
743 F.Supp.2d 1225 (2010)
Karen S. ZANDER, Plaintiff,
v.
CRAIG HOSPITAL, and Rick Bayles, Ph.D., CNIM, Defendants.
Civil Action No. 09-cv-02121-REB-BNB.
United States District Court, D. Colorado.
October 14, 2010.
*1227 Michael E. Mone, Esdaile, Barrett & Esdaile, Boston, MA, Natalie A. Brown, Dezarae D. Lacrue, Leventhal, Brown & Puga, P.C., Denver, CO, for Plaintiff.
David H. Yun, Jaudon & Avery, LLP, Deanne C. McClung, Jessie Marie Fischer, Paul D. Cooper, Cooper & Clough, PC, Denver, CO, for Defendants.

ORDER
BOYD N. BOLAND, United States Magistrate Judge.
This matter arises on Plaintiff's Second Motion to Compel Investigative Documents [Doc. #125, filed 7/27/2010] (the "Second Motion to Compel"). The Second Motion to Compel is GRANTED IN PART and DENIED IN PART.

I.
This is a negligence case against Dr. Rick Bayles, Ph.D., CNIM, in which the plaintiff alleges that Dr. Bayles breached the standard of care in connection with his responsibilities to monitor and report the plaintiff's somatosensory-evoked potential waveforms during spinal surgery performed by Dr. Scott Falci, M.D.[1] Complaint [Doc. #1] at pp. 15-17. Craig Hospital is sued on a theory of respondeat superior as the employer of Dr. Bayles. Id. at pp. 17-18. The plaintiff claims that she was rendered paraplegic as a result of Dr. Bayles' negligence. Scheduling Order [Doc. #11] at p. 4.
Dr. Falci was deposed and testified that he conducted an investigation after the plaintiff's surgery to attempt to determine what caused her paralysis. Deposition of Scott Falci [Doc. #39-2] (the "Falci Depo.") at p. 89 line 18 through p. 94 line 9. In response to follow-up questioning about Dr. Falci's investigation, Craig Hospital interposed an objection based on the "quality assurance privilege" and instructed Dr. Falci not to answer. Falci Depo. [Doc. #39-2] at p. 94 lines 13-18. Dr. Falci's lawyer joined in the objection and instructed his client not to answer.
Subsequently, the plaintiff served her Second Set of Discovery [Doc. #125-4], requesting production of the following documents:
[A]ll DOCUMENTS of any type, including electronically stored information, pertaining to the reporting and investigation of the INCIDENT or "occurrence" or "sentinel event" involving Karen Zander, which was prepared, generated or reviewed for the time of the INCIDENT through the date of filing of this litigation, including insurance claim files, Root Cause Analysis records, Risk Management records, Quality Assessment records, Peer Review records and patient advocate records.
Id. at Request for Production No. 4.
Craig Hospital responded to the production request as follows:

*1228 Objection. In addition to the [General Objections] set forth above, this request is compound and over broad. It seeks information that is irrelevant and not reasonably calculated to lead to the discovery of admissible evidence. It also seeks information protected from discovery by Colorado law. C.R.S. § 25-3-109(3) states that "any records, reports or other information . . . that are part of a quality management program . . . shall be confidential information." The statute states that the "records, reports and other information described in subsection (3) . . . shall not be subject to subpoena or discoverable or admissible as evidence in any civil or administrative proceeding." C.R.S. § 25-3-109(4). (Emphasis added.) This request for production improperly seeks documents that fall squarely within the definition of documents protected by statute and requests confidential information that is protected form discovery. The statutory protections are not "waived" even if Plaintiff at some point determines the organic documents were not "complied with." See Privilege Log, served with these responses.
Id. at Response [to Request for Production No. 4] (original emphasis).[2]
Apparently, no documents were produced in response to the plaintiff's Request for Production No. 4. In a supplemental privilege log dated August 13, 2010, however, Craig Hospital identified six documents responsive to the production request but which it claims are privileged pursuant to the quality management privilege. Supplemental Privilege Log [Doc. #134-3].[3] The documents are:
(1) "Root Cause Analysis Worksheet (3 pages)";
(2) "A Framework for a Root Cause Analysis and Action Plan (4 pages)";
(3) "Correspondence to [Root Cause Analysis] Team Leader (2 pages)";
(4) "[Root Cause Analysis] expert review report (2 pages)";
(5) "[Root Cause Analysis] case discussion and attached medical literature (21 pages)"; and
(6) "Notes from 10/23 2007 discussion of peer review case with confidential physician reviewer (3 pages)." Id.
