Although the Office for Civil Rights prefers to resolve HIPAA violations with corrective action when no data breach has occurred, the agency has recently cracked down on Covered Entities that fail to provide patients with access to their PHI within the 60 days allowed. In November 2020, the University of Cincinnati was fined $65,000 for the failure to provide timely access to patient records. This was the twelfth financial penalty in 2020 for right of access failures.