...Google definitely understands how HIPAA works. GCP and G Suite both have HIPAA compliance to varying degrees. I don't think that person had any chance of getting clearance to do that from the G side, less your side.
Collecting patient health records starts bringing the HIPAA Privacy Rule into play, which they have zero experience with.
Looking at how Google is handling the GDPR, for example, there's just as well plenty obvious violations that someone had to sign off on and that are gonna cost them a few billions once they can't drag the lawsuits out any longer. In the meantime, though, they're very likely making enough money to offset that, which is why executives can sign off on illegal things in the first place. It's just a basic risk analysis in the end.