In theory, you're fine loading stylesheets and fonts from a third party - as you say, they're included in link tags, which shouldn't allow script execution. There are a few things which might cause information leakage though, and a potential for a targeted attack resulting in data appearing to change.
In terms of information leakage, browsers by default send a referer header when loading a resource. This will be sent to the font provider, and, if your links are structured in a way where you're attempting to use length or unknown values in the URL as a protection method, the font provider would be able to bypass that. If you're performing session checks, though, as most websites with authenticated sections in do, the third party shouldn't get the authentication tokens (usually cookies). Given that you're working in a sensitive industry, I'd hope this wasn't the case.
In terms of data appearing to change, a malicious font provider could supply fonts which are mapped incorrectly. Imagine if they supplied icons in a font, and you're using either a tick or a cross to indicate, for example, whether a blood sample was found to have a specific disease. By mapping the "tick" symbol to the "cross" value, and vice versa, an end user might think they've got some disease due to seeing this in the output. This would be a very targeted attack, so would probably only apply in very specific cases. This is unlikely to happen with Google Fonts, but could apply if you allowed linking to arbitrary web fonts.
Note that it would be possible for any stylesheet to perform similar attacks - for sensitive data, it's generally worth keeping anything that can modify the behaviour or appearance of the application hosted locally, unless you have specific requirements making this impossible.
For sensitive data, I'd advise hosting the fonts (and any other stylesheets and scripts) yourself, if possible, just for peace of mind.