5 Step Duty to Warn Checklist for Clinicians
Yes: in most U.S. states, clinicians either must or may disclose confidential information when a patient poses a serious risk to an identifiable person, though the exact rule depends on the state where you practice. Clinicians typically look for three things before acting: a specific and credible threat, a victim who can be identified, and evidence the patient has the capacity to act on the threat. Federal privacy law permits limited disclosure in these situations, but state law controls whether a clinician is required to act, permitted to act, or left without clear guidance. When any of these conditions are uncertain, document the reasoning and consult counsel or risk management before proceeding.
Table of Contents
What duty to warn and duty to protect mean, and why Tarasoff matters
The phrase “duty to warn” describes a clinician’s potential obligation to notify a specific, identifiable victim that a patient has threatened harm. “Duty to protect” is broader, as it covers any reasonable step a clinician might take to prevent violence, which could include warning a victim but might also mean contacting law enforcement, pursuing civil commitment, or adjusting a treatment plan. The two terms get used interchangeably in casual conversation, but the distinction matters when a clinician is deciding what to actually do.
This entire area of law traces back to a pair of California Supreme Court decisions known together as Tarasoff v. Regents of the University of California. The court held that once a therapist determines, or reasonably should determine, that a patient presents a serious danger to another person, the therapist has an obligation to exercise reasonable care to protect the intended victim. That obligation could be satisfied several different ways, not only by warning the victim directly.
Tarasoff did not create a nationwide statute. It established a legal principle that individual states then adopted, modified, or rejected through their own legislatures and courts. That is why the current landscape looks less like a single national rule and more like fifty separate answers to the same question.
A few distinctions are worth holding onto as you read the rest of this piece:
Warning is a specific act: notifying an identifiable victim or law enforcement about a threat.
Protecting is a category of acts: warning is one option among several, alongside hospitalization, commitment proceedings, or treatment changes.
Statutory duties are created by state legislatures and spell out exact requirements.
Common-law duties come from court decisions interpreting a state’s general negligence principles when no statute exists.
Clinicians working across state lines, including in telehealth, need to understand which framework applies to the state where the patient is physically located at the time of the session, not necessarily where the clinician is licensed or based.
How states handle the duty: mandatory, permissive, or no clear rule
There is no single American duty to warn law. Instead, states fall into three general categories, and the category your state falls into changes what you are required, permitted, or left to figure out on your own.
Mandatory duty states have statutes that require clinicians to take specific action once the legal threshold is met, often warning the victim, notifying law enforcement, or both. These states typically also provide clinicians some legal protection when they act in good faith under the statute.
Permissive duty states give clinicians the discretion to disclose information without being required to. The clinician who chooses to warn is usually protected from a breach of confidentiality claim, but nothing forces the disclosure. This sounds like flexibility, but it can create its own problems: a peer-reviewed review in the APA’s Focus found that permissive statutes tend to offer clinicians less predictable protection than mandatory ones, since courts have more room to second-guess a discretionary choice after the fact.
States with no statutory guidance leave the question to common law, meaning courts decide case by case whether a duty existed and whether it was met. This is the most legally uncertain category to practice in, because the standard is built from prior court rulings rather than a clear statutory checklist.
According to the National Conference of State Legislatures, most states have adopted a law that either requires or permits mental health professionals to disclose information about a patient who may become violent, though the specific triggers, required recipients, and immunity language vary considerably from state to state. Some statutes name only law enforcement as an acceptable recipient of a warning; others require the clinician to also attempt to notify the victim directly. Some define a duty as arising only when there is a threat against a specifically named person; others extend the duty to a reasonably identifiable group.
Given that variation, treat any general summary, including this one, as a starting point rather than a final answer. Before relying on a state’s rule in practice:
Locate the actual statute text for your state through your state legislature’s website or a state bar resource.
Check the NCSL summary for a plain-language overview and citation to the underlying code section.
Confirm whether your state’s rule has been updated recently, since several states have revised their duty-to-warn statutes in the past decade.
Ask your employer’s risk management or legal counsel which category your state falls into and how your organization’s policy reflects it.
