The Tarasoff duty to warn requires a mental health professional to take protective action when a patient makes a serious, credible threat of violence against a reasonably identifiable person, even if that means breaking confidentiality. The rule traces to the California Supreme Court’s 1976 decision in Tarasoff v. Regents of the University of California, which held that a therapist’s duty to protect the public outweighs the privacy of the therapeutic relationship.1Justia. Tarasoff v. Regents of University of California Roughly two-thirds of states now impose some form of mandatory duty, and most of the rest at least permit therapists to break confidentiality when a patient threatens violence. The specifics vary enough that any clinician needs to know the rules of the state where they practice.
One clarification up front. The 1974 Tarasoff I ruling created a narrow duty to warn potential victims. On rehearing in 1976, Tarasoff II broadened the obligation to a duty to protect, meaning that warning the victim is one way to satisfy the duty but not the only way.1Justia. Tarasoff v. Regents of University of California Most states have adopted the broader framework, though “duty to warn” remains the common shorthand.
When the Duty Is Triggered
The duty does not attach every time a patient says something angry or unsettling. It requires a serious threat of physical violence directed at a reasonably identifiable person. Vague hostility, generalized frustration, or offhand comments about wanting to hurt “someone” do not meet the threshold.
A clinician assessing whether the threshold has been crossed looks at whether the threat names or clearly implies a specific person, whether the patient has the apparent means and opportunity to carry it out, and whether the danger is imminent rather than hypothetical. These are clinical judgments made under pressure, which is one reason documentation of the reasoning matters as much as the decision itself.
Who Counts as an Identifiable Victim
Courts have consistently held that the duty runs to identifiable individuals, not the public at large. A patient who says “I want to hurt people” without specifying anyone generally does not trigger the duty.
Group threats are harder. In 2020, a Pennsylvania court found that residents of a 40-unit apartment building were “readily identifiable” when a patient threatened a “neighbor,” reasoning that the provider could figure out on a moment’s reflection who was at risk. Other courts have drawn the line more narrowly. A handful of states use a broader “foreseeably endangered” standard that captures a wider set of potential victims than the identifiable-victim test.
Threats Communicated by Family Members
California’s codification of the duty, Civil Code Section 43.92, frames the trigger as a serious threat that the patient “has communicated to the psychotherapist.”2California Legislative Information. California Civil Code Section 43.92 Early readings of that language suggested the patient had to make the threat directly to the therapist. The 2004 California appellate decision in Ewing v. Goldstein rejected that interpretation, holding that when a patient’s family member shares the threat with the therapist for the purpose of furthering the patient’s treatment, the fact that the information did not come from the patient’s own mouth is not decisive.3FindLaw. Ewing v. Goldstein The reasoning in Ewing has influenced courts in other jurisdictions, though not every state has addressed the question.
Which Practitioners Are Covered
The original Tarasoff case involved a psychologist, but the duty has expanded well beyond that profession. It applies to essentially any licensed mental health practitioner providing treatment or assessment: psychiatrists, psychologists, clinical social workers, marriage and family therapists, and licensed professional counselors. Interns and trainees working under supervision are not exempt; their supervisors carry responsibility for ensuring the duty is met. If you hold a license that authorizes you to provide therapy, you are subject to the obligation in states that recognize it.
How to Discharge the Duty
Once the threshold is met, the practitioner must take affirmative steps. Which steps count depends on the state, but most jurisdictions accept some combination of the approaches below.
Warning the Victim and Contacting Law Enforcement
The most direct method is notification. The practitioner contacts the intended victim by phone, in person, or in writing, and alerts the law enforcement agency with jurisdiction over the victim’s or patient’s location. California’s statute specifically provides that a therapist discharges the duty by making reasonable efforts to communicate the threat both to the victim and to a law enforcement agency.2California Legislative Information. California Civil Code Section 43.92 Share only what is necessary to prevent the harm: the patient’s name, the nature of the threat, and the identity of the target. Disclosing unrelated clinical details risks a separate privacy violation.
Clinical Alternatives
Because Tarasoff II established a duty to protect rather than merely warn, many states allow the practitioner to fulfill the obligation through clinical intervention instead of, or in addition to, victim notification. Voluntary or involuntary hospitalization, civil commitment proceedings, medication adjustments, increased session frequency, and arranging for weapons to be removed from the patient’s home are recognized approaches in various states. Several states explicitly list hospitalization as a way to discharge the duty. This flexibility matters because notifying a victim is not always the safest or most effective intervention.
Documentation
Whatever the practitioner does, thorough documentation is essential. Records should capture the specific threat, the risk assessment, every action taken in response, and the outcome of each step. Log the date and time of each notification attempt, the name of the person contacted, and what was said. Consultations with colleagues, supervisors, or attorneys before acting belong in the record too. This paper trail is what demonstrates good faith if the decision is later second-guessed in litigation or a licensing investigation.
