(a) The Department may impose an administrative penalty upon a health care facility if the Department determines that the health care facility has committed a breach of a patient's medical information. The penalty assessed for any violation in accordance with this article, including penalty adjustment factors, shall not exceed the maximum penalty specified in Health and Safety Code section 1280.15.

(b) When the Department has determined that an administrative penalty for a breach of a patient's medical information is warranted, the base penalty amount is $15,000 for each violation, subject to the penalty adjustment factors provided in section 79904.

(c) For each subsequent occurrence of a breach of a patient's medical information relating to a particular reported event, the Department may assess an administrative penalty in an amount equal to 70% of the initial violation's final penalty amount. The administrative penalty for the subsequent occurrence shall be subject to the penalty adjustment factors pursuant to section 79904, if applicable, not to exceed the statutory maximum of $17,500 per subsequent occurrence.