When the department notifies a recipient that its subrecipient is ineligible to receive protected personal information, the recipient must immediately:

(1) Terminate the subrecipient's access to protected personal information; and

(2) Require the subrecipient destroy all protected personal information it obtained through the recipient.