They can be! You can build HIPAA compliant apps with Expo if you follow the requirements.
Expo doesn't collect any individually identifiable health data, and you can actually see all the data that Expo collects on our privacy explained page. That being said, you are ultimately in control of the data you collect from your users, so we cannot guarantee that all apps built with Expo are HIPAA compliant, as in the end it is up to you as an individual application developer. But there should be no compliance issues with using Expo.
For more information about HIPAA compliance, you can consult the HHS website about it.