Opinion by CHIEF JUDGE DAVIDSON

¶ 1 Plaintiff, Adolescent and Family Institute of Colorado, Inc., appeals from the district court's declaratory judgment in favor of defendant, Colorado Department of Human Services, Division of Behavioral Health, Alcohol and Drug Abuse Division (ADAD). The court determined that defendant's regulation, which required plaintiff to submit confidential patient information to defendant, did not violate state or federal confidentiality statutes as applied to plaintiff. It further determined that defendant was required to finalize a policy for retention and destruction of that information.

¶ 2 Defendant cross-appeals from the district court's postjudgment stay pending appeal enjoining defendant from taking any licensure action against plaintiff.

¶ 3 We affirm the judgment and vacate the stay.

I. Background

¶ 4 The Colorado Department of Human Services (DHS) is "responsible for the administration of human services programs" in the state, § 26-1-105(3), C.R.S.2012, including alcohol and drug abuse treatment programs, see §§ 26-1-111(5), 26-1-201(1)(a)-(c), C.R.S.2012. See §§ 27-80-101(6), 27-80-102(2), C.R.S.2012.

¶ 5 Defendant is a division within DHS and is responsible for formulating and administering a comprehensive state plan for alcohol and drug abuse programs. See § 26-1-105(1.5), C.R.S.2012; see also § 27-80-102, C.R.S.2012. To do so, defendant is authorized to "establish standards for approved treatment facilities that receive public funds or that dispense controlled substances or both." § 27-82-103(1), C.R.S.2012; see § 27-81-106(1), C.R.S.2012; see also § 27-80-108(1), C.R.S.2012. A facility that falls into that category must be approved, meaning licensed, by defendant to operate in Colorado. See § 27-82-103(6), C.R.S.2012.

¶ 6 Thus, defendant also is authorized "to establish minimum rules by which it licenses and monitors the administration and provision of treatment services for substance use disorders," ADAD Admin. Procedures, 6 Code Colo. Regs. 1008-1:15.210(A); see §§ 27-80-204 to -207, C.R.S.2012, and may deny, revoke, or suspend a license based on a program's failure to comply with those standards, see §§ 27-80-208, 27-81-106(4)-(6), 27-82-103(5), C.R.S.2012; ADAD License Revocation, Denial, Suspension, Limitation, Annulment or Modification, 6 Code Colo. Regs. 1008-1:15.212(A).

¶ 7 Defendant is responsible for reviewing each program's request for public funds and all applications for federal grants. See § 27-80-109, C.R.S.2012.

¶ 8 Plaintiff is a private, for-profit facility that provides treatment for patients with substance abuse and mental health disorders. According to the record, plaintiff does not dispense controlled substances and it is unclear whether it receives public funds. See 42 C.F.R. § 2.12(b) (describing what is considered federal assistance). However, regardless of whether plaintiff is required to be licensed, it has been licensed by defendant since 1984 and seeks to maintain its licensed status.

¶ 9 All licensees are required to comply with defendant's regulations and standards to maintain their licenses. See §§ 27-80-208(1)(d), 27-81-106(5), 27-82-103(5); ADAD Administrative Procedures, 6 Code Colo. Regs. 1008-1:15.210(B).

¶ 10 The regulation at issue here provides that all licensees are responsible for "[a]ccurate and timely submission of required data to [defendant], including Drug Alcohol Coordinated Data System (DACODS) client treatment admission and discharge records." ADAD Governance, 6 Code Colo. Regs. 1008-1:15.214(B)(6). The DACODS form contains, inter alia, a patient's first and last name, date of birth, social security number, zip code, and other demographic information such as income and education.

¶ 11 Defendant did not require private treatment facilities to comply with the DACODS submission requirement until 2005. At that time, plaintiff sought a waiver of the requirement because it believed that submitting the DACODS form to defendant violated state and federal laws protecting the confidentiality of patient records.

¶ 12 Defendant denied plaintiff's waiver request. Defendant then initiated administrative license revocation proceedings, which were dismissed with prejudice by an administrative law judge. Plaintiff then initiated proceedings in the district court, seeking, inter alia, a declaratory judgment to determine whether the DACODS submission requirement was preempted by state and federal laws because the regulation and the laws conflicted, "making compliance with both physically impossible," that is, whether the regulation was unconstitutional as applied to plaintiff.

