§495.350 State Medicaid agency attestations.
(a) The State must provide assurances to HHS that amounts received with respect to sums expended that are attributable to payments to a Medicaid provider for the adoption of EHR are paid directly to such provider, or to an employer or facility to which such provider has assigned payments, without any deduction or rebate.
Make sure you are Omnibus Rule Compliant: HIPAA Privacy Checklist.