending in certain countries, which could reduce overall health care spending,              and/or  lead to higher income or

corporate

taxes, which could depress spending overall. Recessionary or inflationary conditions and depressed

levels of

consumer and commercial spending may also cause customers to  to reduce, modify, delay,              or cancel plans to

purchase

our products and may cause suppliers to reduce their output  or change  their terms of sale.              We have

experienced

inflationary pressures, including higher freight costs and  interest expense. Although inflation impacts both our

revenues and costs, the depth , and breadth of our product portfolio often allows us to offer lower-cost national brand

solutions or corporate brand alternatives to our more price-sensitive customers who are unable to absorb price

increases, thus positioning us to protect our gross profit. Tpressures resulting from

the strengthening of the dollar, likewise,which has impacted

our revenuesve and costs, but neither inflation nor exchange rates have materially intinue to impacted our results of operations 

in fiscal year 2023. We generally sell

products to customers with payment terms. If customers cash flow or

operating and financial performance

deteriorate, or if they are unable to  make scheduled payments or obtain               credit,

they may not be able to, or may

delay, payment to us. Likewise, for similar reasons suppliers may restrict credit or

impose  different payment terms.

REGULATORY AND LITIGATION RISKS

Failure to comply with existing and future regulatory requirements could materially adversely affect our

business.

We strive to be compliant with the applicable laws, regulations and guidance described below in all material

respects, and believe we have effective compliance programs and other controls              in place to ensure substantial

compliance. However, compliance is not guaranteed either now or in the future as certain laws, regulations              and

guidance may be subject to varying and evolving interpretations that could affect our ability to comply, as well as,

future changes, additions and enforcement approaches, including in light of political changes.              When we discover

situations of non-compliance we seek to remedy them and bring the affected area back into compliance.              Changes

with

respect to the applicable laws, regulations and guidance described below may require us to update or revise

our

operations, services, marketing practices, and compliance programs and controls, and may impose additional

and

unforeseen costs on us, pose new or previously immaterial risks to us, or may otherwise have a material

adverse

effect on our business. There can be no assurance that current and future government              regulations will not

adversely

affect our business, and we cannot predict new regulatory priorities, the  form, content               or timing of

regulatory

actions, and their impact on the health care industry and on our  business               and operations.

Global efforts toward contain health care costs containment contininue to exert pressure on               product pricing.              In the United

States, in addition to otther government efforts to control health care costs, there has e

has been  increased scrutiny on drug

pricing and concurrent efforts to control or  reduce drug costs by Congress, the

President,  executive branch agencies

and various states. We and our subsidiaries  may be required to report drug pricing data under

federal laws and

regulations. At the state lSevel, several U.S. states have adopted laws, that may               apply to some of               our operations, that

require drug manufacturers, including re-packagers or re-labelers, to provide              advance notice of certain price

increases and to report information relating to those price increases, while others have taken legislative or

administrative action to estaestablished prescription drug

affordability boards or  multi-payer purchasing pools to reduce

the cost of prescription  drugs. At the federal level, several re

for example, the Inflated bills have been introduced and reguion Reduction Act of 2022, among other things,              requires drug manufacturers that raise certain

of their drug prices faster than the rate of inflations

proposed which, if enacted or finalized, respectively, would impact drug pricing to pay rebates to Medicare,              and over time will authorize the

federal government to negotiate directly with drug manufacturers to lower the prices of certain brand-name drugs

covered by Medicare. These various evolving efforts create uncertainty and related costmay adversely affect our business.

Under the Sunshine Act, we are required to collect and report detailed information regarding certain financial

relationships we have with covered recipients, including (

e.g.

, physicians, dentists,  teaching hospitals, and certain other

non-physician health care

practitioners). We and our subsidiaries may be required to report information under certain state

32

transparency laws that address circumstances

not covered by the Sunshine  Act, and some of these state laws, as

well as the federal law, can be unclear. We are also subject to foreign regulations requiringsimilar foreign transparency of certain

interactions between suppliers and their customerlaws. While we believe we

35

have substantially compliant programs

and controls in place satisfying  the above laws and requirements,  such

compliance imposes additional costs on us

and the requirements  are sometimes unclear. In the United States, government actions to seek to increase health-

related price transparency may also affect our business.

