Stryker (SYK) Risk Analysis

The classification, manufacturing, sterilization, licensing, labeling, marketing and sale of our products are subject to extensive and evolving regulations and rigorous regulatory enforcement by the FDA, state governments, European Union and other governmental authorities in the United States and internationally. The process of obtaining licenses, regulatory clearances and/or approvals to market and sell our products can be costly and time consuming and the clearances and/or approvals might not be granted timely. We have ongoing responsibilities under the laws and regulations applicable to the manufacturing of products within our facilities and those contracted by third parties that are subject to periodic inspections by the FDA, state Boards of Pharmacy and other governmental authorities to determine compliance with the quality system, medical device reporting regulations and other requirements. We incur significant costs to comply with regulations, including the MDR, the free trade agreement between the United Kingdom and the European Union that became effective January 1, 2021, and the regulatory laws established by the National Medical Products Administration in China. If we fail to comply with applicable regulatory requirements, we may be subject to a range of sanctions, including substantial fines, warning letters that require corrective action, product seizures, recalls, the suspension of product manufacturing, revocation of approvals, exclusion from future participation in government healthcare programs, substantial fines and criminal prosecution.

The relationships that we, and third parties that market and/or sell our products, have with healthcare professionals, such as physicians, hospitals, healthcare organizations and others, are subject to scrutiny under various state and federal laws often referred to collectively as healthcare fraud and abuse laws. In addition, the United States and foreign government regulators have increased the enforcement of the Foreign Corrupt Practices Act (FCPA) and other anti-bribery and anti-kickback laws. We also must comply with a variety of other laws that impose extensive tracking and reporting related to all transfers of value provided to certain healthcare professionals and others. These laws and regulations are broad in scope and are subject to evolving interpretation and we have in the past been, and in the future could be, required to incur substantial costs to investigate, audit and monitor compliance or to alter our practices. Violations or alleged violations of these laws could result in litigation and we may be subject to criminal or civil penalties and sanctions, including substantial fines, imprisonment of current or former employees and exclusion from participation in governmental healthcare programs. In 2013 and 2018 we settled claims brought by the United States Securities and Exchange Commission (SEC) related to the FCPA. Pursuant to these settlements, we paid fines and penalties and retained an independent compliance consultant. We continue to implement recommendations that resulted from the independent compliance consultant's review of our commercial practices to enhance our commercial business practices.We are subject to privacy, data protection and data security regulations and laws globally, and could face substantial penalties if we fail to comply with such regulations and laws: We are subject to a variety of laws and regulations globally regarding privacy, data protection, and data security, including those related to the collection, storage, handling, use, disclosure, transfer and security of personally identifiable healthcare information. For example, in the United States, privacy and security regulations under the Health Insurance Portability and Accountability Act of 1996, including the expanded requirements under the Health Information Technology for Economic and Clinical Health Act of 2009, establish comprehensive standards with respect to the use and disclosure of protected health information (PHI), by covered entities, in addition to setting standards to protect the confidentiality, integrity and security of PHI. Regulators are also imposing new data privacy and security requirements, including new and greater monetary fines for privacy violations. For example, the European Union's General Data Protection Regulation (GDPR) established rules regarding the handling of personal data. Non-compliance with the GDPR may result in monetary penalties of up to 4% of total company revenue. Other governmental authorities around the world are imposing similar types of laws and regulations, data breach reporting and penalties for non-compliance and increasing security requirements. These laws and regulations are broad in scope and are subject to evolving interpretation and we have in the past been, and in the future could be, required to incur substantial costs to monitor compliance or to alter our practices.We may be adversely affected by product liability claims, unfavorable court decisions or legal settlements: We are exposed to potential product liability risks inherent in the design, manufacture and marketing of medical devices, many of which are implanted in the human body for long periods of time or indefinitely. We may be exposed to additional potential product liability risks related to products designed, manufactured and marketed in response to the COVID-19 pandemic, including discretionary products and products permitted under the Emergency Use Authorization granted by the FDA. We are currently defendants in a number of product liability matters, including those relating to our Rejuvenate and ABGII Modular-Neck hip stems, LFIT Anatomic CoCr V40 Femoral Heads and the product liability lawsuits and claims relating to Wright Medical Group N.V. (Wright) legacy hip products discussed in Note 7 to our Consolidated Financial Statements. These matters are subject to many uncertainties and outcomes are not predictable. Further, in November 2020 the European Parliament voted in favor of the European Representative Actions Directive (the Collective Redress Directive), which mandates a class action regime in each member state to facilitate domestic and cross-border class actions in a wide range of areas, including product liability claims with medical devices. The Collective Redress Directive will take effect in 2023 after a 24-month implementation period. The Collective Redress Directive, when implemented, could result in additional litigation risks and significant legal expenses for us. In addition, we may incur significant legal expenses for product liability claims regardless of whether we are found to be liable. settled claims brought by the United States Securities and Exchange Commission (SEC) related to the FCPA. Pursuant to these settlements, we paid fines and penalties and retained an independent compliance consultant. We continue to implement recommendations that resulted from the independent compliance consultant's review of our commercial practices to enhance our commercial business practices.