The Secretary may make a grant under section
300x or
300x–21 of this title only if the State involved has in effect a system to protect from inappropriate disclosure patient records maintained by the State in connection with an activity funded under the program involved or by any entity which is receiving amounts from the grant.