(1) In determining the appropriate sanction, including the amount of any civil penalty, the director will consider the level of culpability associated with the violation. The levels of culpability, in the order of less severe to severe, are as follows:

(a) Did not know. The person did not know and by exercising reasonable diligence, would not have known the violation had occurred.

(b) Reasonable cause. The person knew, or by exercising diligence should have known, that the violation had taken place, but the person did not act with willful negligence.

(c) Willful neglect - Corrected. The violation was due to the person's conscious, intentional failure or reckless indifference, and the violation was corrected within thirty days from the date the person knew or with reasonable diligence should have known of the inappropriate disclosure or use.

(d) Willful neglect - Uncorrected. The violation was due to the person's conscious, intentional failure or reckless indifference, and the violation was not corrected within thirty days from the date the person knew or with reasonable diligence should have known of the inappropriate disclosure or use.

(2) The penalty ranges for each level of culpability and the yearly cap for violations of a similar nature are as follows:

(3) Violations that involve malicious intent, as that term is defined in WAC 82-75-030, are not subject to the yearly caps set forth in subsection (2) of this section.

(4) The director may assess a penalty outside the penalty ranges set forth in subsection (2) of this section if the person has previously committed the same violation in the same culpability category.