A chain of custody is only as good as the record behind it. Yours shows when custody was taken and by whom, every handoff after that, and when and how the material was destroyed. For hard drives and devices, each item is listed by serial number, so you can match the record against your asset register.
On site, the chain is short: material is destroyed at your premises, witnessed if you want it. Off site, it is collected in locked containers and the record covers every step until destruction. Both close with a certificate of destruction.
That record is what an auditor, a regulator or your own security team will ask for. For the rules that require it, see HIPAA and compliance.