The Second Motion to Compel requests an order "compelling Craig [Hospital] to produce the investigative documents related to Ms. Zander's surgery" and "an Order indicating that Dr. Falci's investigation is not subject to the quality management privilege." Second Motion to Compel [Doc. #125] at p. 11.

II.
The quality management privilege upon which Craig Hospital relies is contained at section 25-3-109, C.R.S., and provides in relevant part:
(1) The general assembly hereby finds and declares that the implementation of quality management functions to evaluate and improve patient and resident care is essential to the operation of health care facilities licensed or certified by the department of public health and environment pursuant to section 25-1.5-103(1)(a). For this purpose, it is necessary that the collection of information *1229 and data by such licensed or certified health care facilities be reasonably unfettered so a complete and thorough evaluation and improvement of the quality of patient and resident care can be accomplished. To this end, quality management information relating to the evaluation or improvement of the quality of health care services shall be confidential, subject to the provisions of subsection (4) of this section, and persons performing such functions shall be granted qualified immunity. . . .
(2) For purposes of this section, a "quality management program" means a program which includes quality assurance and risk management activities, the peer review of licensed health care professionals not otherwise provided for in part 1 of article 36.5 of title 12, C.R.S., and other quality management functions which are described by a facility in a quality management program approved by the department of public health and environment. . . .
(3) Except as otherwise provided in this section, any records, reports, or other information of a licensed or certified health care facility that are part of a quality management program designed to identify, evaluate, and reduce the risk of patient or resident injury associated with care or to improve the quality of patient care shall be confidential information; except that such information shall be subject to the provisions of subsection (4) of this section.
(4) The records, reports, and other information described in subsection (3) and subsection (5.5) of this section shall not be subject to subpoena or discoverable or admissible as evidence in any civil action or administrative proceeding. No person who participates in the reporting, collection, evaluation, or use of such quality management information with regard to a specific circumstance shall testify thereon in any civil or administrative proceeding. However, this subsection (4) shall not apply to:
(a) Any civil or administrative proceeding, inspection, or investigation as otherwise provided by law by the department of public health and environment or other appropriate regulatory agency having jurisdiction for disciplinary or licensing sanctions;
(b) Persons giving testimony concerning facts of which they have personal knowledge acquired independently of the quality management information program or function;
(c) The availability, as provided by law or the rules of civil procedure, of factual information relating solely to the individual in interest in a civil suit by such person, next friend, or legal representative. In no event shall such factual information include opinions or evaluations performed as a part of the quality management program.
(d) Persons giving testimony concerning an act or omission which they have observed or in which they participated, notwithstanding any participation by them in the quality management program;
(e) Persons giving testimony concerning facts they have recorded in a medical record relating solely to the individual in interest in a civil suit by such person.
(5) Nothing in this section shall affect the voluntary release of any quality management record or information by a health care facility; except that no patient-identifying information shall be released without the patient's consent.
The Colorado quality management privilege created by section 25-3-109 contemplates that licensed health care facilities may create a "quality management program," which they may submit to the Colorado department of public health and environment for approval. Section 25-3-109(2), *1230 C.R.S. After a facility obtains approval of its quality management program, it may engage in quality management functions, such as gathering and preparing "records, reports, or other information" to "identify, evaluate, and reduce the risk of patient care," subject to the quality management privilege. Section 25-3-109(3), C.R.S. Section 25-3-109(3) provides that the "records, reports, or other information of [the] licensed . . . health care facility that are part of [the] quality management program designed to identify, evaluate, and reduce the risk of patient . . . injury. . . or to improve the quality of patient care shall be confidential information. . . ." Id.
