Here is Google's information on the subject: https://cloud.google.com/security/compliance/hipaa/ (note that the Google Vision API is listed as a covered service, so it's approved for use under a BAA)

Obviously I don't have a copy of the contract between Google and Oscar, but I think it's profoundly unlikely that they would write a blog post about something that would be the end of their company without the "simple" (and industry standard) step of signing a BAA with a vendor.