If you work in more than one state, or treat patients through telehealth across state lines, this step is not optional. The rule that protects you in one jurisdiction may not exist in the next.
The legal elements clinicians must actually assess
Regardless of which category your state falls into, the core legal analysis tends to rest on the same handful of elements. Understanding them helps you organize your clinical judgment into something a court, or your own documentation, can later follow.
Identifiable victim. Most statutes and the original Tarasoff standard require the threat to name or clearly point to a specific person, not a vague or generalized statement of anger. A patient saying “I want to hurt someone” is different, legally, from a patient naming a former partner, coworker, or family member.
Specificity of the threat. Courts and statutes generally distinguish between a fleeting expression of frustration and a threat with enough detail, a plan, a method, a stated intent, to be taken seriously.
Imminence and seriousness. This is often the hardest element to pin down. Clinicians are asked to weigh how soon harm might occur and how severe it would be, not just whether a threat was made. According to StatPearls, clinical commentary increasingly emphasizes weighing a patient’s demonstrated capacity and history of violence more heavily than trying to pin an exact timeframe on the word “imminent,” since a rigid clock rarely matches how real threats unfold.
Capacity and means. Has the patient described a specific method? Do they have access to a weapon or other means? Is there a documented history of violence, prior attempts, or escalating behavior that supports the threat being more than words?
In practice, these elements work together rather than as a strict checklist. A vague threat against a named person carries different weight than a highly specific plan against an unnamed but easily identifiable group, such as “everyone at my old job.”
Pro Tip: When in doubt, document the reasoning behind your risk assessment as thoroughly as the assessment itself. A court reviewing your decision later will weigh what you knew and how you reasoned through it, not just the outcome.
Where HIPAA fits: the permitted disclosure exception
Clinicians sometimes assume HIPAA blocks any disclosure of a threat, full stop. It does not. Federal privacy regulations include a specific carve-out for exactly this situation.
Under 45 CFR §164.512(j), a covered entity may disclose protected health information, without the patient’s authorization, when the disclosure is made in good faith and is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public. The regulation allows disclosure to the person or persons reasonably able to prevent or lessen the threat, which can include the potential victim, law enforcement, or another party positioned to intervene.
A covered entity may, consistent with applicable law and standards of ethical conduct, disclose protected health information if it believes in good faith that the disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public. 45 CFR §164.512(j), summarized from the federal regulation text
This provision is permissive at the federal level, meaning it removes a privacy barrier rather than creating an independent legal duty to disclose. Whether a clinician must disclose, may disclose, or has no clear guidance still depends on state law. HIPAA simply clears the way so state law can operate without a federal privacy conflict.
A few practical limits matter here. The disclosure should be limited to the information reasonably necessary to prevent the harm, not the patient’s full clinical record. Clinicians should document the good-faith basis for believing the threat was serious and imminent at the time of disclosure. And when a choice exists between notifying law enforcement or contacting the potential victim directly, many clinicians and institutional policies favor involving law enforcement first, since officers are typically better positioned to verify the threat and intervene safely.
A practical checklist for the moment a threat appears
When a patient discloses something that raises concern, the sequence of decisions in the following minutes and hours matters both clinically and legally. A clear internal workflow reduces hesitation and creates the kind of record that supports a defensible decision later.
Assess safety first. If there is immediate danger, calling 911 or initiating an emergency evaluation for possible civil commitment takes priority over any documentation step.
Identify who needs to be involved. This may include a clinical supervisor, an institution’s risk management or legal team, and, depending on the state and situation, law enforcement or the potential victim.
Limit what you share. Disclose only the information necessary to prevent the harm, consistent with the federal permitted-disclosure standard, rather than the patient’s broader history.
Document as you go, not after the fact. A useful record includes the exact content of the threat, the risk factors you considered, your reasoning for the action taken, any attempts to contact a victim or authorities, consultations with colleagues or supervisors, and the follow-up plan for the patient’s ongoing care.
Consider alternatives to disclosure. Adjusting the treatment plan, increasing session frequency, involving family with the patient’s consent, or pursuing voluntary or involuntary commitment can sometimes address the risk without a third-party warning at all.