Craig Hospital has identified the following five documents which it claims constitute its quality management program:
(1) Performance Improvement and Safety Management Plan, dated April 2008 (the "Performance Improvement Plan");
(2) Safety Management Policy, dated December 2007 and captioned "Risk Management," (the "Risk Management Plan");
(3) Safety Management Policy, dated October 2006 and captioned "Sentinel Event/Adverse Event/Near Miss" (the "Sentinel Event Plan");
(4) Failure Mode and Effects Analysis, dated August 2004 (the "Failure Mode Plan"); and
(5) Quality/Performance Improvement Plan, adopted May 25, 1995 (the "QP Plan"). Order [Doc. #63, filed 4/8/2010] at p. 4.

III.
Discovery in the federal courts is governed by the Federal Rules of Civil Procedure, regardless of whether jurisdiction is based on a federal question or diversity of citizenship. Atteberry v. Longmont United Hospital, 221 F.R.D. 644, 646 (D.Colo.2004). Where, as here, the "case [is] based upon a state cause of action, state law controls the determination of privileges." White v. American Airlines, Inc., 915 F.2d 1414, 1424 (10th Cir.1990); see Fed.R.Evid. 501 (stating that "in civil actions and proceedings, with respect to an element of a claim or defense as to which State law supplies the rule of decision, the privilege of a witness, person, government, State, or political subdivision thereof shall be determined in accordance with State law").
A party asserting a privilege has the burden of showing that the privilege applies. Atteberry, 221 F.R.D. at 649. To carry that burden, the party claiming the privilege must make a "clear showing" that the withheld information is privileged. Bethel v. United States, 242 F.R.D. 580, 583 (D.Colo.2007). The framework for discovery established by the Federal Rules of Civil Procedure evidences a policy favoring the full disclosure of facts before trial to aid in the search for the truth. Id. at 584. Consistent with that policy, evidentiary privileges are disfavored. Herbert v. Lando, 441 U.S. 153, 175, 99 S.Ct. 1635, 60 L.Ed.2d 115 (1979). Those privileges, which are "in derogation of the search for the truth," are "not lightly created nor expansively construed." United States v. Nixon, 418 U.S. 683, 710, 94 S.Ct. 3090, 41 L.Ed.2d 1039 (1974).

IV.
Craig Hospital consistently has urged that the Colorado quality management privilege be given an expansive reading, arguing:
[T]here are no formal requirements to trigger or activate these privileges. There aren't any. . . . The only thing necessary to trigger this is that there be an approved health plan on file with the state. . . . That is the only condition necessary to have the investigation be confidential and non-discoverable.
*1231 Record of Proceedings of March 29, 2010, at 4:06:20 p.m. to 4:07:50 p.m. Thus, according to Craig Hospital, once there is a state approved quality management program, all discussions, including gossip, that take place among health care professionals, facility administrators, and other unspecified persons concerning medical care are privileged and not discoverable pursuant to the quality management privilege. Id. at 4:24:40 p.m.
Craig Hospital's interpretation of the quality management privilege does not comport with the plain meaning of the statute. To the contrary:
[O]nly the "records, reports, or other information of a licensed or certified health care facility" resulting from activities "described . . . in a quality management program" which has been approved by the state are confidential. Information resulting from other sources, including gossip or a doctor acting on his own initiative, if not described by the facility in its state approved quality management program, is not privileged.
Zander v. Craig Hospital, 267 F.R.D. 653, 659 (D.Colo.2010). Consequently, documents that exist regardless of any quality management functions undertaken pursuant to a state approved quality management program (hereafter "qualifying quality management functions") are discoverable, but only from their original source; and conversations between or among health care providers about medical care before a qualifying quality management function is initiated or outside the operation of a qualifying quality management function are not privileged. Id. at 659-60. As the court held in Shelton v. Morehead Memorial Hospital, 318 N.C. 76, 347 S.E.2d 824, 829 (1986), applying an analogous North Carolina statute:
[I]nformation, in whatever form available, from original sources other than the medical review committee is not immune from discovery or use at trial merely because it was presented during medical review committee proceedings; neither should one who is a member of a medical review committee be prevented from testifying regarding information he learned from sources other than the committee itself, even though that information might have been shared by the committee.
