Henry Schein (HSIC) Risk Factors

significant changes to our products, or incur substantial fines, penalties, or other liabilities. Our businesses that involve physician and dental practice management products, and our specialty home medical supply businesses, include electronic information technology systems that store and process personal health,clinical, financial, and other sensitive information of individuals. These information technology systems may be vulnerable to breakdown, wrongful intrusions, data breaches and malicious attack, which could require us to expend significant resources to eliminate these problems and address related security concerns, and could involve claims against us by private parties and/or governmental agencies. We are directly or indirectly subject to numerous and evolving federal, state, local and foreign laws and regulations that protect the privacy and security of personal information, such as HIPAA, CAN-SPAM, TCPA, Section 5 of the FTC Act, the CCPA, and the CPRA that became effective on January 1, 2023. Laws and regulations relating to privacy and data protection are continually evolving and subject to potentially differing interpretations. These requirements may not be harmonized, may be interpreted and applied in a manner that is inconsistent from one jurisdiction to another or may conflict with other rules or our practices. Our businesses' failure to comply with these laws and regulations could expose us to breach of contract claims, substantial fines, penalties and other liabilities and expenses, costs for remediation and harm to our reputation. Also, evolving laws and regulations in this area could restrict the ability of our customers to obtain, use or disseminate patient information, or could require us to incur significant additional costs to re-design our products to reflect these legal requirements, which could have a material adverse effect on our operations. In addition, the European Parliament and the Council of the EU adopted the GDPR effective from May 25, 2018,which increased privacy rights for Data Subjects, including individuals who are our customers, suppliers and employees. The GDPR extended the scope of responsibilities for data controllers and data processors, and generally imposes increased requirements and potential penalties on companies, such as us, that are either established in the EU and process personal data of Data Subjects (regardless the Data Subject location), or that are not established in the EU but that offer goods or services to Data Subjects in the EU or monitor their behavior in the EU. Noncompliance can result in penalties of up to the greater of EUR 20 million, or 4% of global company revenues (sanction that may be public), and Data Subjects may seek damages. Member states may individually impose additional requirements and penalties regarding certain limited matters (for which the GDPR left some room of flexibility), such as employee personal data. With respect to the personal data it protects, the GDPR requires, among other things, controller accountability, consents from Data Subjects or another acceptable legal basis to process the personal data, notification within 72 hours of a personal data breach where required, data integrity and security, and fairness and transparency regarding the storage, use or other processing of the personal data. The GDPR also provides rights to Data Subjects relating notably to information, access, rectification, erasure of the personal data and the right to object to the processing. On August 20, 2021, China promulgated the PIPL, which took effect on November 1, 2021. The PIPL imposes specific rules for processing personal information and it also specifies that the law shall also apply to personal information activities carried out outside China but for the purpose of providing products or services to PRC citizens. Any non-compliance with these laws and regulations may subject us to fines, orders to rectify or terminate any actions that are deemed illegal by regulatory authorities, other penalties, as well as reputational damage or legal proceedings against us, which may affect our business, financial condition or results of operations. The PIPL carries maximum penalties of CNY50 million or 5% of the annual revenue of entities that process personal data. In the United States, the CCPA, which increases the privacy protections afforded California residents, became effective January 1, 2020. The CCPA generally requires companies, such as us, to institute additional protections regarding the collection, use and disclosure of certain personal information of California residents. Compliance with the obligations imposed by the CCPA depends in part on how particular regulators interpret and apply them. Regulations were released in August of 2020, but there remains some uncertainty about how the CCPA will be interpreted by the courts and enforced by the regulators. If we fail to comply with the CCPA or if regulators assert that we have failed to comply with the CCPA, we may be subject to certain fines or other penalties and litigation,any of which may negatively impact our reputation, require us to expend significant resources, and harm our business. Furthermore, California voters approved the CPRA on November 3, 2020, which will amend and expand the CCPA, including by providing consumers with additional rights with respect to their personal information, and creating a new state agency to enforce CCPA and CPRA. The CPRA came into effect on January 1, 2023, applying to information collected by businesses on or after January 1, 2022. Other states, as well as the federal government, have increasingly considered the adoption of similarly expansive personal privacy laws, backed by significant civil penalties for non-compliance. While we believe we have substantially compliant programs and controls in place to comply with the GDPR, CCPA, PIPL and CPRA requirements, our compliance with data privacy and cybersecurity laws is likely to impose additional costs on us,and we cannot predict whether the interpretations of the requirements, or changes in our practices in response to new requirements or interpretations of the requirements, could have a material adverse effect on our business. We also sell products and services that health care providers, such as physicians and dentists, use to store and manage patient medical or dental records. These customers and we are subject to laws, regulations and industry standards, such as HIPAA and the Payment Card Industry Data Security Standards, which require the protection of the privacy and security of those records. Our products or services may be used as part of these customers'comprehensive data security programs, including in connection with their efforts to comply with applicable data privacy and security laws and contractual requirements. Perceived or actual security vulnerabilities in our products or services, or the perceived or actual failure by us or our customers who use our products or services to comply with applicable legal or contractual data privacy and security requirements, may not only cause us significant reputational harm, but may also lead to claims against us by our customers and/or governmental agencies and involve substantial fines, penalties and other liabilities and expenses and costs for remediation. Additionally, under the GDPR, health data belong to the category of "sensitive data" and benefit from specific protection. Processing of such data is generally prohibited, except for specific exceptions. Certain of our businesses involve the manufacture and sale of electronic health record (EHR) systems and other products linked to government supported incentive programs, where the EHR systems must be certified as having certain capabilities designated in evolving standards, such as those adopted by CMS and ONC. In order to maintain certification of our EHR products, we must satisfy the changing governmental standards. If any other EHR systems do not meet these standards, yet have been relied upon by health care providers to receive federal incentive payments, we may be exposed to risk, such as under federal health care fraud and abuse laws, including the False Claims Act. Additionally, effective September 1, 2023, the OIG for HHS issued a final rule implementing civil money penalties for information blocking as established by the Cures Act. OIG incorporated regulations published by ONC as the basis for enforcing information blocking penalties. Each information blocking violation carries a $1 million penalty. While we believe we are substantially in compliance with such certifications and with applicable fraud and abuse laws and regulations and that we have adequate compliance programs and controls in place to ensure substantial compliance, we cannot predict whether changes in applicable law, or interpretation of laws, or resulting changes in our compliance programs and controls, could have a material adverse effect on our business. Moreover, in order to satisfy our customers and comply with evolving legal requirements, our products may need to incorporate increasingly complex functionality, such as with respect to reporting and information blocking. Although we believe we are positioned to accomplish this, the effort may involve increased costs, and our failure to implement product modifications, or otherwise satisfy applicable standards, could have a material adverse effect on our business. Additionally, as electronic medical devices are increasingly connected to each other and to other technology, the ability of these connected systems to safely and effectively exchange and use exchanged information becomes increasingly important. As a medical device manufacturer, we must manage risks including those associated with an electronic interface that is incorporated into a medical device.

If we fail to comply with laws and regulations relating to the collection, storage and processing of sensitive