Duty to Warn in Arizona: Triggers, Immunity, and Confidentiality

In Arizona, a mental health provider’s duty to warn is narrow: you only owe it when a patient makes an explicit threat of imminent serious physical harm or death against a clearly identified or identifiable victim, and the patient appears to have both the intent and the ability to carry it out. ARS 36-517.02 starts from the opposite of what most people assume. The default is that no cause of action exists against you for harm a patient causes to someone else. Liability arrives only when the statute’s two triggering conditions are both present and you fail to take reasonable precautions.¹

When the Duty Is Triggered

Two conditions must exist at the same time before you have any obligation to act:¹

The patient has communicated an explicit threat of imminent serious physical harm or death aimed at a clearly identified or identifiable victim. Vague hostility, generalized anger, and threats against unnamed groups do not qualify.
The patient appears to have both the intent and the ability to carry the threat out. A threat voiced without any apparent means to follow through does not, by itself, trigger the duty.

Neither condition alone is enough. A specific, chilling threat against a named person still falls outside the statute if the patient has no realistic capacity to act on it. Access to weapons, proximity to the victim, and history of violence are the sorts of factors that push a threat over the ability line. Clinical judgment does real work at this step, and it is the assessment itself, not just the patient’s words, that the statute expects you to make.

What Counts as an Identifiable Victim

The victim does not have to be named by full legal name. The statute uses “clearly identified or identifiable,” and in practice that covers situations where a patient describes a target closely enough that you can reasonably determine who is meant. A patient who says “my ex-wife’s new boyfriend” has identified a victim if you can figure out who that is. The American Psychiatric Association describes the standard as “a specific (or at least a reasonably identified victim).”² Threats against categories of people, or against someone you have no way of locating, sit in harder territory. No bright-line rule covers every scenario, which is one reason the statute closes with a catch-all requiring whatever a reasonable provider would do.

What You Have to Do to Discharge the Duty

Once both triggering conditions are present, ARS 36-517.02 gives you a checklist. Your duty is fully discharged when you do all of the following:¹

Notify identifiable victims when possible. Every person you can identify as a potential target should be warned, and the “when possible” language acknowledges that some victims may not be reachable despite a genuine effort.
Notify a law enforcement agency in the area where the patient or the potential victim lives. This gives authorities a chance to intervene and creates a documented record that you acted.
Pursue voluntary or involuntary hospitalization if appropriate. Arizona’s involuntary evaluation process under ARS 36-520 lets any responsible person apply for court-ordered evaluation of someone who is a danger to others as a result of a mental disorder.
Take any other reasonable precautions under the circumstances, such as adjusting the treatment plan, increasing session frequency, or coordinating with other providers.

The word “all” matters. Warning the victim alone does not discharge the duty. Calling the police alone does not either. The statute expects you to work through every applicable step, though the hospitalization item carries an “if appropriate” qualifier that recognizes inpatient care is not always warranted or available.

Immunity for Disclosure

The statute’s immunity provision is deliberately broader than the trigger for liability. You are immune from being sued for disclosing confidential patient communications whenever the patient has explicitly threatened serious harm to a person, or whenever you reasonably conclude that the patient is likely to cause serious harm, as long as you disclose to reduce that risk.¹

The gap between the two standards is intentional. Liability requires an explicit threat, an identifiable victim, and apparent intent plus ability. Immunity kicks in on a lower bar: a reasonable conclusion that the patient is likely to cause serious harm is enough. Even without a textbook threat, you can act on clinical judgment and remain protected. The statute leaves room to warn early rather than waiting for the picture to become unambiguous.

Does Warning Someone Breach Confidentiality?

Arizona’s mental health confidentiality statute, ARS 36-509, generally requires health care entities to keep patient records and information private. It also carves out an exception for disclosure to law enforcement when necessary to “avert a serious and imminent threat to an individual or the public.”³ That exception aligns with the duty-to-warn framework. When a patient’s threat triggers your obligation under ARS 36-517.02, ARS 36-509 independently permits the disclosure you need to make.

Providers sometimes hesitate to warn because they worry the patient will sue them for breaching confidentiality. Both statutes address that concern. ARS 36-517.02 provides immunity for disclosures made to reduce the risk of harm, and ARS 36-509 authorizes the disclosure in the first place. A provider acting in good faith under these provisions is protected on both fronts.

What Happens If You Do Not Warn

If both triggering conditions are present and you fail to take reasonable precautions, you lose the default protection the statute otherwise provides. A cause of action can then proceed against you for failing to prevent the harm the patient caused.¹ The victim or the victim’s family can sue you for damages, and the case will turn on whether you knew of the explicit threat, whether the victim was identifiable, and whether your response fell short of what a reasonable provider would have done.

Documentation is where these cases are won or lost. If your records show that you assessed the threat, weighed the patient’s intent and ability, and worked through the discharge checklist, you have a strong defense even if the outcome was tragic. Without documentation of your assessment or response, defending the case becomes much harder.

Who the Statute Covers

Arizona defines “mental health provider” broadly. Under ARS 36-501, the term reaches any physician or provider of mental health or behavioral health services involved in evaluating, caring for, treating, or rehabilitating a patient.⁴ Psychiatrists, psychologists, licensed clinical social workers, licensed professional counselors, marriage and family therapists, and psychiatric nurse practitioners all fall within that scope. If you provide mental health or behavioral health services in a treatment or evaluation capacity, the duty-to-warn statute applies to you.

1
Arizona Legislature. Arizona Revised Statutes 36-517.02 – Limitation of Liability; Exception; Discharge of Duty; Immunity for Disclosure
2
NCBI Bookshelf. Duty to Warn
3
Arizona Legislature. Arizona Code 36-509 – Confidential Records; Immunity; Definition
4
Arizona Legislature. Arizona Code 36-501 – Definitions