Across the clinical and legal literature, one point comes up more consistently than almost any other: thorough, contemporaneous documentation is repeatedly identified as the single strongest factor in defending a clinician’s decision, according to reviews summarized in StatPearls and the APA’s Focus journal. A well-reasoned record, even one that later turns out to reflect an imperfect prediction, tends to protect clinicians far more than the outcome of the case itself.
For organizations, this checklist works best when it exists as a written protocol before a crisis happens, not something staff improvise under pressure. CVPSD’s informal duty-to-intervene protocol outlines a similar documentation-first structure for frontline staff, which translates well to a clinical setting.
How courts have applied the duty in real cases
The original Tarasoff decisions remain the most cited authority in this area, but state courts and legislatures have built considerably on that foundation over the decades since. A few patterns are worth understanding.
The Tarasoff opinion itself held that the special relationship between a therapist and patient can create a duty to third parties once a serious danger is identified, a significant departure from the traditional rule that mental health providers owed duties only to their own patients.
States that adopted mandatory statutes following Tarasoff generally spelled out exactly what triggers the duty and to whom the warning must go, which gives clinicians a clearer standard to meet and, often, statutory immunity when they meet it.
States that adopted permissive statutes preserved clinician discretion but left more room for after-the-fact litigation over whether the discretion was exercised reasonably.
An analysis of appellate cases published in the Journal of the American Academy of Psychiatry and the Law found that permissive statutes are associated with greater litigation uncertainty than mandatory ones, and that courts more often sided with clinicians who acted in good faith under a clearly defined mandatory standard.
Later cases, including litigation summarized in law review analysis of Volk v. DeMeerleer, reinforced that the duty to protect can be satisfied through multiple routes: hospitalization, notifying law enforcement, initiating commitment proceedings, or modifying treatment. Warning the victim directly is one option, not the only one.
The throughline across these cases is that courts are less interested in whether a clinician predicted violence correctly than in whether the clinician’s process was reasonable given what was known at the time.
Legal defenses, liability risk, and what draws court scrutiny
Clinicians who act under a mandatory or permissive statute typically receive some form of statutory immunity or hold-harmless protection, provided the action was taken in good faith and consistent with the statute’s requirements. That protection has limits: it generally does not cover reckless disregard of obvious risk, and it rarely helps a clinician who took no action at all when the threshold was clearly met.
A few patterns show up repeatedly in the legal literature on this topic.
Good-faith action, even when imperfect, tends to be protected, while inaction in the face of a clear threat tends to draw the most scrutiny.
Documentation quality often decides close cases. A record showing careful reasoning, consultation, and timely follow-through carries far more weight than the ultimate outcome.
Inpatient and forensic settings face heightened scrutiny, since courts view clinicians who control a patient’s liberty, through hospitalization, commitment, or supervised release decisions, as having more direct ability to prevent harm.
Failure to escalate a known risk, such as not involving a supervisor or risk management when a case exceeds an individual clinician’s comfort level, is treated as its own kind of liability exposure.
The JAAPL analysis frames duty to protect as a standard of reasonable care rather than a guarantee against harm, meaning liability tends to follow a failure of process, not an unforeseeable outcome.
When to bring in counsel or risk management
Legal ambiguity is common enough in this area that consulting local counsel or an organization’s risk management team should be treated as a normal part of the process, not a last resort. Clear triggers for that consultation include any case where the victim is not clearly identifiable, where your state’s statute is silent or ambiguous, where the patient is in an inpatient or forensic setting, or where you are genuinely unsure whether the threat meets your state’s threshold. Document that you sought consultation, when, and what was discussed, since that record itself becomes part of your defensible file.
Organizations reduce this uncertainty by building protocols before a crisis occurs: written escalation chains, defined documentation templates, and regular staff training that keeps the statutory framework fresh rather than something staff half-remember from graduate school. CVPSD has integrated behavioral threat assessment and management training into its curriculum specifically to help organizations build that kind of structured, repeatable process.
Pro Tip: Treat your state’s duty-to-warn statute and your organization’s internal protocol as two separate documents that need to agree with each other. A policy that contradicts the actual statute creates confusion exactly when clarity matters most.
