Hacker News Reader

What about Google employees looking for damaging data on adversaries? Or stalkers, looking for information on particular individuals without consent.

Why does Google get PII?

To take your argument to its conclusion, what if someone at Ascension wanted damaging information on one of its patients?

They'd be legally liable. Same as those they sign BAA with.

Those are both illegal as well, and the employees who did that would be held personally liable.