delivered the Opinion of the Court.
11 Petitioner-Defendant Cedar Springs Hospital, Inc. ("Cedar Springs") petitioned this Court under C.A.R. 21 to issue a rule to show cause challenging the trial court's order that it produce materials related to quality management. In the underlying medical malpractice case, Respondent-Plaintiff Scott R. Simpson ("Simpson") sought to obtain the minutes from meetings of two Cedar Springs quality management committees. Cedar Springs refused to produce these documents, asserting that they were protected by the quality management privilege set forth in section 25-3-109, C.R.S. (2014). This privilege covers "records, reports, or other information of a licensed or certified health care facility that are part of a quality management program." § 25-8-109(8) (emphasis added). Section 25-3-109(2) defines "quality management program" as one that is "approved by" the Colorado Department of Pub-He Health and Environment ("CDPHE").
T2 Before the trial court, Simpson argued that Cedar Springs failed to show that its quality management program was "approved by" CDPHE because it failed to show that its program complied with all CDPHE regulations. In particular, Simpson pointed to a letter from CDPHE stating that Cedar Springs' quality management plan "has been approved," and adding "[please submit a schedule for implementation of the plan within 90 days." A CDPHE regulation requires facilities to submit "a schedule for [quality management] plan implementation" within 90 days of receiving written notice that its plan has been approved. 6 Code Colo. Regs. 1011-1:1I-8.1.1(9) (2014). According to Simpson, because Cedar Springs failed to produce evidence that it submitted such an implementation schedule in response to the letter, its program could not be deemed "approved."
13 Cedar Springs responded that because a quality management program is required to maintain a CDPHE license, and because Cedar Springs was licensed by CDPHE throughout all relevant periods, its quality management program was necessarily approved by CDPHE.
T4 The trial court agreed with Simpson, reasoning that licensure was insufficient to demonstrate that facilities "complied with what they are required to comply with," and stating that such facilities should have "authoritative" documentation "immediately in place" confirming that their quality management plans were properly implemented.
15 We now make our rule absolute. Under the trial court's rationale, every privilege determination would entail a top-down compliance review of the facility claiming the privilege. The statutory scheme, however, tasks CDPHE-not the trial court-with ensuring that a licensed facility's quality management complies with applicable CDPHE regulations. Moreover, the trial court's reasoning misperceives the purpose of the quality management privilege, which is to promote frank and honest discussion about quality management, not to act as a backstop for regulatory compliance. We hold that because a quality management program is required in order to be licensed by CDPHE, and because Cedar Springs was licensed by CDPHE during all relevant periods, its quality management program is nee-essarily "approved" by CDPHE. Therefore, the documents here were created as part of a quality management program approved by CDPHE and are protected by the quality management privilege. Accordingly, we conclude that the trial court erred in ordering that they be produced.
*182I.
T6 In 2008, Simpson sought treatment at Cedar Springs for depression, anxiety, and panic attacks. He was given a course of treatment and administered various medications. Simpson alleges that these medications resulted in complications including a toxic aequired brain injury, temporal lobe brain epilepsy, vestibular damage, and central nervous system damage. Simpson brought a medical malpractice suit against Cedar Springs and psychiatrists Dr. Roger Pumphrey and Dr. Charles Peck,1 alleging that they negligently prescribed inappropriate medications, inadequately monitored him, and failed to take corrective action when he had negative reactions.
T 7 Initial depositions included that of Jodi Mattson, Cedar Springs' Director of Nursing. She testified that the Pharmacy and Thera-peuties Committee and the Performance Improvement Committee maintained minutes of their meetings and their review of adverse drug reactions. After Mattson's deposition, Simpson served a request for production on Cedar Springs, asking for "a copy of [the Pharmacy and Therapeutics Committee's and the Performance Improvement Committee's] minutes from January 1, 2008 to present, as well as any such document[s] in any way pertaining to Seott Simpson."
T8 Cedar Springs responded to this request by stating that the information was subject to the quality management privilege pursuant to section 25-8-109, which makes privileged records, reports, or other information of a licensed health care facility that are part of a CDPHE-approved quality management program. Cedar Springs argued that because it was licensed by CDPHE, its quality management program was necessarily approved by CDPHE. It was undisputed that Cedar Springs was initially licensed, and that its license was repeatedly renewed throughout the period relevant to this case.
