It viewed the first two of these failures as attributable to reasonable cause. New limits cap penalties for matters arising from reasonable cause at $100,000 per year. As a result, most of the civil monetary penalty in this case is attributable to the health system's failure to provide OCR with timely and accurate notice of a breach caused by a loss of paper records. OCR viewed this failure as one of willful neglect; penalties were capped at $1.5 million even though this violation was seen as lasting only 31 days. The materials published by OCR serve as a warning about issues that might arise, especially as it relates to implementation of policies designed to prevent and detect HIPAA violations. They also show OCR is prepared to both impose significant civil monetary penalties and temper the amount of those penalties, even in situations that do not involve a formal settlement agreement.