42 C.F.R. § 456.3

The Medicaid agency must implement a statewide surveillance and utilization control program that—

(a) Safeguards against unnecessary or inappropriate use of Medicaid services and against excess payments;

(b) Assesses the quality of those services;

(c) Provides for the control of the utilization of all services provided under the plan in accordance with subpart B of this part; and

(d) Provides for the control of the utilization of inpatient services in accordance with subparts C through I of this part.