It looks like the maximum penalty (if corrected within 30 days) is about $450,000 as of 2022.

However, there is apparently an addendum to the law that the State Attorney General is authorized to impose civil penalties in addition to this.

As we see, Anthem settled for $115,000,000 for a similar breach.

So, yeah, unless Cerebral gets a very lenient AG, they're done.

https://www.hipaajournal.com/court-approves-anthem-115-milli...

https://www.hipaajournal.com/what-is-the-maximum-penalty-for...