In order to establish that information is privileged under the Colorado quality management privilege, Craig Hospital must show, at a minimum, that (1) it has a quality management program which has been approved by the Colorado department of public health and environment, and (2) the information claimed to be privileged was obtained and maintained in accordance with the approved program. Zander, 267 F.R.D. at 660 (citing Bush v. Dolan, 149 A.D.2d 799, 540 N.Y.S.2d 21, 23 (1989)).

V.
There is no indication that any documents were produced in response to the plaintiff's Request for Production No. 4, nor is there a clear statement that all responsive documents are claimed to be privileged. Instead, Craig Hospital provided the Supplemental Privilege Log [Doc. #134-3] identifying six documents responsive to the request but withheld from production as privilege.
A party resisting discovery based on a privilege has the burden of establishing that the privilege applies. Peat, Marwick, Mitchell & Co. v. West, 748 F.2d 540, 542 (10th Cir.1984). Under Fed. R.Civ.P. 26(b)(5)(A), when a party withholds documents based on a claim of privilege, the party must "expressly make the claim" and "describe the nature of the *1232 documents . . . and do so in a manner that, without revealing information itself privileged or protected, will enable other parties to assess the claim." This ordinarily is accomplished through a privilege log. A privilege log is sufficient if it describes in detail the documents sought to be withheld and provides the precise reasons supporting the claim of privilege. Hill v. McHenry, 2002 WL 598331 at *2 (D.Kan.2002). The information provided must be sufficient to enable opposing parties and the court to determine whether each element of the asserted privilege is satisfied; a blanket claim of the asserted privilege does not satisfy the burden of proof. Id. Generally, a privilege log is adequate if it identifies with particularity the documents withheld, including their date of creation, author, title or caption, addressee and each recipient, and general nature or purpose for creation. In addition, the particular privilege relied on must be specified. A privilege log may be supplemented by an affidavit, deposition testimony, or other evidence, if necessary, to establish that each element of the asserted privilege has been met.
In this case, Craig Hospital relies primarily on the quality management privilege created by section 25-3-109, C.R.S., in support of its claim that the six withheld documents are privileged. Craig Hospital has identified five documents within its quality management program, however, each of which describes a quality management function: (1) the Performance Improvement Plan; (2) the Risk Management Plan; (3) the Sentinel Event Plan; (4) the Failure Mode Plan; and (5) the QP Plan. Craig Hospital has failed to identify the particular quality management function under which the withheld documents were prepared. To the contrary, Craig Hospital expressly refused to allow deposition testimony designed to determine the quality management function involved in connection with the withheld documents. Although Craig Hospital relies on the Affidavit of Dana Polonsky [Doc. #134-4] (the "Polonsky Aff.") in support of its assertion of the quality management privilege, the following exchange occurred during Ms. Polonsky's deposition:
Q: And can you tell me which quality management planunder which quality management plan the investigation of Karen Zander's surgery was undertaken.
MR. COOPER: Objection, instruct her not to answer.
Deposition of Dana Polonsky, P.T. [Doc. #139-6] (the "Polonsky Depo."), at p. 19 lines 17-22.
The instruction not to answer was improper.[4] The basis for asserting a privilege is not itself privileged, and in this case, where Craig Hospital has identified *1233 five distinct quality management functions defined by five different documents as composing its quality management program, the plaintiff is entitled to know which quality management function was alleged to be involved in the creation of each allegedly privileged document. Identifying and substantiating the applicability of the quality management function which Craig Hospital asserts to have followed is not privileged because it does not involve the disclosure of records, reports, or other information used to identify, evaluate, or reduce the risk of patient injury or to improve the quality of patient care.
Notwithstanding the improper objection, Craig Hospital has identified in argument, and it does not appear to be contested, that the Sentinel Event Plan is the quality management function involved here and pursuant to which the withheld documents were created. See Supplemental Response [Doc. #140] at p. 1 (where Craig Hospital asserts that it was applying the "Sentinel Events/Adverse Events/Near Miss Policy. . . in initiating and conducting its Root Cause Analysis"); and Second Motion to Compel [Doc. #125] at p. 7 (stating that "Plaintiff assumes Defendant Craig Hospital is asserting the Colorado Quality Management Privilege pursuant to its sentinel event/adverse event/near miss policy"). Consequently, I find that with respect to the six withheld documents, Craig Hospital has adequately identified the particular privilege relied upon.