Our business is subject to additional requirements under various local, state,              federal and internationalforeign laws and

regulations applicable to the sale and distribution of, and third-party payment              for, pharmaceuticals and medical

devices and HCT/P products. Among the federal laws with which we must comply are the Controlled Substances

Act, the FDC Act, the Federal Drug Quality and Security Act, including DSCSA,              and Section 361 of the Public

Health

Services Act and Section 401 of the Consolidated Appropriations Act of the Social Security Act.              Among other

things, such laws, and the regulations promulgated  thereunder: 

regulate the introduction, manufacture, advertising, marketing and, promotion,              sampling, pricing and,

reimbursement, labeling, packaging, storage, handling, returning or, recalling, reporting, and

ddistribution of, and

record keeping for drugs, HCT/P products and  medical devices,  including 

requirements with respect to uni unique medical ddevice identifiers;

subject us to inspection by the FDA , OSHA, and DEA and similar state  authorities;

regulate the storage, transportation and disposal of certain of our products that are considered

ha hazardous materials;

require us to advertise and promote our drugs and devices in accordance with applicable FDA

requirementregulations;

require us to report average sales price (ASP) to CMS for drugs or biologicals               payable               under Medicare Part B to

CMS

B with or without a Medicaid drug rebate agreement;

require registration with the FDA and the DEA and various state agencies;

require record keeping and documentation of transactions involving drug products;

require us tus to design and operate a system to identify and report suspicious              orders of controlled

substances

to the DEA and certain states;

require us to manage returns of products that have been recalled and subject              us to inspection of our

recall

procedures and activities; 

impose on us reporting requirements if a pharmaceutical, HCT/P product or              medical device causes

sean

adverse event, serious illness, injury or death;

require manufacturers, wholesalers, re-packagers and dispensers of prescription              drugs to identify and

trace

certain prescription drugs as they are distributed; 

require the licensing of prescription drug wholesalers and third-party logistics providers; and             

mandate compliance with standards for the recordkeeping, storage , hand hling andling documentation of

transactions involving prescription drugs,

 and associated reporting requirements.

The FDA has become increasingly active in addressing the regulation of regulates certain computer software and digital health

products intended  for use in health care settings. The Cures Act, signed into law on December 13, 2016, among

other things, amended the medical device definition to exclude certain software              from FDA regulation, includ,

including, for example, AI and machine learning 

certain clinical decision support software. On September 27, 2019, the FDA issued a suite of guidance documents

on digital health products, which incorporated applicable Cures Act standards,-enabled medical devices              and on September 28, 2022, tthe

FDA subsequently finalized certain of these guidance documents, including regarding the typescybersecurity of clinical decision

support tools and other software that are exempt from regulation by the FDA as              memedical devices, and the FDA

continues to issue new guidance in this area. . 

Certain of our businesses involve the development and  sale of 

 software and related products to support physician

and dental practice management,  and it is possible that the FDA

or or foreign government authorities could determine

that one or more of our products  is subject to regulation as a

medical device,  which could subject us or one or more of o our businesses to               

substantial additional requirements,

costs and, potential enforcement actions  or liabilities for noncompliance with               

respect to these products. Some oFor example, some of our

imaging software is  regulated as a medical device which

subjects our businesses  to substantial additional

requirements, costs  and potential enforcement actions or liabilities

for noncompliance  with respect to these

products.

33

Applicable federal, state, local, and foreign laws and regulations also may  require               us to meet various standards

relating to, among other things, licensure or , registration, program eligibility, procurement, third-party

reimbursement,

sales and marketing practices, product integrity, and supply  tracking to product manufacturers,

product labeling,

personnel, privacy and security of health or other personal  information,               installation, maintenance

and repair of

equipment and the importation and exportation of products. The FDA and DEA, as well as CMS

(including with

respect to complex Medicare reimbursement requirements  applicable to our               specialty home medical

supplies

business) and state Medicaid agencies, have recently increased  their regulatory               and enforcement activities

and, in

particular, the DEA has heightened enforcement activities due to the opioid crisis in the United               States.              Our

business is also subject to requirements of similar and other foreign governmental              laws and regulations affecting

our operations abroad.

The failure to comply with any of these laws or regulations, or new interpretations              of existing laws and regulations,

them, or the imposition of any

additional laws and regulations, could  materially adversely affect our business.              The costs

to us associated with

complying with the various applicable statutes  and regulations, as they now               exist and as they

may be modified,

could be material. Allegations by a governmental body that we have not complied              with these

laws could have a

material adverse effect on our businesses. While we believe that we are substantially compliant

with  applicable

laws and regulations, and believe we have adequate  compliance programs and controls               in place to

ensure substantial

36

compliance, if it is determined that we have not complied  with these laws,  we are potentially

subject to warning

letters, substantial civil and criminal penalties,  mandatory recall of product,               seizure of product

and injunction,

consent decrees and suspension or limitation of payments  to us, product               sale and distribution.              If we

enter into

settlement agreements to resolve allegations of non-compliance, we could be required to make settlement

payments

or be subject to civil and criminal penalties, including  fines and  the loss of licenses.              Non-compliance

with

government requirements could also adversely affect our ability to participate              in  in              important federal and state

government health care programs, such as Medicare and Medicaid, and damage our reputation.

