You need to encrypt each note with its own secret key. You should use a new symmetric key for each note. This symmetric key is called the session key.
Now the problem becomes how to distribute the session key to the recipients and only to the recipients. For this, you need public key cryptography.
You should issue each participant in the system (patients and doctors) his/her own personal keypair. The public key may be stored on the server unencrypted, but the private key should not be stored on the server unencrypted. You should either encrypt the private key on the server using the user's password, or the users should be required to store their private key securely for themselves.
A patient can send a private message to a particular doctor by generating a new session key and encrypting a message with it, then encrypting the session key with the doctor's public key. You can also send a message to multiple recipients by encrypting the session key against multiple public keys.
Optionally, you may want to have a Certificate Authority that checks a participant's identity (e.g. by requiring a photo ID) and signs the participant's public key to assert that the identity check had been done, and attach signed attributes that asserts the participant's role(s).
At this point, you have a mechanism for point to point encryption, these are essentially how S/MIME and PGP scheme works.
You can build a group messaging on top of this, so that patients and/or doctors can send a message to a large group (e.g. a patient can send encrypted message to the podiatrist group, without allowing the dental group to read the message), without anyone having to know the individual member's identity. This is called multi-cast encryption.
The way you build group messaging is that you need to create a group keypair. A group keypair consists of a private key that's distributed to all members of the group and a public key that's distributed to anyone who needs to send messages to the group. This allow members and non members to send a message to everyone on that group only. To send a group message, you encrypt the session key for that message with the group's public key.
Note that in most cases, you'll need to create a new group key every time the membership of a group changes (e.g. someone leaves the group, or a new person entered the group.)