The Medicaid agency must implement a statewide surveillance and utilization control program that-
42 C.F.R. §456.3