¶ 13 In its judgment, the court concluded that the DACODS submission requirement was not preempted by state and federal laws because it was not covered by the statutory psychotherapist-patient privilege, and it fell within certain statutory exceptions to the general prohibition against disclosures. In a postjudgment motion, plaintiff asked the court to stay any licensure action by defendant against it pending the appeal. The court granted the stay.

¶ 14 Plaintiff appeals the declaratory judgment, and defendant cross-appeals the stay order.

II. Appeal

A. Psychotherapist-Patient Privilege

¶ 15 Plaintiff first contends that the district court erred by finding that the DACODS submission requirement does not violate section 13-90-107(1)(g), C.R.S.2012, the psychotherapist-patient privilege. We disagree.

¶ 16 "`Generally, privileges are creatures of statute and therefore must be strictly construed.'" DeSantis v. Simon, 209 P.3d 1069, 1073 (Colo.2009) (quoting People v. Turner, 109 P.3d 639, 644 (Colo.2005)); see Hartmann v. Nordin, 147 P.3d 43, 49 (Colo. 2006) ("Because it withholds potentially relevant information, we narrowly construe the physician-patient privilege."). We review the district court's interpretation of a statute de novo. See Turner, 109 P.3d at 644; W. Fire Truck, Inc. v. Emergency One, Inc., 134 P.3d 570, 573 (Colo.App.2006).

¶ 17 In interpreting statutes, our primary goal is to ascertain and give effect to the legislative intent. See Hartmann, 147 P.3d at 49. We do so by first looking to the plain language of the statute. Id. If the language is clear and unambiguous, we apply it as written. Kauntz v. HCA-Healthone, LLC, 174 P.3d 813, 816 (Colo.App.2007).

¶ 18 As relevant here, section 13-90-107(1)(g) provides that the following persons "shall not be examined as a witness":

¶ 19 Looking to the plain language of the statute, we initially note that a "witness" is "[o]ne who gives testimony under oath or affirmation (1) in person, (2) by oral or written deposition, or (3) by affidavit." Black's Law Dictionary 1740 (9th ed. 2009); see People v. Martin, 316 Mich. 669, 26 N.W.2d 558, 560 (1947) ("`The term `witness,' in its strict legal sense, means one who gives evidence in a cause before a court; and in its general sense includes all persons from whose lips testimony is extracted to be used in any judicial proceeding, and so includes deponents and affiants as well as persons delivering oral testimony before a court or jury.'" (quoting 70 C.J. 34)); see also Concerned Parents of Pueblo, Inc. v. Gilmore, 47 P.3d 311, 313 (Colo.2002) ("We must give words not defined in the statute their plain and ordinary meanings.").

¶ 20 Additionally, this section is located in Title 13, which is entitled "Courts and Court Procedure." See Frazier v. People, 90 P.3d 807, 811 (Colo.2004) ("Although the title of a statute is not dispositive of legislative intent, it is a useful aid in construing a statute."); see also People v. Bowman, 812 P.2d 725, 728 (Colo.App.1991) ("In construing a statute, the whole act must be considered so as to give consistent, harmonious, and sensible effect to all of its parts.").

¶ 21 Thus, viewing the statute in context, and based on its plain language, we understand the statute to grant to the people listed therein protection from being questioned in a manner that will result in their disclosures being used at any stage in the litigation process. See Cardenas v. Jerath, 180 P.3d 415, 424 (Colo.2008) ("This privilege applies equally to pretrial discovery as it does to in-court testimony."); cf. Turner, 109 P.3d at 644 ("[T]he clear language of the [victim-advocate privilege] statute extends the privilege so as to prohibit the disclosure of information contained in records or reports, such that `examined' is not a restrictive term making the privilege effective only at trial.").

