The preamble stated that the type of sanction applied would vary depending on factors such as the severity of the violation, whether the violation was
intentional or unintentional,
and whether the violation indicated a pattern or practice of improper
use or
disclosure of protected health information.