The EU Medical Device Regulation (MDR) may adversely affect our business.             

The EU MDR, applicable since May 26, 2021, si significantly modifies and intensifies              td the regulatory compliance

requirements  for the medical device industry as a

whole. Among other things, the EU MDR:

strengthens the rules on placing devices on the market and reinforces  surveillance              once they are

availablereafter;

establishes explicit provisions on manufacturers responsibilities for the follow-up of the quality,

performance and safety of devices placed on the market;

improves the traceability of medical devices throughout the supply chain to               the end-user               or patient

through

a unique identification number;

sets up a central database (EUDAMED) to provide patients, health care  professionals and               the public with

comprehensive information on products available devices, importers, and distributors registered              in the EU;             

strengthens rules for the assessment of certain high-risk devices, such as implants, which may have to

undergo an additional check by experts before they are placed on the market; and

identifies importers and distributors and medical device products through registracontains specific provisions in the event of interruption in a database

(EUDAMED not due, for the time being, until the endor discontinuation of supply of 2027 at              the earliest, as mentioned above)a device.             

In particular, tThe EU MDR imposes strict requirements for the confirmation that a               product               meets the regulatory

requirements,

including regarding a products clinical evaluation and a companys quality systems, and for the

distribution,

marketing and sale of medical devices, including post-market surveillance. As mentioned above,

pPursuant to Regulation 2023/607 and

subject to certain conditions, medical devices  that (i) obtained  a certificate

under the EU Medical Device Directive

from May 25, 2017, (ii) which was  still valid on May 26, 2021, and (iii) 

has not been subsequently withdrawn may, for the moment,  

continue to be placed on the market or put into service

until December  31, 2027 for higher risk devices or

December 31, 2028 for medium  and lower risk devices.

Nevertheless, EU MDR requirements regarding the distribution, marketing and sale including quality systems and

post-market surveillance have to be observed by manufacturers, importers and distributors as of the application date

(i.e., May 26, 2021). The modifications  created by the EU MDR may have an

impact  on the way we design and

manufacture products and the way we  conduct our business in  the EEA.

34

If we fail to comply with laws and regulations relating to health care              fraud or other laws and regulations, we

could suffer penalties or be required to make significant changes to our operations,              which could materially

adversely affect our business. 

Certain of our businesses are subject to federal and state (and similar foreign) health care fraud and abuse, referral

and reimbursement laws and regulations with respect to their operations. Some of these laws, referred to as false

claims laws, prohibit the submission or causing the submission of false or  fraudulent               claims for reimbursement to

federal, state, and other health care payers and programs. Other laws, referred to as anti-kickback laws, prohibit

soliciting, offering, receiving or paying remuneration in order to induce or reward              the referral of a patient or

ordering, purchasing, leasing or arranging for, or recommending ordering, purchasing or leasing               of,               items or

services that are paid for by federal, state and other health care payers and programs.              Certain additional state and

federal laws, such as the federal Physician Self-Referral Law, commonly known as the  (Stark Law, ),              prohibit

physicians and other health

care professionals from referring a patient  to an entity with which  the physician (or

family member) has a financial

relationship, for the furnishing of certain designated  health services  (for example,

durable medical equipment and

medical supplies), unless an exception applies. Violations of Anti-Kickback

statutes or the Stark Law may be enforced as violations of the federal False Claims              Act.

The fraud and abuse laws and regulations have been subject to heightened enforcement activity over the past few

years, and significant enforcement activity has been often as the result of relators who               serve as whistleblowers by filing 

 complaints in the name of the United

States (and if applicable, particular states)  under applicable false claims               laws,

and who may receive up to 30% of

total government recoveries. Penalties under fraud and abuse laws may be

severe, including treble damages  and

substantial civil penalties under  the federal False Claims Act, as  well as

potential loss of licenses and the ability to

participate in federal and state  health care programs, criminal penalties, 

 or imposition of a corporate compliance

37

monitor, which could have a material adverse effect on our business. Also,

these measures may be interpreted or

applied by a prosecutorial, regulatory or  judicial authority in a  manner that

could require us to make changes in our

operations or incur substantial defense  and settlement expenses. Even

unsuccessful challenges by regulatory

authorities or private rerelators could result  in reputational harm and the

incurring of  substantial costs. Most states have

adopted similar state false claims lawacts, and these state  laws have

their  own penalties which may be in addition to

federal False Claims  Act penalties, as well asnd other fraud and abuse

laws. 

