McKesson

McKesson, as a pharmaceutical distributor, was legally required under the Controlled Substances Act to maintain effective controls against diversion and to report "suspicious orders" to the DEA. In September 2005, DEA officials warned McKesson that its distribution centers were filling suspicious hydrocodone orders from internet pharmacies — online pill mills issuing fake prescriptions. McKesson continued filling those orders. In 2008, the company paid a $13.25 million civil penalty and signed an administrative agreement promising reform. Then it re-offended immediately and continuously through at least 2013. In Colorado alone, McKesson processed more than 1.6 million controlled substance orders from 2008 to 2013, reporting exactly 16 as suspicious — all connected to a single terminated customer. At its Methuen, Massachusetts distribution center, thousands of oxycodone and hydrocodone orders "more than 10 times the average size" of a pharmacy order were processed; zero were reported suspicious. In January 2017, the DEA announced a $150 million civil penalty — its largest ever. Four McKesson distribution centers were required to temporarily suspend controlled substance shipments. In 2022, McKesson agreed to pay $7.4 billion as part of the national opioid distributor settlement, alongside Cardinal Health ($6B) and AmerisourceBergen ($6.1B). Total McKesson payments across three settlements: approximately $7.563 billion. No admission of liability in any settlement. The DOJ declined to bring criminal charges in 2017, to the expressed dismay of DEA agents who had documented the repeat pattern.

• —DEA meeting, September 2005: federal officials explicitly warned McKesson that its distribution centers were shipping suspicious controlled substance volumes to internet pharmacies. McKesson continued.
• —2008 settlement: $13.25 million civil penalty paid to six state attorneys general (FL, MD, CO, TX, UT, CA) for failing to report suspicious hydrocodone orders from three distribution centers. McKesson signed an administrative agreement promising to comply.
• —Re-offense, 2009–2013: The DOJ alleged McKesson immediately re-offended. Colorado: 1.6 million controlled substance orders processed from June 2008 to May 2013; 16 reported suspicious. Methuen MA: thousands of orders 10x average size; zero reported.
• —2017 DEA settlement: $150 million civil penalty — DEA called it the largest settlement in its history. McKesson also agreed to suspend controlled substance shipments at four distribution centers (Colorado, Ohio, Michigan, Florida) for periods of 1–3 years.
• —2022 national opioid settlement: McKesson committed to pay up to $7.4 billion over 18 years, with at least 85% of funds earmarked for state and local opioid remediation. Settlement effective April 2, 2022. 46 of 49 eligible states participated.
• —No admission of liability in any of the three settlements. The DOJ declined to criminally charge McKesson Corporation or any of its executives in 2017. DEA agents publicly expressed frustration at the DOJ's decision.

John Hammergren served as McKesson's sole CEO from 2001 to 2019 — the entire span of the opioid epidemic's peak and the company's documented violations. According to Bloomberg's Pay Index, Hammergren received $781 million in total compensation between 2001 and July 2017. His annual salary in 2013 — the year in which, the DOJ would later allege, McKesson was processing 1.6 million Colorado opioid orders while reporting 16 as suspicious — was $51 million. At retirement, Hammergren held a pension valued at $159 million: the largest CEO pension in the S&P 500. After significant shareholder pressure, he voluntarily reduced the pension to $114 million. He retired on April 1, 2019. No charges were filed.

• —$781 million total compensation, 2001–2017 (Bloomberg Pay Index): salary, bonus, equity awards, perks, and other compensation across 16 years of operation as sole CEO.
• —$51 million in total compensation in 2013 alone — the same year McKesson's Colorado operations were allegedly processing mass suspicious orders without reporting them.
• —$159 million pension: calculated by crediting Hammergren for extra years of service beyond his actual tenure and pay categories that exceeded actual compensation. Bloomberg called it the largest CEO pension in the S&P 500.
• —Pension reduced to $114 million in 2014 after shareholder criticism. Hammergren acknowledged the reduction was voluntary.
• —McKesson announced Hammergren\'s retirement on November 1, 2018. He retired March 31, 2019. Bloomberg: "McKesson CEO to Retire With Corporate America\'s Biggest Pension."
• —Brian Tyler, McKesson's then-president and COO, succeeded Hammergren as CEO effective April 1, 2019. No McKesson executive was charged in connection with the opioid distribution pattern built under Hammergren.

McKesson's pattern — warned by the DEA in 2005, fined in 2008, signed a reform agreement, immediately re-offended through at least 2013, fined again at record level in 2017 — represents exactly the kind of repeat conduct that criminal law is designed to address. The DOJ declined to bring criminal charges against McKesson Corporation at the time of the 2017 settlement. Individual executives, including Hammergren, faced no criminal investigation. The company paid $150 million and continued operating. Three years later, the company's opioid liability was $7.9 billion. The $150 million fine in 2017 represented approximately one week of McKesson's annual revenue of approximately $8 billion (pharmaceutical distribution segment). DEA agents expressed public frustration at the DOJ's decision not to pursue criminal charges. The company's response to the pattern: continued civil settlements without admission of liability.

• —DEA agents expressed public dismay that the DOJ declined to criminally charge McKesson in 2017, despite a documented repeat pattern following a prior settlement and explicit prior warning.
• —Criminal exposure under the Controlled Substances Act: distributors who knowingly distribute controlled substances outside the normal course of professional practice face criminal felony charges. McKesson's pattern of documented non-reporting was the evidence base.
• —$150 million civil penalty in 2017 vs. McKesson's 2017 revenue: ~$198 billion. The fine was approximately 0.076% of annual revenue — effectively a cost of doing business.
• —No individual executive criminally charged. Hammergren was CEO throughout the violations documented in the 2017 settlement (2009–2013). He retired in 2019 with full pension.
• —Repeat civil penalty model: McKesson paid, promised reform, re-offended, paid more, promised reform again. The national settlement in 2022 ($7.4B over 18 years) contains no admission of liability and no individual accountability.