What is the risk of using a static symmetric key for encryption vs a session key that changes each time?
Flexible access control: A big reason to use session keys is that it is easier to adjust your access control. It seems to me that the access for the files is not different. As long as that remains the case there is no direct need to use different keys to protect the data. However, with session keys you can make a different access control scheme without having to re-encrypt your data.
Access to the keys: remember that key management has a lot to do with the accessibility. It doesn't make much sense to use multiple keys if they are evenly vulnerable to attacks. However, patient information can get relatively large. It might be feasible to protect the master key better than the session keys that are required to decrypt large amounts of data.
Limitations of modes of operations and IV's: Modes of operation such as CBC do have limitations. If you would be encrypting large amounts of data then you might get into trouble in case the input of the block cipher repeats, as it would generate the same ciphertext block, and that would leak information to an adversary.
Forward secrecy: You already mentioned forward security, where the leakage of a session key doesn't compromise the confidentiality of data encrypted with other session keys.
What you could do is to encrypt the session keys with the master key. This may not feel more secure, but it does allow you keep the master key safe, possibly in a more secure system or device.
Another option that you could use is to use a key derivation function or KDF that derives session keys from the master key. That way the limitations of the mode of operation can be diminished. You may also use any kind of information rather than to use a specific IV. A KDF also solves the problem of the forward secrecy as you cannot derive the master or any of the other keys given a session key. This way you don't have to store any session keys; you don't however get the same flexibility as wrapping (encrypting) session keys.
How good/bad is this setup in general? Any other problems I am overlooking in this setup?
That's a very broad question. I would not consider OpenPGP. Not so much because the protocol is bad, but it simply hasn't designed for this kind of operation. Furthermore, it is a rather old protocol which hasn't been updated to support the latest / greatest algorithms. More importantly, I don't thing the PGP method of distributing keys does justice to a rather hierarchical setup used mainly at hospitals. X.509 may make a lot more sense.
RSA 2048 is not considered all that secure anymore, giving a security strength of about 112 bits. See keylength.com to see some comparable key strengths. Using it together with AES-256 gives you and your users a false sense of security. You may have to go for Elliptic Curve crypto and preferably an asymmetric Post Quantum Crypto algorithm to provide 256 bits of security. This may require long term security, after all.
With regards to algorithms, I think you should learn about new modes of operation such as AEAD modes of operation. Using AES-CBC is fraught with dangers; I would not consider CBC mode best of breed anymore.