¶ 22 This interpretation is further supported by numerous Colorado appellate court decisions describing the psychotherapist-patient privilege as a "testimonial" privilege. See Clark v. Dist. Court, 668 P.2d 3, 8 (Colo. 1983) (the psychotherapist-patient privilege applies to "not only testimonial disclosures in court but also pretrial discovery of information within the scope of the privilege"); see also People v. Sisneros, 55 P.3d 797, 800 (Colo.2002) ("Once it attaches, the psychologist-patient privilege protects testimonial disclosures as well as pretrial discovery of files or records derived or created in the course of the treatment."); accord People v. Hogan, 114 P.3d 42, 54 (Colo.App.2004); cf. Petro-Lewis Corp. v. Dist. Court, 727 P.2d 41, 43 (Colo.1986) ("The testimonial [marital] privilege applies to in-court testimony, as well as depositions, interrogatories, requests for admissions, and other forms of testimonial discovery.").

¶ 23 "Testimonial" refers to evidence given under oath or affirmation at trial or in an affidavit or deposition. Black's Law Dictionary at 1613; see Jaffee v. Redmond, 518 U.S. 1, 9-10, 116 S.Ct. 1923, 135 L.Ed.2d 337 (1996); cf. People v. Vigil, 127 P.3d 916, 921 (Colo.2006); Compan v. People, 121 P.3d 876, 880-81 (Colo.2005) (the victim's statements were not testimonial because they "were not made under circumstances which would lead an objective witness reasonably to believe that the statement would be available for use at a later trial"). We are not aware of any cases applying the psychotherapist-patient privilege outside the litigation context, nor has plaintiff cited any. See Bowman, 812 P.2d at 729 (the privilege did not apply because the social worker did not testify at trial); see also People in Interest of L.A.N., 296 P.3d 126, 134-35 (Colo.App.2011) ("A privilege operates as an exception to Colorado's broad discovery rules."), aff'd in part and rev'd in part sub nom. L.A.N. v. L.M.B., 2013 CO 6, 292 P.3d 942; accord In re Grand Jury Subpoena, 430 Mass. 590, 722 N.E.2d 450, 453 (2000) ("[T]estimonial privileges are `exceptions to the general duty imposed on all people to testify.' Such privileges diminish the evidence before the court, and contravene the fundamental principle that `the public... has a right to every man's evidence.'" (citations omitted) (quoting Commonwealth v. Corsetti, 387 Mass. 1, 438 N.E.2d 805, 808 (1982), and United States v. Bryan, 339 U.S. 323, 331, 70 S.Ct. 724, 94 L.Ed. 884 (1950))).

¶ 24 Therefore, we conclude that the district court properly found that the psychotherapist-patient privilege does not apply to the DACODS submission requirement.

B. Federal Confidentiality Statutes and Exceptions

¶ 25 Plaintiff next contends that the district court erred by concluding that the DACODS submission requirement does not violate 42 U.S.C. § 290dd-2 (2006) and its implementing regulations, 42 C.F.R. §§ 2.1-2.67. The court, as we understand its ruling, determined that defendant could require, as a condition to licensure, that plaintiff submit the information on the DACODS forms; however, because defendant did not have a data retention and destruction policy, defendant could not enforce the requirement until such a policy had been enacted. We perceive no error in the district court's conclusions.

¶ 26 We review the district court's interpretation of this statute de novo. Jefferson Cnty. Bd. of Equalization v. Gerganoff, 241 P.3d 932, 935 (Colo.2010).

42 U.S.C. § 290dd-2(a); see 42 C.F.R. §§ 2.1(a), 2.2(a). Subsection (b) authorizes disclosures, even without patient consent,

42 U.S.C. § 290dd-2(b)(2); see 42 C.F.R. §§ 2.1(b)(2), 2.2(b)(2). Where permissible, the disclosures "must be limited to that information which is necessary to carry out the purpose of the disclosure." 42 C.F.R. § 2.13(a).

42 C.F.R. § 2.12(c)(3)(ii).

2. Analysis

¶ 27 The district court determined that (1) the disclosure restrictions do not apply to the DACODS submission requirement because defendant is the "administrative entity that has direct administrative control" over plaintiff, id.; and (2) if the restrictions do apply, the relevant disclosures are permissible because they fall within the audit and evaluation exception. We review each conclusion in turn.

a. Direct Administrative Control

¶ 28 There is no relevant definition in the Confidentiality of Alcohol and Drug Abuse Patient Records Act, 42 U.S.C. § 290dd-2; see 42 C.F.R. ch. 1, subch. A, pt. 2, and we have found no case law addressing what "direct administrative control" means under these circumstances. However, we find persuasive the definition used by the Social Security Administration (SSA) to determine whether an institution is public or private for SSA purposes. See Social Security Administration Program Operations Manual System Supplemental Security Income (SSA POMS SI), 00520.001(C)(2)(a).

