45 CFR §160.408

1. (a)The nature and extent of the violation, consideration of which may include but is not limited to:
   1. (1)The number of individuals affected; and
   2. (2)The time period during which the violation occurred;
2. (b)The nature and extent of the harm resulting from the violation, consideration of which may include but is not limited to:
   1. (1)Whether the violation caused physical harm;
   2. (2)Whether the violation resulted in financial harm;
   3. (3)Whether the violation resulted in harm to an individual's reputation; and
   4. (4)Whether the violation hindered an individual's ability to obtain health care;
3. (c)The history of prior compliance with the administrative simplification provisions, including violations, by the covered entity or business associate, consideration of which may include but is not limited to:
   1. (1)Whether the current violation is the same or similar to previous indications of noncompliance;
   2. (2)Whether and to what extent the covered entity or business associate has attempted to correct previous indications of noncompliance;
   3. (3)How the covered entity or business associate has responded to technical assistance from the Secretary provided in the context of a compliance effort; and
   4. (4)How the covered entity or business associate has responded to prior complaints;
4. (d)The financial condition of the covered entity or business associate, consideration of which may include but is not limited to:
   1. (1)Whether the covered entity or business associate had financial difficulties that affected its ability to comply;
   2. (2)Whether the imposition of a civil money penalty would jeopardize the ability of the covered entity or business associate to continue to provide, or to pay for, health care; and
   3. (3)The size of the covered entity or business associate; and
5. (e)Such other matters as justice may require.