Table of Contents

          The FDA, in cooperation with U.S. Customs and Border Protection (CBP), administers controls over the import of medical devices into the U.S. The CBP imposes its own regulatory requirements on the import of our products, including inspection and possible sanctions for noncompliance. The FDA also administers certain controls over the export of medical devices from the U.S. International sales of our medical devices that have not received FDA approval are subject to FDA export requirements. Many foreign countries to which we export medical devices also subject such medical devices to their own regulatory requirements. Frequently, we obtain regulatory approval for medical devices in foreign countries first because their regulatory approval is faster or simpler than that of the FDA. However, as a general matter, foreign regulatory requirements are becoming increasingly common and more stringent.

          In the European Union, a single regulatory approval process has been created, and approval is represented by the CE Mark. To obtain a CE Mark in the European Union, defined products must meet minimum standards of performance, safety and quality (i.e., the essential requirements) and then comply with one or more of a selection of conformity routes. A notified body assesses the quality management systems of the manufacturer and the product conformity to the essential and other requirements within the medical device directive. Medtronic is subject to inspection by notified bodies for compliance. The competent authorities of the European Union countries, generally in the form of their departments of health, oversee the clinical research for medical devices and are responsible for the products once they are in commercial distribution. We are required to report device failures and injuries potentially related to product use to these authorities in a timely manner. Various penalties exist for non-compliance with the medical device directives.

          To be sold in Japan, most medical devices must undergo thorough safety examinations and demonstrate medical efficacy before they are granted approval, or “shonin.” The Japanese government, through the Ministry of Health, Labour, and Welfare (MHLW), regulates medical devices under the Pharmaceutical Affairs Law (PAL). Oversight for medical devices is conducted with participation by the Pharmaceutical and Medical Devices Agency (PMDA), a quasi government organization performing many of the review functions for MHLW. Penalties for a company’s noncompliance with PAL could be severe, including revocation or suspension of a company’s business license and criminal sanctions. MHLW and PMDA also assess the quality management systems of the manufacturer and the product conformity to the requirements of the Pharmaceutical Affairs Law. Medtronic is subject to inspection for compliance by these agencies.

          The process of obtaining approval to distribute medical products is costly and time-consuming in virtually all of the major markets where we sell medical devices. We cannot assure that any new medical devices we develop will be approved in a timely or cost-effective manner or approved at all.

          Federal and state laws protect the confidentiality of certain patient health information, including patient medical records, and restrict the use and disclosure of patient health information by healthcare providers. In particular, in April 2003, the U.S. Department of Health and Human Services (HHS) published patient privacy rules under the Health Insurance Portability and Accountability Act of 1996 (HIPAA privacy rule) and, in April 2005, published security rules for protected health information. The HIPAA privacy and security rules govern the use, disclosure and security of protected health information by “Covered Entities,” which are healthcare providers that submit electronic claims, health plans and healthcare clearinghouses. In 2009, Congress passed the HITECH Act, which modified certain provisions of the HIPAA privacy and security rules for Covered Entities and their Business Associates (which is anyone that performs a service on behalf of a Covered Entity involving the use or disclosure of protected health information and is not a member of the covered entity’s workforce). These included directing HHS to publish more specific security standards, and increasing breach notification requirements, as well as tightening certain aspects of the privacy rules. In addition, the HITECH Act provided that Business Associates will now be subject to the same security requirements as Covered Entities, and that with regard to both the security and privacy rule, Business Associates will be subject to direct enforcement by HHS, including civil and criminal liability, just as Covered Entities are. In the past, HIPAA has generally affected us indirectly. Medtronic is generally not a Covered Entity, except for a few units such as our Diabetes operating segment and our health insurance plans. Medtronic only operates as a Business Associate to Covered Entities in a limited number of instances. In those cases, the patient data that we receive and analyze may include protected health information. We are committed to maintaining the security and privacy of patients’ health information and believe that we meet the expectations of the HIPAA rules. Some modifications to our systems and policies may be necessary, but the framework is already in place. However, the potential for enforcement action against us is now greater, as HHS can take action directly against Business Associates. Thus, while we believe we are and will be in compliance with all HIPAA standards, there is no guarantee that the government will not disagree. Enforcement actions can be costly and interrupt regular operations of our business. Nonetheless, these new requirements affect only a small portion of our business. We believe the ongoing costs and impacts of assuring compliance with the HIPAA privacy and security rules are not material to our business.

26