If data was only accessed through CMS systems and no physical files were received by the Requesting Organization, the Certificate of Disposition for CMS Data form should still be completed. The Requesting Organization should document the disposal of the data by providing a description of the data and the date it was removed from the CMS systems. The CMS Security Officer should be notified in writing of the disposal.