Agreed. The key point I was attempting to make is that a BAA allows orgs to share data legally. AFAIK Google hasn't violated any privacy with this project and indeed they would be in violation if they did.