Records may be disclosed to State agencies or other entities acting pursuant to a contract with CMS, for fraud and abuse control efforts, to the extent required by law or under an agreement between IHS and respective State Medicaid agency or other entities.