How does HIPAA outline the storage of "active" physical patient chart files? (not electronic)?

During regular business hours, can charts sit on open shelving (behind a reception station) and be considered compliant? Understanding that after-hours they are to be locked, how locked do they need to be? (locked cabinets behind locked doors?, etc). Is there an easy-to-follow guideline available?