T9 Cedar Springs also produced a privilege log and a supplemental privilege log providing details about the requested documents. The supplemental privilege log stated,
[the meetings] were conducted pursuant to a Performance Improvement Plan ... as part of Cedar Springs' quality management program as identified in the Performance Improvement Plan. Cedar Springs is approved by [CDPHE]. Accordingly, the actions of the Committee, particularly as reflected in the minutes of meetings conducted as part of a Performance Improvement Plan, are privileged.
Simpson filed a motion seeking in camera review and production of seventeen sets of minutes from the supplemental privilege log. Simpson argued that the minutes were discoverable because, in order for a quality management program to be deemed "approved" by CDPHE, a facility had to demonstrate that its quality management program was in compliance with all applicable CDPHE regulations. In particular, Simpson argued that the quality management program was not in compliance with 6 Code Colo. Regs. 1011-1:II-8.1.1(9), which requires a facility to submit to CDPHE "a schedule for [quality management] plan implementation not to exceed 90 days after the date the facility receives written notice of [CDPHE's] approval of the plan."
1 11 Cedar Springs produced a letter from CDPHE dated October 14, 2008, stating that "your [quality management] plan has been approved. Please submit a schedule for implementation of the plan within 90 days of commencing operation." Simpson argued that because Cedar Springs had produced no evidence that it had submitted an implementation schedule within 90 days, the quality management program could not be deemed "approved."
12 In addition, Simpson argued that Cedar Springs was not in compliance with another CDPHE regulation requiring that it submit to CDPHE "a description of" a "permanent and substantive change in its quality management plan." 6 Code Colo. Regs. 1011-1:I1I-8.1.4. Simpson argued that Cedar Springs made such a change in 2008 and *183failed to produce evidence that it had submitted the change to CDPHE.
13 The trial court agreed with Simpson with regard to the implementation plan and ordered that the documents be produced for in camera review. The court stated that it was "not convinced that just because the facility is reissued a license, it demonstrates that they have necessarily complied with what they are required to comply with in order to ensure that their quality management program maintains a certain privilege." The court also stated that it was denying the privilege in this case in order to encourage facilities such as Cedar Springs to have "authoritative" documentation "immediately in place" confirming that their quality management plans are properly implemented. The trial court did not address Simpson's alternative argument regarding Cedar Springs' alleged failure to submit to CDPHE changes it made to the plan in 2008.
T 14 This C.AR. 21 proceeding followed.
IL
115 This case requires us to determine whether the documents sought by Simpson are covered by the quality management privilege as defined by section 25-3-109. Questions of privilege are particularly appropriate for review under C.A.R. 21 because an erroneous disclosure of privileged information may cause harm that cannot be remedied on appeal. Ortega v. Colo. Permanente Med. Grp., P.C., 265 P.3d 444, 447 (Colo. 2011). Because this case requires us to interpret the statutory definition of "quality management program," we employ a de novo standard of review. Smith v. Exec. Custom Homes, Inc., 230 P.3d 1186, 1189 (Colo. 2010).
116 The quality management privilege is governed by section 25-3-109, entitled "Quality management functions-confidentiality and immunity." According to the legislature, "the implementation of quality management functions to evaluate and improve patient and resident care is essential to the operation of health care facilities licensed or certified by the" CDPHE. § 25-3-109(1). The legislature has further declared that, given the importance of quality management, "it is nee-essary that the collection of information and data by such licensed or certified health care facilities be reasonably unfettered so a complete and thorough evaluation and improvement of the quality of patient and resident care can be accomplished." Id. To this end, the legislature has deemed "confidential" any "records, reports, or other information of a licensed or certified health care facility that are part of a quality management program." § 25-38-1098). Such information "shall not be subject to subpoena or discoverable or admissible as evidence in any civil or administrative proceeding." § 25-3-109(4). In other words, it is covered by the quality management privilege.