The Sentinel Event Plan provides:
A formal root cause analysis will be conducted for events that meet the definition of a sentinel event or other events requiring intense analysis. . . . Root cause analysis is a process for determining the most basic causal factors underlying a variation in performance or equipment malfunction and focuses on systems and processes, not on individual performance.
Sentinel Event Plan [Doc. #125-6] at p. 2. In this case, Craig Hospital asserts that Ms. Zander's surgery constituted an "Adverse Event" falling under the Sentinel Event Plan because the outcome constituted an event "with serious negative consequences." Id.
In order to invoke the quality management privilege pursuant to Craig Hospital's Sentinel Event Plan, an "Occurrence (Incident) Report" must be "completed"; the president of Craig Hospital or his designee must "call a sentinel event committee meeting"; after which the sentinel event committee is "responsible for conducting a root cause analysis. . . ." Id. at pp. 2-3. The sentinel event committee is to be composed of "the Vice President of Clinical Services, the Vice President of Patient Care Services, the Medical Director or designee, the Chair of the Quality Council, and, as deemed appropriate, pertinent hospital staff and/or physicians." Id. at p. 3.
The Polonsky Affidavit establishes that there was an occurrence report[5] and that *1234 a root cause analysis was instituted. Polonsky Aff. [Doc. #134-4] at ¶ 3, 5. The Supplemental Privilege Log demonstrates that the withheld documents were prepared by and distributed only to members of the sentinel event committee. In addition, with respect to each of the six withheld documents, Craig Hospital has adequately identified the document's date, author, title or caption, addressee and recipients, and general purpose. Craig Hospital has met its burden to establish the applicability of the quality management privilege with respect to each of the six withheld documents.
Craig Hospital has failed to assert or establish a privilege protecting from disclosure other documents (if any) responsive to the plaintiff's Request for Production No. 4. Those documents, if any, must be produced.

VI.
Dr. Falci testified as follows about an investigation he initiated:
Q (By Ms. Brown) Dr. Falci, as Karen Zander's neurosurgeon and as the chief consulting neurosurgeon, you had access to Karen Zander's medical records and outside of the quality assurance process to gather facts about what happens with your patients; is that fair?
* * *
A Okay. When the case was over and Karen was clearlyhad a clear profound deficit, I was devastated. So, I mean, the first thing that comes to mind, what happened, how did this happen. And my first assumption was, well, I just did it. I mean, it wasthe untethering went as we anticipated, and her spinal cord and nerve roots just did not tolerate the little bits of traction that it took to untether the cord.
You don't cut the cord. You cut the scar tissue around it, but that necessarily causes little tugs on here and there, so I assumed my luck had run out, Karen's as well, and I paralyzed her.
So that was my initial assumption, that I had just done that. I did go on to investigate this further because Karen and family and everybody asked me to. This would be the day after surgery, Saturday. I had met a lot of people and so forth. And I reviewed radiology reports, I, you know looked at records and then, ultimately, I put in a call to Dr. Best, who was still a consultant at Craig. I asked him, you know, please pull all preoperative SSEPs monitoring and operative SSEPs monitoring and just tell me if you see any issues, anything about it.
MR. COOPER: I'm going to object. Now we're at peer review.
Q (By Ms. Brown) Well, wait. Let me ask you a question about that. Let me ask a question.
Dr. Falci, was this an investigation that you undertook on your own for your own purposes and not as part of a QA review for Craig Hospital?
* * *
MS. BROWN: I would like an answer to my question, which is did Dr. Falci do this on his own for his own answer or did he do it for purposes of quality assurance at Craig Hospital?
* * *
A Okay. I did that on my own prior to the quality assurance process.
*1235 Deposition Transcript of Scott Falci, M.D. [Doc. #39-2, filed 2/15/2010] at p. 89 line 18 through p. 94 line 9 (emphasis added).
