HIPAA compliance has many loopholes. Providers and carriers (insurance) are bound by them, but random private companies are not generally. Most covered entities are going to insist anyone they share data with also be compliant, but it's not necessarily a requirement. Not to say it's trivial, either, but it's not exactly a huge challenge to get 100M annotated anything, really.

HIPAA is about not identifying the patient. It doesn't say you can't take 100M mammograms, wipe out the PII, and add "this image is of a patient that disease X". I'm not sure how much other demographically interesting metadata you can add, like age, gender, height/weight, etc.

There are efforts like the UK Biobank but healthcare institutions are very sensitive about their patient data.