Purge Org Data

Destroy every row of PHI this organization holds with us. Owner only.

This is the "return or destroy" duty a business associate owes at termination (§164.504(e)(2)(ii)(J)), exercised by the customer's own owner. It is deliberately not a "delete the organization" call: the org, its people, its API keys, its billing history and the three ledgers (audit_logs, phi_access_log, data_purge_records) survive, so the customer can still read the accounting of disclosures and the proof that this purge happened. What goes is listed in app.core.phi_purge.ORG_PURGE_TABLE_ORDER.

Fail-closed: the deletes and the purge record share one transaction. Any failure rolls the whole thing back and the request is retryable. On success the org's PHI activation is revoked (phi_access_approved_at = NULL) so no new PHI lands until it is deliberately re-onboarded.