¶ 29 According to the SSA, an institution is public if the government has direct or indirect control over it. See SSA POMS SI 00520.001(B)(4); see also 20 C.F.R. § 416.201 ("Public institution means an institution that is operated by or controlled by the Federal government, a State, or a political subdivision of a State such as a city or county."). Direct control means the controlling entity "is responsible for the ongoing daily activities of an institution, such as when ... [it] has the final authority to hire and fire employees." SSA POMS SI 00520.001(C)(2)(a); see N. Colo. Med. Ctr., Inc. v. Nicholas, 27 P.3d 828, 835 (Colo.2001); cf. McLaughlin v. State Bd. of Educ., 75 Cal.App.4th 196, 203, 89 Cal.Rptr.2d 295, 299 (1999). Indirect control means the controlling entity "has total control of all fiscal decisions even though it lacks the authority to hire and fire employees of the institution." SSA POMS SI 00520.001(C)(2)(a); see Dep't of Health & Human Servs. v. Chater, 163 F.3d 1129, 1134 (9th Cir.1998).

¶ 30 Further, "control" means "`power or authority to guide or manage.'" Bd. of Educ. v. Booth, 984 P.2d 639, 648 (Colo.1999) (quoting Webster's Third New Int'l Dictionary 496 (1986)). Thus, according to these definitions, regulation or licensure of an institution does not, by itself, amount to direct administrative control. See 20 C.F.R. § 416.201; SSA POMS SI 00520.001(C)(2)(c); 70B Am.Jur.2d Social Security and Medicare § 880; cf. Am. Mfrs. Mut. Ins. Co. v. Sullivan, 526 U.S. 40, 52, 119 S.Ct. 977, 143 L.Ed.2d 130 (1999) ("`[T]he mere fact that a business is subject to state regulation does not by itself convert its action into that of the State for purposes of the Fourteenth Amendment.'" (quoting Jackson v. Metro. Edison Co., 419 U.S. 345, 350, 95 S.Ct. 449, 42 L.Ed.2d 477 (1974))); N. Colo. Med. Ctr., 27 P.3d at 836.

¶ 31 Applying these definitions here, we note that, as discussed in section I above, defendant is the government agency with the authority to regulate and license plaintiff. Defendant also has the authority, to some extent, to determine the type and scope of treatment programs that plaintiff administers. However, it is undisputed that defendant has no authority over plaintiff's staffing decisions, internal policy decisions, budget decisions, or management of financial resources, and defendant is not otherwise involved in guiding plaintiff's day-to-day operations.

¶ 32 Therefore, we conclude that defendant is not an entity with direct administrative control over plaintiff and the confidentiality exception of 42 C.F.R. § 2.12(c)(3)(ii) does not apply here. Accordingly, defendant's collection of the DACODS information must fall within one of the exceptions provided in 42 C.F.R. §§ 2.1(b)(2) and 2.2(b)(2).

b. Audit or Evaluation Exception

i. Conducting an Audit or Evaluation

¶ 33 We must first determine whether defendant is conducting an audit or evaluation within the meaning of the exception.

¶ 34 Here, defendant has argued that it collects the DACODS information for the annual reports, applications, evaluations, and audits it is required to submit to the governor, the state legislature, and the Secretary of Health and Human Services. See 42 U.S.C. § 300x-21 (2012); §§ 27-80-102, 27-80-110, C.R.S.2012.

¶ 35 As relevant here, these annual submissions must include data on

42 U.S.C. § 290aa-4(c)(1).

¶ 36 The submissions should also include an assessment of the state's need for the federally funded activities, which should include a description of

42 U.S.C. § 300x-29; see also § 27-80-110 (annual report to the state legislature should include "the costs and effectiveness of alcohol and drug abuse programs in this state and... recommended legislation in the field of alcohol and drug abuse").