Dr. Falci's investigation, undertaken on his own, was outside the scope of Craig Hospital's quality management program and is not privileged. Dr. Falci's "belief and expectation" that Craig Hospital would initiate a quality management review, Affidavit of Scott Falci, M.D. [Doc. #140-3] (the "Falci Aff.") at ¶ 2, does not alter the independent nature of Dr. Falci's investigation or make it privileged. See, e.g., Shelton, 347 S.E.2d at 829 (applying an analogous North Carolina statute and holding that information learned by a member of a medical review committee "from sources other than the committee itself, even though that information might have been shared by the committee," is not privileged). Although Dr. Falci has stated that he "did not prepare any documents or notes as part of the quality management process," Falci Aff. [Doc. #140-3] at ¶ 3 (emphasis added), there is no indication about whether he prepared documents in connection with or as a part of his independent investigation. Any such documents are not privileged and are subject to discovery.

VII.
IT IS ORDERED that the Second Motion to Compel is GRANTED IN PART and DENIED IN PART as follows:
(1) GRANTED with respect to all documents, if any, responsive to plaintiff's Request for Production No. 4 other than the six withheld documents identified in Craig Hospital's Supplemental Privilege Log [Doc. #134-3];
(2) GRANTED insofar as it seeks an order finding that Dr. Falci's independent investigation is not privileged; and
(3) DENIED with respect to the six withheld documents identified in Craig Hospital's Supplemental Privilege Log [Doc. #134-3].
NOTES
[1]  The plaintiff initially included a claim against Dr. Falci for medical negligence, but that claim has been dismissed. Order Dismissing Defendant, Scott Falci, M.D., Only [Doc. #14].
[2]  Craig Hospital's relevancy and overbreadth objections lack merit. The production request seeks documents created in connection with an investigation of the events which underlie the plaintiff's claims. The requested documents obviously are relevant to those claims or are reasonably calculated to lead to the discovery of admissible evidence, and the request is not overbroad.
[3]  Craig Hospital claims that three of the documents also are privileged under a peer review privilege, citing section 12-36.5-101, C.R.S.
[4]  The Polonsky Deposition is filled with improper objections and instructions not to answer based on an assertion of the quality management privilege. Among others, the following were proper questions which Ms. Polonsky should have been allowed to answer, and defense counsel improperly instructed Ms. Polonsky not to answer:

 "Was there an occurrence or incident report filled out on behalf of Ms. Zander?" Polonsky Depo. [Doc. #139-6] at p. 24 lines 20-23;
 "Is there a separate set of quality management documents that apply to occurrences or incidents that occur outside of Craig Hospital?" Id. at p. 40 lines 19-24;
 "Did the president of Craig Hospital or yourself review an incident report, evaluate the incident and gather facts to determine if Ms. Zander's case was a sentinel event?" Id. at p. 41 lines 15-22;
 "[W]as Ms. Zander's case determined to be either a sentinel event or an event requiring intense analysis?" Id. at p. 42 lines 9-14;
 "Was a root cause analysis investigation instituted for Ms. Zander's case?" Id. at p. 42 lines 15-19;
 "Does there exist a final report that includes the root cause analysis and process improvement plan?" Id. at p. 42 lines 20-24;
 "Were you provided with the root cause analysis worksheet?" Id. at p. 65 lines 7-10;
 "And how is it thathow is it that who decides who iswho becomes members of the RCA?" Id. at p. 109 lines 13-17;
 "Is there anything in Craig's quality management program that prohibits people actually involved in the care to serve on the quality management [program]?" Id. at p. 109 lines 18-25;
 "[I]s there any written statements or interviews that were taken as part of the quality management process?" Id. at p. 110 lines 8-13; and
 "And is it true that that investigation began when the event was reported to you by Kelly Johnson?" Id. at p. 113 lines 1-5.
[5]  The plaintiff argues that this requirement was not satisfied because the occurrence report was not in writing. Second Motion to Compel [Doc. #125] at ¶ 22. The Sentinel Event Plan does not specifically require a written incident report. Even if it did, it is not clear that allowing an oral incident report in place of a written report would result in a waiver of the quality management privilege.
