The State Medicaid agency—

(a) Must conduct pre-enrollment and post-enrollment site visits of providers who are designated as “moderate” or “high” categorical risks to the Medicaid program. The purpose of the site visit will be to verify that the information submitted to the State Medicaid agency is accurate and to determine compliance with Federal and State enrollment requirements.

(b) Must require any enrolled provider to permit CMS, its agents, its designated contractors, or the State Medicaid agency to conduct unannounced on-site inspections of any and all provider locations.