¶ 17 Breaking down the statutory requirements, the quality management privilege applies to (1) "records, reports, or other information" (2) of a "licensed or certified health care facility" (@@) that are "part of" (4) a "quality management program." § 25-8-1098). No one disputes that the documents sought by Simpson-that is, minutes of meetings of the Pharmacy and Therapeutics Committee and the Performance Improvement Committee-are "records, reports, or other information." Nor does anyone dispute that they are records of a "licensed or certified health care facility," that is, Cedar Springs. Finally, no one disputes that the records were created as "part of" Cedar Springs' quality management program.2 The only *184question in this case is whether Cedar Springs' program meets the statutory definition of "quality management program," which is one that has been approved by CDPHE.
1 18 Section 25-8-109(2) defines a "quality management program" as
a program which includes quality assurance and risk management activities, the peer review of licensed heath care professionals not otherwise provided for [in another statutory provision], and other quality management functions which are described by a facility in a quality management program approved by the department of public health and environment.
(Emphasis added.)3 This definition of a quality management program is somewhat circular, defining such a program in relation to the functions of such a program as described by the facility. The definition does, however, provide an additional guidance-namely, that the quality management program to which the privilege applies is one that is "approved by" CDPHE.
119 Cedar Springs argues that because a quality management program is required to maintain a CDPHE license, and because Cedar Springs was licensed by CDPHE throughout all relevant periods, its quality management program is necessarily "approved" by CDPHE. In contrast, Simpson argues, and the trial court held, that licensure is not sufficient to show that a program has been "approved." We agree with Cedar Springs, and hold that if a facility is licensed by CDPHE, its quality management program is an "approved" program under the statutory definition.
120 CDPHE regulations require that all licensed facilities "establish a quality management program ... that complies with" an extensive list of requirements. 6 Code Colo. Regs. 1011-1:II-8.1. CDPHE oversees this regulatory compliance through regular fitness reviews. 10ll-1:II-28.1 (CDPHE "shall review [a facility's] fitness to conduct or maintain a licensed operation"). As part of these fitness reviews, CDPHE "shall determine by on-site inspection or other appropriate investigation [the facility's] compliance with applicable statutes and regulations." Id.; see also 1011-1:II-2.11.1 ("The Department ... shall have the right to enter upon and into the premises of any licensee or applicant for a license in order to determine the state of compliance with the law and regulations. ..."). Particularly relevant to this case, fitness reviews include consideration of the facility's "quality improvement plans, other quality improvement documentation as may be appropriate, and acereditation reports." 1011-l:II-2.8.1(E). If for some reason CDPHE determines that a licensed facility's quality management program is not in compliance with applicable regulations, it has broad discretion in taking action against the facility. 1011-1:11-2.9.8 ("A license issued by the Department may be revoked, suspended, annulled, limited, or modified at any time during the license term because of a licensee's failure to comply with any of the applicable statutes or regulations. ..."). Therefore, under CDPHE regulations, a facility may maintain its license only if it has established a quality management program approved by CDPHE.
121 As applied here, there is no dispute that Cedar Springs has maintained a CDPHE license at all relevant times. Its quality management program was therefore approved by CDPHE, and the documents sought by Simpson that were produced as part of that program are privileged.4
*185{22 In arguing that licensure is not sufficient to demonstrate CDPHE approval, Simpson contends that Cedar Springs' privilege claim must fail because it has not demonstrated that its quality management program is in compliance with all CDPHE regulations. In particular, Simpson points to a regulation requiring facilities to submit "a schedule for [quality management program] plan implementation" within 90 days of receiving written notice that its plan has been approved. 6 Code Colo, Regs. 1011-1:1I-3.1.1(9). Simpson relies upon a 2003 letter from CDPHE stating that Cedar Springs' quality management plan "has been approved," and adding "[pllease submit a schedule for implementation of the plan within 90 days." According to Simpson, because Cedar Springs failed to produce evidence that it submitted such an implementation schedule in response to the letter, its program cannot be deemed "approved" under the statutory definition.
123 We disagree with Simpson's argument, as well as the trial court's rationale adopting it, for two reasons. First, as made clear by the regulatory regime discussed above, CDPHE-not the trial court-is the entity tasked with ensuring that a licensed facility's quality management program complies with applicable regulations. Indeed, we find nothing in the privilege statute or regulations to suggest that the trial court must find that a facility is in compliance with all CDPHE regulations in order for the quality management privilege to attach. On the contrary, the privilege attaches to "records, reports, or other information of a licensed or certified health care facility that are part of a quality management program" that has been "approved by [CDPHE]." § 25-3-109(2)-@B) {emphasis added). Under Simpson's argument and the trial court's rationale, every privilege determination would entail a top-down compliance review of the facility claiming the privilege. We do not believe such a review is contemplated or permitted by the statutory scheme.
