O365 has this built-in. Check Exact Data Match (EDM), and Data Loss Prevention (DLP).
You define what makes a document HIPAA restricted (EDM) (or for any other other reason if you wish, it does not have to be a HIPAA issue), and then you create a rule about how any document meeting that EDM can be viewed or distributed (DLP).
In a nut shell; Let's say you have documents with Social Security numbers, you create an EDM to identify SS #s in documents (this happens as you access them) and it flags them as having met the criteria for one of your EDM rules.
Then, your DLP rule can, for example, only allow the document to travel through email within your domain, or within a group (department, C level employees, etc). It can disallow the document from being downloaded or printed, etc.....
Have a look here: https://docs.microsoft.com/en-us/microsoft-365/compliance/create-custom-sensitive-information-types-with-exact-data-match-based-classification?view=o365-worldwide