I was under the impression that HIPAA applies to anyone in possession of private healthcare information (medical information tied to personally identifiable information)
It doesn't appear to be as broad as you (and I) imagined. Google might qualify as a "Health Care Clearinghouse" in this case, but it's far from clear.
Protected Health Information is protected under HIPAA for both covered entities and business associates alike. Otherwise, HIPAA would be pointless if covered entities could just pass the PHI to business associates or shell companies unfettered.
Note: I would not consider myself a "HIPAA expert", but I'm a clinical researcher that has to ensure HIPAA compliance for my lab.