With respect to measures of this type, the The United States government (among others) has expressed concerns              about

financial relationships between

suppliers on r manufacturers on the one hand and physicians,  dentists,  and other health care providers,

on the

other. As a result, we regularly review and revise our marketing practices              as necessary to facilitate

compliance. 

Our aspirations, goals and disclosures related to environmental, social and governance matters and the focus on

regulators and private litigants among other things on related claims made by companies and funds expose us to

numerous risks, including reputational, financial, legal and other risks, that could have an adverse impact on us,

including on our stock price. . 

California has adopted stringent new climate disclosure requirements, as  as              has the EU,

and. As of April 4, 2024, the SEC appears about to adopt expansive new disclosure requir

has temporarily suspended implements on ation of its climate changedisclosure rules.             

In the EU, the Directive No. 2019/1937 of October 23, 2019,

on the protection of persons who report breaches of

Union law,

 organizes the legal protection of whistleblowers. This Directive covers whistleblowers reporting

breaches of certain EU laws, in particular as regards public health, the above-mentioned              Directive No. 2001/83,

Re and regulation No. 726/2004 or, as regards datas and protection, the GDPR.              The Directive protects a wide range of people 

and  includesing former employees. All private

companies with 50 or more employees are required  to create effective

internal reporting  channels. All EU Member

States other than Poland and Estonia hahave now implemented  the

Directive.  

We also are subject to the requirements of the new Directive No. 2022/2464 on corporate sustainability reporting

(CSR DirecD)

that became effective) adopted on December 14 on January 5, 2022 and which ha3.              CSRD requires in-scope companies to be              implemented by EU members report on sustates by July

6, 2024, atinability-related

information the latest. By amending Direat is material from a financial risk or opportunity perspectives No. 2004/109, No. 2006/43, No. 2013/34              and Regulation No.

537/2014, the CSR Dir to their business and from an impact

perspective strengthenson the existing rules on non-financnvironment or society.              The material              reporting by setting new requiremity of sustainability matters is subjective and              may be

interpreted differents

for large companies to publish sustainability-relaly by various stakeholders.              CSRD, its transposition into national EU Member State law, and

associated informationguidance are evolving and, in particular, disclose details about               reporting requirements may change,              which may furtheir risks

and impacts on environr increase the costs of

complying with CSRD. CSRD has not yet been fully implemental matters.

35 ed by all EU Member States. 

We

also are subject to certain United States and foreign laws and regulations  concerning the conduct of our foreign

operations, including the U.S. Foreign Corrupt Practices Act, the U.K. Bribery              Act, German anti-corruption laws

and other anti-bribery laws and laws pertaining to the accuracy of our internal              books and records, which have been

the focus of increasing enforcement activity globally in recent years. Our businesses

are generally subject to

numerous other laws and regulations that  could impact our financial  results, including,

without limitation,

securities, antitrust, consumer protection, and marketing  laws and regulations.

In the EU, both active and passive briberycorruption in the private sector are               criminalized.              The EU Council Framework

Decision 2003/568/JHA

of 22 July 2003

 on combating corruption in the private sector

establishes more detailed

rules on the liability of

legal persons and deterrent sanctions. However, the liability of legal persons is regulated at

a national level.

Failure to comply with fraud and abuse laws and regulations, and other laws and regulations, could result in

significant civil and criminal penalties and costs, including the loss of licenses and the ability to participate in

federal and state health care programs, and could have a material adverse effect on our business.              We may

determine to enter into settlements, make payments, agree to consent decrees              or enter into other arrangements to

resolve such matters. Intentional or unintentional failure to comply with settlement agreements              or consent decrees

could materially adversely affect our business.

While we believe that we are substantially compliant with applicable fraud and              abuse and other               laws and

regulations, and believe we have

adequate compliance programs and controls  in place to ensure substantial 

 compliance, we cannot predict whether

changes in applicable law, or interpretation of laws, or changes in our

services or marketing practices in response  to

changes in applicable law or  interpretation of laws, could have a

material  adverse effect on our business. 

