Henry Schein (HSIC) Risk Factor Changes

events and other potential physical consequences, regulatory and technological

to the accuracy of our internal books and records;

regulatory requirements, including, without limitation, anti-bribery, anti-corruption and laws pertaining

longer payment cycles and difficulty of collecting receivables in foreign jurisdictions;

Our global operations are subject to inherent risks that could materially

Processing of such data is generally prohibited, except for

us significant reputational harm, but may also lead to claims against us by our

services to comply with applicable legal or contractual data privacy and

in our products or services, or the perceived or actual failure by us

Perceived or actual security vulnerabilities

applicable data privacy and security laws and contractual requirements.

customers’ comprehensive data security programs, including in connection

Our products or services may be used as part of these

protection of the privacy and security of those records.

standards, such as HIPAA and the Payment Card Industry (PCI) Data Security Standards, which require the

and we may be required to make significant

in complying with legal obligations to be imposed by new regulations

increase the penalties to which we could be subject in the event of any

Anticipated further evolution of regulations and legislation

Any failure or perceived failure by us to comply with such requirements

implementing specific legal frameworks with respect to AI.

applying their data and consumer protection laws to AI, particularly

a material adverse effect on our business.

additional costs on us, and we cannot predict whether the interpretations

domestically and internationally, our compliance with data privacy and cybersecurity laws is likely to impose

complicate our compliance efforts and further increase our risk of regulatory enforcement,

is considering legislation that may preempt some or all of such U.S.

states have enacted specific health data privacy laws and other states

increasingly disparate requirements across the various U.S.

enacted or are considering enacting similar privacy laws, which may subject

This private right of action may increase the likelihood of, and risks associated

evolving, with many countries having updated, or are in the process

Data protection laws in other countries, such as Brazil, are

processing personal data in the European

interpret GDPR differently, or requirements of national laws may vary between the EU Member States, UK and

access, rectification, erasure of the personal data and the right to object to

where required, data integrity and security, and fairness and transparency regarding the storage, use or other

within 72 hours of a personal data breach

another acceptable legal basis to process the personal data, notification

it protects, the GDPR requires, among other things, controller accountability, consents from Data Subjects or

which the GDPR left some room of flexibility), such as employee personal data.

in penalties of up to the greater of EUR 20

the Data Subject location), or that are not established in the EU but

The GDPR extended the scope of responsibilities for

May 25, 2018, which increased privacy rights for Data Subjects in

legal requirements, which could have a material adverse effect on our operations.

Evolving laws and regulations in this area could restrict the ability

substantial fines, penalties and other liabilities and expenses, costs

Our businesses’ failure to comply with these laws and regulations could expose

provide notifications about cybersecurity incidents in limited timeframes and

reporting requirements may require us to

2022, proposed Federal Acquisition Regulations and amendments to SEC

and territories), cybersecurity laws such as the federal Cyber Incident

may be interpreted and applied in a manner that is inconsistent from one

potentially differing interpretations, including those relating to AI.

Laws and regulations relating to privacy and data protection

and various other privacy laws that have or will soon come

TCPA, Section 5 of the FTC Act, the CCPA/CPRA

CSRD requires in-scope companies to report sustainability-related information

We are subject to Directive (EU) 2022/2464 on corporate sustainability reporting (“CSRD”) which became

As a result, we regularly review and revise our marketing

relationships between suppliers or manufacturers on the one hand and

December 31, 2028 for medium and lower risk devices.

with comprehensive information on devices, importers, and distributors

enforcement activities and, in particular, the DEA has heightened enforcement activities due to the

For example, some of our imaging software is regulated

transactions involving prescription drugs and devices and associated

trace certain prescription drugs as they are distributed;

Part B with or without a Medicaid drug rebate agreement;

regulate the storage, transportation and disposal of hazardous materials;

disposal, and recordkeeping for drugs, HCT/P products and medical devices,

Act, the Food, Drug & Cosmetic Act, the Federal Drug Quality and Security

While we believe we have substantially compliant programs and controls

We may be required to report information

under “Management’s Discussion and Analysis of Financial Condition and Results of Operations, Cautionary

world could have a material adverse effect on our

ports, could cause our operating expenses to rise and materially adversely

Similarly, strikes or other service interruptions by those shippers, including at transportation centers or shipping

additional expenses to be material to our results now, however they could become material in a future fiscal period.

Expansion of GPOs, DSOs, MSOs or provider networks and the

industry and the ability or willingness of individuals to engage with it.

a significant impact on the U.S.

If we are unable to react effectively to these and other changes

In addition, a number of states are considering and enacting laws

affected by laws and regulations reducing

our profitability and that of our customers may be materially adversely

consolidation among office-based health care

In recent years, the health care industry has

be perceived as a more vulnerable target of the cyber hackers as a result of the October

protect against, or to address problems caused by, business interruptions and data security breaches.

We have spent, and plan to expend in the future, additional resources to continue to

management, and caused the Company to incur significant remediation

operations, adversely impacted our financial results for the fourth quarter

Nevertheless, the October 2023 cybersecurity incident disrupted

In addition to immaterial and unrelated incidents at certain of our subsidiaries,

reporting of results of operations, divert the attention of management,

Any of these impacts may alone, or collectively, have a material impact on our business.

A cyberattack that bypasses or compromises our IS cybersecurity

negative impact on our financial performance, and to an adverse

has in the past led, to a disruption of our, or our vendors’, IS business systems (including third-party systems