The State or alternate participant shall comply with the provisions for confidentiality of information, including the security of systems, and records requirements described in 20 CFR part 401 and pertinent written guidelines (see Sec. 404.2123).