Balancing confidentiality and safety in practice
Confidentiality and safety are not opposing goals, though they can feel that way in the middle of a difficult session. Clear training and clear policy make the choice easier precisely because they remove the guesswork at the moment it matters most. A clinician who has already walked through the elements of the duty, practiced the documentation habit, and knows who to call does not have to build that judgment from scratch under pressure.
Some training programs aim to teach defensible, practical steps for exactly these situations, alongside broader crisis intervention and de-escalation skills that help prevent a crisis from reaching this point in the first place. This training does not replace legal advice, and it should not be mistaken for it.
What such training does is give clinicians and the staff around them a shared framework to act within, so that when a genuine threat surfaces, the response is calm, consistent, and grounded in preparation rather than improvisation.- Shawn Lebrock
Preparing your organization for duty-to-warn situations
Understanding the law is only half the work. The other half is making sure your staff can recognize a genuine threat, respond calmly, and document the decision correctly when it counts. That is where CVPSD’s training programs fit into the picture, giving healthcare, education, behavioral health, and government organizations a practical way to translate legal obligations into day-to-day readiness.
Our ConflictIQ™ training programs build the behavioral analysis and de-escalation skills clinicians and frontline staff need to assess risk calmly and respond appropriately, including scenarios that touch on threat recognition and escalation protocols. For organizations that need something built around their own policies and state’s legal framework, our Customized Training engagements let you shape the curriculum around your specific setting, whether that is inpatient care, outpatient practice, or a school district.
CVPSD’s self-paced conflict resolution training gives individual clinicians a flexible starting point for building these skills.
The ConflictIQ™ series scales from foundational co-regulation and de-escalation skills through more advanced behavioral analysis modules.
Customized engagements let organizations align training directly with their state’s duty-to-warn statute and internal risk management protocols.
Legal counsel remains the only source for interpreting your state’s specific statute. What our training provides is the operational side: the skills and protocols that help your staff execute those legal obligations with confidence and consistency once the interpretation is settled.
Where to verify the law and research behind this guide
The legal and clinical points in this article draw on primary statutes, case law, and peer-reviewed sources that are worth reading directly if you need to apply this to a specific situation.
The original Tarasoff v. Regents of the University of California opinion, the foundational case in this area.
The National Conference of State Legislatures summary of state-by-state duty to warn statutes.
StatPearls on the clinical assessment and practice implications of duty to warn.
The federal permitted-disclosure regulation at 45 CFR §164.512.
The JAAPL analysis of appellate Tarasoff-related cases and litigation outcomes.
The APA’s Focus review of interstate variation and training gaps.
This article is general information, not a substitute for advice from a qualified lawyer. Consult a qualified legal professional about your own circumstances before acting on anything here.
Sources
FAQ
What states have duty to warn laws?
Most U.S. states have adopted some form of duty to warn or duty to protect law, whether mandatory, permissive, or built through court decisions rather than statute. The exact requirements, including who must be notified and under what conditions, vary by state, so check your specific state’s statute through the NCSL summary rather than assuming a uniform national rule.
What states are not duty to warn?
A smaller group of states has no statute directly addressing duty to warn or duty to protect, leaving the question to common law and prior court decisions rather than a clear legislative standard. This category creates more legal uncertainty for clinicians, since the standard develops case by case instead of through a defined statutory checklist, according to a review of interstate variation in APA’s Focus.
What are the legal requirements for duty to warn?
The requirements vary by state, but most frameworks ask clinicians to weigh whether the threat names or clearly points to an identifiable victim, whether it is specific enough to be credible, and whether the patient shows the capacity or means to carry it out. Federal law, specifically 45 CFR §164.512(j), permits limited disclosure of health information to prevent a serious and imminent threat, but state law determines whether the clinician must act, may act, or has no clear statutory guidance.
Can you give me an example of duty to warn?
The Tarasoff v. Regents of the University of California case is the clearest example: a patient told his therapist he intended to kill a specific person, and the court later held that the therapist had an obligation to take reasonable steps to protect that identifiable victim once the danger was recognized. In practice today, an example might involve a patient naming a former partner and describing a specific plan, prompting the clinician to notify law enforcement or the potential victim consistent with their state’s statute.
Recommended
