Are we required to change the locks on our office door when an employee leaves? Our paper charts are not locked in a particular area at night. Often, they are on the various physicians' desks awaiting review.

There is no requirement that you change the locks - just that you've made the data physically secure in some manner. In any case, your paper charts are not an issue as far as HIPAA security is concerned. It's only about electronic data. If access to computerized data is secure (passwords, user tracking, etc.) you'd be fine as far as the letter of the Security Rule goes. Still, given the increased scrutiny in this area, why not insist on better security? Lock the physician office doors and the chart room door with locks that are changed only if their owner (the physicians themselves) leaves the practice. Or, install an electronic security system that makes it easy to change the pass code.