You absolutely could build such a tool and I have seen HIPAA authorized model sandboxes that do definitely exist. However, most off the shelf note-takers would not so qualify and it's a minefield to build one with out of domain third party resources.

I think it's fair to say the non-technical public has been repeatedly burned by AI companies selling something different from what they're advertising and it's fair to be skeptical as a layperson about your ability to tell a properly HIPAA compliant tool from a non-HIPAA compliant tool.

They are, and already exist.