In addition to the culpability category set forth in WAC 182-70-635, to determine the penalty amount, the director may consider the following factors:

(1) The nature and extent of the violation including, but not limited to, the number of persons affected, the duration of the violation, and whether the violation was done with malicious intent.

(2) The nature and extent of the harm resulting from the violation including, but not limited to:

(a) Whether the violation resulted in physical harm;

(b) Whether the violation resulted in financial harm;

(c) Whether the violation resulted in harm to a person's reputation;

(d) Whether the violation hindered an individual's ability to obtain health care;

(e) Whether the violation resulted in any other actual or potential harm.

(3) The history of compliance with the statutory, regulatory, and contractual provisions related to prior data release from the WA-APCD including, but not limited to:

(a) Whether the current violation is the same or similar to previous noncompliance;

(b) Whether and to what extent the person has attempted to correct previous noncompliance;

(c) How the person has responded to the complaint, investigation and any assistance provided to correct and mitigate any effect from the violation;

(d) How the person has responded to prior complaints for the same or similar violations including, but not limited to, changes in process or procedures for securing the confidentiality of the protected information, changes in recruitment, retention, or training requirements for employees or contractor with access to protected information.

(4) Any other factor relevant to the violation or the impact of the violation including, but not limited to:

(a) The frequency of incidents and/or duration of the wrongdoing;

(b) Whether there is a pattern or prior history of wrongdoing;

(c) Whether the person has accepted responsibility for the wrongdoing and recognizes the seriousness of violation;

(d) Whether the person paid or agreed to pay any criminal, civil, and administrative liabilities for the improper activity, including any investigative or administrative costs incurred by the government, and has made or agreed to make full restitution;

(e) Whether the person has cooperated fully during the investigation and any administrative action. In determining the extent of cooperation, the director may consider when the cooperation began and whether the person disclosed all known pertinent information;

(f) The kind of positions held by the individuals involved in the wrongdoing;

(g) Whether the person fully investigated the circumstances surrounding the violation and, if so, made the result of the investigation available to the reviewing official, and took appropriate corrective action or remedial measures;

(h) Whether effective standards of conduct and internal control systems were in place at the time the violation occurred;

(i) Whether appropriate disciplinary action was taken against the individuals responsible for the activity that constitutes the violation.