124 On a similar note, Simpson's argument mispereeives the purpose of the quality management privilege. The legislature ree-ognized the privilege because, as noted above, "it is necessary that the collection of information and data by such licensed or certified health care facilities be reasonably unfettered so a complete and thorough evaluation and improvement of the quality of patient and resident care can be accomplished." § 25-8-109(1). In other words, quality management teams must be able to speak openly and honestly about the quality of services delivered in order for those services to be improved. There is nothing in the statutory scheme to suggest that a privilege determination should be used as a backstop for regulatory compliance. Indeed, the privilege is designed to encourage frank and open discussion about quality management, not to punish a facility for failure to have approval documentation "immediately in place," as suggested by the trial court.
25 Simpson also contends that the privilege cannot attach in this case because Cedar Springs failed to show that its quality management program was in compliance with another CDPHE regulation requiring that it submit to CDPHE "a description of" a "permanent and substantive change in its quality management plan." 6 Code Colo. Regs. 1011-1:1I-8.1.4. Simpson argues that Cedar Springs made such a change in 2008 and failed to produce evidence that it had submitted it to CDPHE. Although the trial court did not address this alternative argument in its ruling, we find it unpersuasive for the reasons stated above-namely, that the privilege determination is not a regulatory compliance review. In other words, determining whether a facility has submitted "permanent and substantive [plan] change[s]" to CDPHE is part of the ongoing licensure process, not a prerequisite to application of the privilege.
T26 In sum, we hold that because Cedar Springs is licensed by CDPHE, it has an "approved" quality management program. The documents in question were therefore created as part of "a quality management *186program" as defined by statute. Accordingly, the documents are covered by the quality management privilege, and the trial court erred in ordering that they be produced.
IIL.
T27 For the above reasons, we make the rule absolute and remand this case to the district court for further proceedings consistent with this opinion.
JUSTICE MARQUEZ dissents.. Simpson dismissed his claims against Dr. Peck, and Dr. Pumphrey did not participate in this C.A.R. 21 proceeding.
. This case is thus distinguishable from Zander v. Craig Hospital, 267 F.R.D. 653 (D.Colo.2010) ("Zander I") and Zander v. Craig Hospital, 743 F.Supp.2d 1225 (D.Colo. 2010) ("Zander Il"). There, the court held that only information created as part of a facility's quality management program-not "every word uttered by a licensed health care professional ... following a procedure or treatment"-would be covered by the privilege. Zander I, 267 F.R.D. at 661. It is in this context that the court stated that only statements made in "compifiance]" with a facility's quality management program would be covered by the privilege. Id.; see also Zander II, 743 F.Supp.2d at 1234-35 (holding that documents created as part of the facility's quality management program were privileged, whereas documents created as part of physician's independent investigation were not). In this case, no one disputes that the minutes in question were created as part of Cedar Springs' quality management program, specifically the Pharmacy and Thera*184peutics Committee and the Performance Improvement Committee. There is therefore no need for us to determine the scope of the privilege as to whether documents were created as "part" of a quality management program.
. The parties and the trial court have focused on the third phrase of section 25-3-109(2). We do as well, and do not consider whether the documents in question might have been produced in conjunction with the first two phrases.
. Simpson points to the fact that a new facility must submit to CDPHE for approval a plan for its quality management program within 90 days of receiving a license, 6 Code Colo. Regs. 1011-1:II-3.1.1, positing that possession of a license alone may not demonstrate regulatory compliance during the approval period. See 6 Code Colo. Regs. 1011-1:113.1.2 (CDPHE may return the submitted plan to the facility with "specific reasons for disapproval" and a schedule for resubmission). However, in this case, because *185there is no dispute that Cedar Springs was initially licensed, and that its license was repeatedly renewed throughout the period relevant to this case, we need not address the potential application of the privilege within the approval period.