While it's not sure what Google is doing here, I can tell what most companies in the healthcare data space do when dealing with data like this - they use an external vendor to essentially encrypt the "personally identifiable data" (mame, exact dob, etc) into some hash tokens before the data hits their servers from the partners. This would mean the data is still tied to a patient but not easily identifiable (at least some orgs would run reidentification risk analyses based on the types of data available within the org). It would also mean that an org like Google can (assuming it chooses to) still work with healthcare data without explicitly tying it to all their other data in a legally compliant manner.
Maybe a HIPAA expert can chime in but I'm reasonably sure it will be a violation to show you ads on your devices based on your personal healthcare data that Google obtained without your explicit consent. It might however be legal if Google uses all the patients healthcare data to train a model that it can use on all users, though.