¶ 37 We conclude that, although the subject of the various submissions may overlap in some instances, and the DACODS information may be used in the aggregate for multiple submissions, each annually required submission is a separate audit or evaluation within the exception.

ii. Compliance with Other Requirements

¶ 38 Having so concluded, we now analyze whether defendant's collection of the DACODS information complies with the statutory requirements regarding how confidential information must be collected, stored, and destroyed.

¶ 39 Here, by requiring a licensed facility to submit the DACODS form to it, defendant is removing confidential patient records from the facility's premises. Under the audit and evaluation exception, confidential records may be removed from a facility's premises only if (1) the audit or evaluation is being performed on behalf of "[a]ny Federal, State, or local governmental agency which provides financial assistance to the program or is authorized by law to regulate its activities," 42 C.F.R. § 2.53(b)(2)(i); and (2) the person performing the audit or evaluation agrees in writing to maintain the records in a secure, locked location; to destroy them upon completion of the relevant activities; and not to disclose the confidential information to any person other than the program from which they were received, id. §§ 2.16, 2.53(b)(1).

¶ 40 Here, as already noted, defendant is the state agency that is authorized by law to regulate plaintiff's activities. See §§ 26-1-105(3), 26-1-111(5), 26-1-201(1), 27-80-101(6), 27-80-102(2), 27-80-205(1), 27-81-106, 27-82-103; see also ADAD Admin. Procedures, 6 Code Colo. Regs. 1008-1:15.210. Thus, the first criterion is met.

¶ 41 However, when defendant began enforcing the DACODS submission requirement, it did not have a data retention and destruction policy as required under sections 2.16 and 2.53 of the federal confidentiality statute. Although in its opening-answer brief on appeal, defendant asserts that, as of November 2011, it "has finalized a data retention/destruction policy," defendant did not submit a copy of the policy into the record or provide a citation to where the policy may be found. Nor were we able to locate the policy in a publicly available forum. Therefore, we will not take judicial notice of the existence of a data retention and destruction policy. See Mun. Subdistrict v. OXY USA, Inc., 990 P.2d 701, 711 (Colo.1999) ("[C]ourts may take judicial notice of facts `not subject to reasonable dispute' that are `either (1) generally known within the territorial jurisdiction of the trial court or (2) capable of accurate and ready determination by resort to sources whose accuracy cannot reasonably be questioned.'" (quoting in part CRE 201(b))); cf. One Hour Cleaners v. Indus. Claim Appeals Office, 914 P.2d 501, 504 (Colo.App.1995) ("[R]ules and regulations promulgated by a governmental agency pursuant to the agency's statutory authority and published in an official state publication, such as Code of Colorado Regulations, may be judicially noticed.").

¶ 42 The district court found that defendant's practice of keeping otherwise confidential patient information indefinitely "contravenes the meaning and purpose of the statutes." And it ordered defendant to "specify a reasonable amount of time to complete its audit or evaluation and destroy patent identifying information."

¶ 43 We agree with the district court that defendant cannot require plaintiff to comply with the DACODS submission requirement as a condition of licensure until it proves that it has a data retention and destruction policy that complies with 42 C.F.R. chapter 1, subchapter A, part 2. Accordingly, we also agree with plaintiff that the court's order requires that, "in the absence of a clearly defined policy for the destruction of the personal identifying information gathered as part of an audit or evaluation, such gathering and retention is a violation of 42 CFR Part 2."

¶ 44 However, because there is no evidence in the record, we do not address whether defendant currently has a data retention and destruction policy for the confidential records it collects pursuant to the DACODS submission requirement, and if such a policy exists, whether it satisfies the federal requirements of 42 C.F.R. § 2.53(b).

III. Cross-Appeal: Rule 62(d) Motion for Stay

¶ 45 After the district court entered its declaratory judgment, plaintiff moved for a stay pending appeal under C.R.C.P. 62(d). The court granted the motion as follows: "Defendant is stayed from taking any action with respect to Plaintiff's license pending Plaintiff's appeal of this matter."

¶ 46 Defendant contends that the court lacked the jurisdiction to stay "all licensing action against an executive agency where there had been no exhaustion of administrative remedies." We agree.

¶ 47 Whether the district court acted within its jurisdiction in issuing the stay is a question of law that we review de novo. In re J.C.T., 176 P.3d 726, 729 (Colo.2007); Colo. Special Dists. Prop. & Liab. Pool v. Lyons, 2012 COA 18, ¶ 14, 277 P.3d 874.

