For some reason, the text under https://www.projectbaseline.com/faq/ is different than that on the COVID-19 page. The FAQ page does explicitly mention HIPAA compliance
Because despite using the Project Baseline webpage, the Verily COVID-19 effort is distinct from Project Baseline and operates under different processes, probably.