So, the hdparm --security-erase will work on an HDD, but how it wipes is left up entirely to the hard drive manfuacturer. Most of them will just zero out your drive once and call it good and some forensic specialists will be able to recover data from that (but only the ones that charge, like, $900/hour or are on government payroll). If your drive supports drive-level encryption, then regardless of it being an SSD or HDD, then this is the best way to go, as it'll just wipe the key and none of the data will be recoverable.
After the erase, the password is gone so no worries there. It's a good idea to set the password because a lot of firmwares/bioses will freeze the drive security settings after boot without one (Lenovo, Dell, HP to name a few). If you get an I/O error running hdparm commands, then do hdparm -I and look for the text " frozen" which means your bios is freezing that functionality on the hard drive immediately after boot.