The Medicaid agency must have authority to implement and enforce the provisions specified in this subpart for safeguarding information about applicants and beneficiaries.