A defensible Certificate of Data Destruction template for any organisation that creates, receives, maintains, or transmits electronic protected health information (ePHI), including UK and global enterprises handling US patient data.
Built to satisfy the HHS Office for Civil Rights. Aligned to the HIPAA Security Rule (45 CFR 164.310(d)(2)) and NIST SP 800-88 Rev. 2, effective September 2025. Includes both a per-device certificate and a batch certificate with a serial-level log, because a batch header with no serial numbers is not adequate evidence under OCR scrutiny.
Inside the 20 pages: the legal basis with every relevant 45 CFR citation; the Business Associate Agreement precondition that turns a transfer into a reportable disclosure if skipped; a Clear, Purge, Destroy decision matrix mapped to each media type, including the SSD wear-levelling trap and the photocopier drive failure that cost Affinity Health Plan $1,215,780; the 12 fields a certificate must contain to hold up; completion guidance; the six-year retention rule; and a HIPAA disposal checklist with mandatory and good-practice flags.
Free and customisable. Everything in square brackets is a field you complete.