The government wants Plaintiff’s patient data. Plaintiff is a private, for-profit facility that provides treatment for patients with substance abuse and mental health disorders. Plaintiff claimed patient data was protected by CRS 13-90-107(1)(g), creating the psychotherapist-patient privilege, and 42 U.S.C. § 290dd-2, Federal Confidentiality Statutes (FCS). On review, the court of appeals agreed with the trial court, holding the data could be disclosed. First, CRS 13-90-107 is limited to the litigation context and did not apply. Second, under the FCS, patient data is disclosable to an agency with “direct administrative control,” which the state was not, or under an “audit and evaluation” exception, which did apply. Thus, the data could be required to be disclosed once the state, but only once the state implements a required data retention and destruction policy.