Duty to Warn in Colorado: Triggers, Immunity, and HIPAA

Under Colorado’s duty to warn, a mental health provider must take reasonable and timely steps to notify a threatened person and alert law enforcement when a patient communicates a serious threat of imminent physical violence against a specific person, group, or identifiable location. The rule is codified at C.R.S. 13-21-117, and it cuts both ways: providers who warn in good faith are immune from civil suit, and providers who fail to warn when the statutory trigger is met can be sued and disciplined.¹

What Triggers the Duty

The trigger is narrow, and every word carries weight. A duty arises only when a patient communicates a serious threat of imminent physical violence against a specific person or persons. The statute also covers threats aimed at people identifiable by their connection to a specific location or entity, such as employees at a named workplace or students at a named school.¹

Break the trigger apart and you get four conditions that must all be present:

The patient actually expressed the threat to the provider.
The threat is serious, not offhand or clearly rhetorical.
The violence is imminent, not a vague future possibility.
The target is specific: a named person, a defined group, or an identifiable place.

Miss any one of those and the statute imposes no duty, and the provider cannot be held civilly liable for failing to predict violence. A patient who says “I’m going to kill my neighbor tonight” has crossed the line. A patient who says “sometimes I think about hurting people” has not. Most of the hard calls sit somewhere between those two statements, and clinical judgment is what closes the gap.

What the Provider Must Do

Once the trigger is met, the statute requires reasonable and timely steps. In practice, that means two things at minimum: notify the threatened person (or, for threats against a location or entity, the person responsible for that location) and notify an appropriate law enforcement agency. The statute also permits other appropriate actions and specifically names hospitalization as one option.¹

Hospitalization connects to Colorado’s emergency mental health hold under C.R.S. 27-65-106, which allows a person to be held for up to 72 hours if an intervening professional reasonably believes the person has a mental health disorder and is an imminent danger to themselves or others.² A provider facing a credible imminent threat can move on both tracks at once: initiate a hold to contain the immediate danger while notifying the intended victim and police.

Timeliness is not optional. The statute uses the phrase “reasonable and timely,” and the word “imminent” in the trigger already tells you the clock is short. A provider who identifies a qualifying threat on Friday afternoon and waits until Monday morning to make calls has almost certainly fallen short of the standard.

Who Counts as a Mental Health Provider

The statute defines “mental health provider” broadly. It covers physicians, social workers, psychiatric nurses, psychologists, and other mental health professionals, and it extends to mental health hospitals, behavioral health entities, other institutions, and their staff.¹ The duty isn’t confined to the treating therapist. It reaches intake workers, nurses on a psychiatric unit, and other institutional staff who directly receive a threat from a patient.

Immunity for Warning in Good Faith

A provider who warns a specific person or group, or who warns the person responsible for a threatened location, cannot be held civilly liable for making that disclosure or for predicting violent behavior.¹ The immunity exists for a reason. Without it, providers would sit between two possible lawsuits: one for disclosing when the threat turned out to be hollow, and one for staying quiet when the threat turned out to be real. The statute resolves that by protecting warnings made in good faith.

That structure should shape how providers approach genuinely borderline cases. When the call is close, the legal risk of warning is essentially zero, and the legal risk of silence can be substantial if the threat materializes. The statute leans providers toward action on close calls.

What Happens if a Provider Fails to Warn

The statute is written as an immunity with an exception. It first declares that mental health providers are not liable for failing to warn or protect against a patient’s violence, then carves out the exception for cases where the patient has communicated a serious, imminent, specific threat.¹ Once the exception applies, the victim or the victim’s family can sue.

Litigation in these cases usually turns on two questions. Did the patient actually communicate a threat that met the statutory threshold? And did the provider take reasonable, timely action once the threshold was crossed? A vague, non-specific, or non-imminent statement leaves the provider inside the statute’s general immunity. A recognized threat followed by prompt notification and documentation puts the provider in a defensible position. A recognized threat followed by nothing does not.

Damages in a failure-to-warn suit can include medical costs, lost income, pain and suffering, and, in wrongful death cases, the full range of wrongful death damages under Colorado law. A finding of liability also affects malpractice premiums and future coverage.

Licensing Board Exposure

Civil liability isn’t the only consequence. Colorado’s Department of Regulatory Agencies oversees mental health licensing, and a failure to fulfill the duty can trigger administrative discipline separate from any lawsuit. Under C.R.S. 12-245-226, a licensing board can impose probation with practice conditions, require examinations, mandate additional training, restrict the scope of practice, or issue confidential letters of concern, and in serious cases it can suspend or revoke a license.³ Board proceedings are generally public, and probationary restrictions can end institutional affiliations even without a civil judgment.

How Courts Read the Trigger

The clearest interpretation of Colorado’s statute comes from the Tenth Circuit’s 2010 decision in Fredericks v. Jonsson. Dr. Mary Margaret Jonsson, a psychologist, evaluated Troy Wellington for the Colorado probation department. During the evaluation, Wellington told her he “used to have frequent violent fantasies involving members of the Fredericks family, but that he no longer had violent thoughts directed at them.” Dr. Jonsson did not warn the family or the probation department. Two weeks later, Wellington attempted to break into the Fredericks’ home.⁴

The court ruled for Dr. Jonsson. Wellington had described past fantasies, not a present threat. The duty to warn under Colorado law, the Tenth Circuit held, is triggered only when “the patient himself predicts his violent behavior” by expressing a current threat to the provider. Disclosure of past violent thoughts, without a current statement of intent, does not cross the line, even if the patient later acts violently.⁴ The case is the working example of where the statute’s boundary sits.

HIPAA and the Warning

Providers bound by HIPAA sometimes hesitate to warn because they worry about the federal privacy rule. HIPAA does not block a warning made under Colorado’s statute. 45 CFR 164.512(j) allows a covered entity to disclose protected health information when the provider, in good faith, believes the disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public, and the disclosure is made to someone reasonably able to prevent or lessen the threat, including the target.⁵ Colorado’s statute requires the disclosure; HIPAA permits it.

HIPAA’s minimum necessary standard still applies. Share what law enforcement or the intended victim needs to act on the threat, and stop there. Handing over an entire treatment file when a targeted warning would do can create HIPAA exposure even when the underlying warning was proper.

Documentation That Protects You

If a duty-to-warn case ends up in court, the provider’s contemporaneous notes are the primary evidence of what the patient said, how the provider assessed the threat, and what the provider did next. Charts written days later carry far less weight than notes made in the moment.

Useful documentation captures the patient’s specific statements as close to verbatim as possible, the provider’s assessment against the statutory elements, the risk factors weighed, and the actions taken. If the conclusion was that the threat didn’t cross the statutory line, the reasoning behind that conclusion belongs in the record too. Providers in forensic, inpatient, and high-risk settings often use structured professional judgment tools to support their evaluations; whichever framework a provider uses matters less than whether the assessment is systematic, documented, and defensible.

1
Justia Law. Colorado Code 13-21-117 – Civil Liability – Mental Health Providers – Duty to Warn – Definitions
2
Justia Law. Colorado Revised Statutes Section 27-65-106 – Screening
3
FindLaw. Colorado Revised Statutes Title 12 – Section 12-245-226
4
Justia Law. Fredericks v. Jonsson, No. 09-1169
5
eCFR. 45 CFR 164.512 – Uses and Disclosures for Which an Authorization or Opportunity to Agree or Object Is Not Required