¶ 48 Under C.R.C.P. 62(d), a district court may stay the execution of its order or judgment pending appeal, upon the moving party's giving of a supersedeas bond. See Hart v. Schwab, 990 P.2d 1131, 1133-34 (Colo.App. 1999); see also 5 Colo. Prac., Civil Rules Annotated R 62 (4th ed.) (as long as an adequate supersedeas bond is approved, a stay upon appeal is a matter of right under the rule); cf. C.R.C.P. 62(b).

¶ 49 Here, neither party disputes that under C.R.C.P. 62(d), the district court could have stayed the execution of its declaratory judgment. Rather, the dispute arises because that is not what the court did. Although plaintiff captioned its motion as seeking a stay of the court's judgment under C.R.C.P. 62(d), the relief it actually sought was a stay of any licensure action against it by defendant pending compliance with 42 C.F.R. § 2.16. And by granting a stay pending appeal, the court enjoined defendant's ability to take future action for any perceived violation of plaintiff's licensing obligations, rather than merely staying execution of its own declaratory judgment.

¶ 50 While a court clearly acts within its jurisdiction by staying enforcement of its own judgment or order, see C.R.C.P. 62; see also Cmty. Tele-Commc'ns, Inc. v. Heather Corp., 677 P.2d 330, 334 (Colo.1984); Johnson v. Dist. Court, 195 Colo.169, 171, 576 P.2d 167, 168-69 (1978), it generally exceeds its jurisdiction in enjoining an executive agency from taking action that the agency is statutorily authorized to take. See T & S Leasing, Inc. v. Dist. Court, 728 P.2d 729, 731 (Colo.1986); accord State Bd. of Cosmetology v. Dist. Court, 187 Colo. 175, 177, 530 P.2d 1278, 1279 (1974); see also, e.g., Rocky Mountain Animal Def. v. Colo. Div. of Wildlife, 100 P.3d 508, 519 (Colo.App.2004) ("Judicial power to enjoin an executive agency under the doctrine of inherent power is limited. For example, it should be exercised where an agency refuses to obey a court order." (citation omitted)); Dep't of Transp. v. Auslaender, 94 P.3d 1239, 1243 (Colo.App. 2004) ("[E]ven where statutorily authorized, `[c]ourts should not grant the equitable remedy of injunction against other branches of government in the absence of convincing proof of threatened and impending wrongful action.'" (quoting in part State Bd. of Chiropractic Exam'rs v. Stjernholm, 935 P.2d 959, 971 (Colo.1997))).

¶ 51 Moreover, any dispute as to the status of plaintiff's license is separate and distinct from the declaratory judgment proceedings that were before the district court. And we agree with defendant that the licensure dispute must first be addressed through the administrative process. See City & Cnty. of Denver v. United Air Lines, Inc., 8 P.3d 1206, 1212-13 (Colo.2000); State v. Dist. Court, 908 P.2d 518, 520 (Colo.1995). Only when there has been final agency action may we then review that action. See United States v. W. Pac. R.R. Co., 352 U.S. 59, 63-64, 77 S.Ct. 161, 1 L.Ed.2d 126 (1956); United Air Lines, Inc., 8 P.3d at 1212.

¶ 52 Therefore, we conclude that the district court erred by issuing the stay that it did here, and we vacate that order. See People in Interest of Heckers v. Dist. Court, 170 Colo. 533, 536, 463 P.2d 310, 311 (1970); Rocky Mountain Animal Def., 100 P.3d at 519; see also Johnson, 195 Colo. at 171-72, 576 P.2d at 168-69. For purpose of clarification, we point out that, by vacating the stay order, we allow defendant, if it so chooses, to initiate revocation proceedings against plaintiff in the administrative court. However, by our affirmance of the declaratory judgment, defendant cannot require DACODS submission compliance until it has a data retention and destruction policy, the existence of which it will need to prove should it initiate any such action against plaintiff.

¶ 53 The declaratory judgment is affirmed, and the order granting postjudgment stay is vacated.

JUDGE MARQUEZ* and JUDGE VOGT* concur.