The OCR determines the nature of the penalty based on the severity and intent behind the violation. Civil penalties are typically imposed for violations arising from negligence, whereas criminal penalties are reserved for deliberate and wrongful disclosures or access to PHI. In cases where criminal intent is evident, the OCR refers the matter to the Department of Justice for prosecution.