38

If we fail to comply with laws and regulations relating to the collection,              storage and processing of sensitive

personal information or standards in electronic health records or transmissions,              we could be required to make

significant changes to our products, or incur substantial fines, penalties, or              other liabilities.             

Our businesses that involve physician and dental practice management products, equipment and our specialty home

medical

supplyies businesses, include electronicand our self-funded employee benefits programs              include information technology (IT)

systems  that store and process personal health,

clinical, financial, and  other sensitive information of individuals. 

These information technology IT systems may be

vulnerable to breakdown, wrongful intrusions, data  breaches and  malicious attack, which

could require us to

expend significant resources to eliminate these  problems and address  related security concerns,

and could involve

claims against us by private parties and/or governmental agencies.

We are directly or indirectly subject to numerous and evolving federal, state, local and foreign laws and regulations

that protect the privacy and security of personal information (including health data), such as HIPAA, CAN-SPAM,

TCPA,  Section 5 of the

FTC Act, the CCPA,  and  various othe CPRA r privacy laws that becahave or will soon come into              effective on January 1, 2023.              .             

Laws and regulations relating to

privacy and data protection are  continually evolving and subject to  potentially

differing interpretations, including those relating to AI. These

requirements may not be harmonized, may be

interpreted and applied in  a manner that is inconsistent from one

jurisdiction  to another or may conflict with other

rules or our practices. In addition, cybersecurity laws such as the federal Cyber Incident              Reporting for Critical

Infrastructure Act of 2022, proposed Federal Acquisition Regulations and amendments to SEC reporting

requirements may require us to provide notifications about cybersecurity incidents in limited timeframes and before

investigations are complete. Our businesses failure to comply with

these laws and regulations  could expose us to

breach of contract claims, substantial  fines, penalties and other 

 liabilities and expenses, costs for remediation and

harm to our reputation. Also, eEvolving laws and regulations in

this area could restrict the  ability of our customers to

obtain, use or disseminate patient  information, or could

require us  to incur significant additional costs to re-design

our products  to reflect these legal requirements, which

could have  a material adverse effect on our operations.

In addition, the European Parliament and the Council of the EU adopted the GDPR effective from May 25, 2018,

which increased privacy rights for Data Subjects, including individuals who are our customers, suppliers and

employees. The GDPR extended the scope of responsibilities for data controllers              and data processors, and

generally imposes increased requirements and potential penalties on companies,              such as us, that are either

established in the EU and process personal data of Data Subjects (regardless              the Data Subject location), or that are

not established in the EU but that offer goods or services to Data Subjects in the EU              or monitor their behavior in the

EU. Noncompliance can result in penalties of up to the greater of EUR 20 million, or 4% of global company

revenues (sanction that may be public), and Data Subjects may seek damages.              Member states may individually

impose additional requirements and penalties regarding certain limited matters (for which the GDPR left some

36

room of flexibility), such as employee personal data. With respect to the personal data it protects, the GDPR

requires, among other things, controller accountability, consents from Data Subjects or another acceptable legal

basis to process the personal data, notification within 72 hours of a personal data breach where required, data

integrity and security, and fairness and transparency regarding the storage, use or other processing of the personal

data. The GDPR also provides rights to Data Subjects relating notably to information, access, rectification, erasure

of the personal data and the right to object to the processing. 

On August 20, 2021, ChinDespite Brexit, the UK also has data protection laws

equivalent to the GDPR). Switzerland enacted FADP. Uncertainty about compliance with these data protection

laws remains, with the possibilities that data promulgtection authorities located the PIPL, which took effect on               in different EU Member States may

interpret GDPR differently, or requirements of national laws may vary between the EU Member States, or guidance

on GDPR and compliance practices may be often updated or otherwise revised.              Any of these events will increase

the complexity and costs of processing personal data in the European Economic              Area, UK or Switzerland or

concerning individuals located in these jurisdictions.

Effective November  1, 2021. The, Chinas PIPL imposes

specific rules for processing personal information and it also sspecifies  

that the law shall also apply to personal

information activities carried  out outside China but for the purpose  of

providing products or services to PRC

citizens. Any non-compliance with these laws and regulations may  subject               

us to fines, orders to rectify or terminate

any actions that are deemed  illegal by regulatory authorities, other

penalties, as well as  reputational damage, or legal

proceedings against us, which  may affect our business, financial condition

or results  of operations. The PIPL

carries maximum penalties of CNY50 million or  5% of the annual revenue               of

entities that process personal data. 

In  Data protection laws in othe United States, the CCPAr countries are also quickly              evolving, which inith many