The process for disposing of physical data files according to the Certificate of Disposition for CMS Data form includes notifying the CMS Security Officer in writing of the intent to dispose of the files, securing the files against unauthorized access, and destroying the files in a manner that prevents their reconstruction or readability. The Requesting Organization is responsible for documenting the disposal process and retaining a record of the disposal for a period of three years.