HIPAA Does Not Prevent Compliance
Practitioners sometimes worry that federal privacy law bars them from sharing patient information even when state law demands it. It does not. HIPAA includes an explicit exception for threats to safety. Under 45 CFR 164.512(j), a covered entity may disclose protected health information without patient authorization when it believes in good faith that disclosure is necessary to prevent or lessen a serious and imminent threat to any person’s health or safety, and the disclosure goes to someone reasonably able to prevent the threat, including the target.4eCFR. 45 CFR 164.512 – Uses and Disclosures for Which an Authorization or Opportunity to Agree or Object Is Not Required
The regulation creates a presumption of good faith when the practitioner’s belief is based on actual knowledge or a credible representation from someone with apparent authority.4eCFR. 45 CFR 164.512 – Uses and Disclosures for Which an Authorization or Opportunity to Agree or Object Is Not Required HIPAA’s “minimum necessary” standard, which normally limits shared information to the smallest amount needed, does not apply when the disclosure is required by another law such as a state duty-to-warn statute.5U.S. Department of Health and Human Services. Minimum Necessary Requirement
Good Faith Immunity
The duty puts practitioners in an uncomfortable spot: break confidentiality and risk a lawsuit from the patient, or stay silent and risk one from the injured victim. Every state and the District of Columbia provide some form of immunity from liability for practitioners who break confidentiality in good faith to protect a potential victim. The details vary, but the core is the same. If you genuinely believed someone was in danger and you followed a reasonable process, you are shielded from liability for the breach itself. HIPAA’s good faith presumption reinforces that protection at the federal level.4eCFR. 45 CFR 164.512 – Uses and Disclosures for Which an Authorization or Opportunity to Agree or Object Is Not Required
Immunity has limits. A practitioner who discloses far more than needed, acts out of personal animosity rather than clinical concern, or fails to follow any reasonable process will have a harder time claiming protection. The record described above is the best defense.
What Happens If a Practitioner Fails to Act
A clinician who ignores a triggering threat faces exposure on multiple fronts. The most significant risk is a civil malpractice suit brought by the injured victim or their family, seeking compensatory damages for medical bills, lost wages, pain and suffering, and emotional distress. Cases involving egregious or reckless conduct can support punitive damages.
State licensing boards can also pursue administrative action. Penalties range from letters of admonition and mandatory supervision to suspension or outright revocation of the practitioner’s license. Administrative fines in the range of $5,000 to $25,000 are possible in some states, though amounts vary. A practitioner whose license is revoked may be barred from reapplying for several years, and reapplication is treated as a brand-new application with no guarantee of approval. These consequences can end a career even without a malpractice judgment.
Therapeutic privilege, the idea that a clinician may withhold information from a patient for the patient’s own benefit, is not a defense to failing to warn a third-party victim. Courts have rejected attempts to conflate the two.
State-by-State Variation
Tarasoff originated in California, but the duty has spread across the country unevenly. A 2012 legal review grouped states into four categories: roughly 23 states with mandatory duty-to-warn statutes, about 10 that recognize the duty through common law rather than legislation, approximately 11 with permissive laws that allow but do not require a confidentiality breach, and around 6 with no statute or case law on the issue. These numbers shift as legislatures act and courts rule, but the pattern holds: a strong majority of states impose or permit the duty in some form.
States also differ on how they evaluate a clinician’s conduct after the fact. Some apply a professional standard, asking whether the clinician acted the way a competent peer would have. Others apply a reasonable person standard, which invites second-guessing by jurors with no clinical training. A practitioner who moves states or treats patients across state lines by telehealth needs to learn each jurisdiction’s framework. Local counsel or the state licensing board is the most reliable source of current guidance.
Talking to Patients About the Limits of Confidentiality
The best time to address the duty is before it ever becomes relevant. Explain the limits of confidentiality at the first session, in plain terms, so the patient understands that certain threats of violence require disclosure to the intended victim or law enforcement. Upfront notice gives the patient a fair picture of the rules and softens the shock if disclosure later becomes necessary.
When a credible threat does arise, and less-intrusive options like hospitalization or medication changes are not feasible, many clinicians recommend telling the patient before contacting the victim or police. Explaining that the notification is legally required, and that it protects everyone involved including the patient, can sometimes preserve enough of the therapeutic alliance to continue treatment. That is not always possible or safe, but when it is, it reflects better practice than blindsiding the patient after the fact.
After a disclosure, the therapeutic relationship will be strained. Increased session frequency, family involvement in treatment planning, or transfer to another provider may be needed. The goal is to keep a structure in place that continues to reduce the patient’s risk of violence, not just to check the legal box and move on.