Table of Contents

          Federal and state laws protect the confidentiality of certain patient health information, including patient medical records, and restrict the use and disclosure of patient health information by health care providers. In particular, in April 2003, the U.S. Department of Health and Human Services (HHS) published patient privacy rules under the Health Insurance Portability and Accountability Act of 1996 (HIPAA privacy rule) and, in April 2005, published security rules for protected health information. The HIPAA privacy and security rules govern the use, disclosure, and security of protected health information by “Covered Entities,” which are health care providers that submit electronic claims, health plans, and health care clearinghouses. In 2009, Congress passed the HITECH Act, which modified certain provisions of the HIPAA privacy and security rules for Covered Entities and their Business Associates (which is anyone that performs a service on behalf of a Covered Entity involving the use or disclosure of protected health information and is not a member of the Covered Entity’s workforce). These included directing HHS to publish more specific security standards, and increasing breach notification requirements, as well as tightening certain aspects of the privacy rules. HHS has proposed, but not finalized, these new rules. In addition, the HITECH Act provided that Business Associates will now be subject to the same security requirements as Covered Entities, and that with regard to both the security and privacy rule, Business Associates will be subject to direct enforcement by HHS, including civil and criminal liability, just as Covered Entities are. In the past, HIPAA has generally affected us indirectly. Medtronic is generally not a Covered Entity, except for a few units such as our Diabetes business and our health insurance plans. Medtronic only operates as a Business Associate to Covered Entities in a limited number of instances. In those cases, the patient data that we receive and analyze may include protected health information. We are committed to maintaining the security and privacy of patients’ health information and believe that we meet the expectations of the HIPAA rules. Some modifications to our systems and policies may be necessary, but the framework is already in place. However, the potential for enforcement action against us is now greater, as HHS can take action directly against Business Associates. Thus, while we believe we are and will be in substantial compliance with HIPAA standards, there is no guarantee that the government will not disagree. Enforcement actions can be costly and interrupt regular operations of our business. Nonetheless, these requirements affect a limited subset of our business. We believe the ongoing costs and impacts of assuring compliance with the HIPAA privacy and security rules are not material to our business. We are also impacted by the privacy requirements of countries outside the U.S. Privacy standards in Europe and Asia are becoming increasingly strict. We will continue our efforts to comply with those requirements and to adapt our business processes to the standards.

          Government and private sector initiatives to limit the growth of health care costs, including price regulation, competitive pricing, coverage and payment policies, comparative effectiveness of therapies, technology assessments, and managed-care arrangements, are continuing in many countries where we do business, including the U.S. These changes are causing the marketplace to put increased emphasis on the delivery of more cost-effective medical devices and therapies. Government programs, including Medicare and Medicaid, private health care insurance, and managed-care plans have attempted to control costs by limiting the amount of reimbursement they will pay for particular procedures or treatments, tying reimbursement to outcomes, and other mechanisms designed to constrain utilization and contain costs. Hospitals, which purchase implants, are also seeking to reduce costs through a variety of mechanisms, including, for example, gainsharing, where a hospital agrees with physicians to share any realized cost savings resulting from the physicians’ collective change in practice patterns such as standardization of devices where medically appropriate. This has created an increasing level of price sensitivity among customers for our products. Some third-party payors must also approve coverage for new or innovative devices or therapies before they will reimburse health care providers who use the medical devices or therapies. Even though a new medical device may have been cleared for commercial distribution, we may find limited demand for the device until reimbursement approval has been obtained from governmental and private third-party payors. In addition, some private third-party payors require that certain procedures or that the use of certain products be authorized in advance as a condition of reimbursement. As a result of our manufacturing efficiencies and cost controls, we believe we are well-positioned to respond to changes resulting from the worldwide trend toward cost-containment; however, uncertainty remains as to the nature of any future legislation, making it difficult for us to predict the potential impact of cost-containment trends on future operating results.

          The delivery of our devices is subject to regulation by HHS and comparable state and foreign agencies responsible for reimbursement and regulation of health care items and services. U.S. laws and regulations are imposed primarily in connection with the Medicare and Medicaid programs, as well as the government’s interest in regulating the quality and cost of health care. Foreign governments also impose regulations in connection with their health care reimbursement programs and the delivery of health care items and services.

15