Guide

Threats toward a third party: assessment, duty, documentation

Summary

When a client makes a threat toward another person, work a fixed sequence: assess how serious, specific, and imminent it is, including the means and whether there is an identifiable victim; check your state's duty-to-protect rule, which varies; if danger is imminent, contact emergency services; make any legally permitted protective disclosure, limited to the minimum necessary; consider whether mandatory reporting applies; and document your assessment, reasoning, and every action.

By Gale Editorial · Updated 2026-07-26. Every figure cited to a dated source. How we write.

When a client threatens someone else: the sequence

When a client threatens to harm another person, work a sequence rather than reacting to the words: assess how serious, specific, and imminent the threat is, including access to means and whether there is an identifiable victim; identify your state's duty rule, which varies; if danger is imminent, contact emergency services by calling 911; make any legally permitted protective disclosure, limited to the minimum necessary; consider whether mandatory reporting applies; and document the assessment, your reasoning, and every action.

The steps below expand each part. Two ideas hold the page together: the clinical assessment comes first and drives everything after it, and the legal duty attached to a threat is set by your state, not by a national rule you can memorize once.

Assess the threat before you act

Before any duty question, assess the threat as a clinical fact: how specific it is, whether there is an identifiable potential victim, the client's intent and plan, access to a weapon, history of violence, and imminence. Do this in a structured, documented way rather than as a global impression. Suicide risk and violence risk often travel together, so screen for both; the Columbia-Suicide Severity Rating Scale covers the suicide side and models the kind of structured, recorded assessment the violence side also needs 1Ref 1Posner K, Brown GK, Stanley B, et al. (2011).The Columbia-Suicide Severity Rating Scale: initial validity and internal consistency findings from three multisite studies with adolescents and adults.That the C-SSRS is a validated structured risk assessment, cited as the model for the structured, documented assessment a threat requires; suicide and violence risk often co-occur..

Asking about firearms directly belongs in this assessment; access to a lethal method changes both the risk and what a reasonable response looks like. Record what you asked, what the client said, and the facts that moved your judgment — the assessment is what your later decision has to rest on, and what a reviewer will read first.

Your duty depends on your state

Whether you have a duty to warn, a duty to protect, or only permission to disclose is set by state law, and it varies widely — some states mandate action toward an identifiable victim, some permit it, some immunize a good-faith disclosure, and a few impose no affirmative duty. Do not treat any one state's Tarasoff duties as the national rule. Identify your state's statute and your board's guidance now, before you are in the room with a threat.

Professional ethics codes, such as the APA ethics code, frame confidentiality and its limits and the situations in which disclosure to protect is contemplated, but they do not replace your state's law 2Ref 2American Psychological Association (2017).Ethical Principles of Psychologists and Code of Conduct.That the ethics code frames confidentiality and its limits, including disclosure to protect, without replacing state law.. Where the two differ, the state's legal standard controls what you must do; the ethics code informs how you do it. Knowing your state's rule in advance is what turns a paralyzing moment into a decision you can defend.

What HIPAA permits: the serious and imminent threat disclosure

State law sets your duty; HIPAA separately sets what you are permitted to disclose. The Privacy Rule permits — it does not require — a disclosure you believe in good faith is necessary to prevent or lessen a serious and imminent threat, made to someone reasonably able to prevent it, which can include the potential victim or law enforcement 3Ref 3HHS Office for Civil Rights (2026).HIPAA Privacy Rule and Sharing Information Related to Mental Health.That HIPAA permits a safety-based disclosure necessary to prevent or lessen a serious and imminent threat, to someone able to prevent it, limited to the minimum necessary.. Limit the disclosure to the minimum necessary for that purpose. HIPAA permission and a state duty are different questions: your state may require action HIPAA merely allows.

That distinction matters in the moment. HIPAA rarely stands in the way of a protective disclosure a clinician judges necessary; the harder question is usually whether your state's law requires you to act, and toward whom. Answer the duty question against your state's statute, then use the HIPAA permission to make the disclosure the duty analysis points to.

Mandatory reporting may also be triggered

Layered on top of the duty analysis is mandatory reporting. If the potential victim is a child, or in many states a dependent or elder adult, a credible threat can trigger a mandatory report to child protective services or adult protective services regardless of how the Tarasoff question comes out. Reporter definitions and standards vary by state, so look up your state's statute rather than assuming — the Child Welfare Information Gateway keeps a state-by-state compilation of mandatory-reporting laws, and the state statute controls 4Ref 4Child Welfare Information Gateway (2023).Mandatory Reporting of Child Abuse and Neglect.That mandatory-reporter statutes vary by state, with a state-by-state compilation as the lookup method; the state statute controls..

Mandatory reporting and duty to protect are separate obligations that can both apply to the same threat, or only one, or neither. Run each analysis on its own terms: the report protects a class the statute names, while the duty to protect responds to the specific threat you assessed.

Document the assessment and your reasoning

Document the threat, the assessment, and your reasoning the same day, in the clinical record — not only in your private psychotherapy notes. Record the facts the client stated, the structured risk assessment, the factors you weighed, whom you consulted, the decision you reached and why, and any disclosure or report you made, to whom, and when. Psychotherapy notes are the provider's separate analysis and stay out of the record you may need to act on and produce; keep the assessment where it belongs 5Ref 5HHS Office for Civil Rights (2026).Does HIPAA provide extra protections for mental health information compared with other health information?.That psychotherapy notes are kept separate from the general record, so the threat assessment belongs in the clinical record you may need to produce..

The same discipline you would use documenting suicide risk — structure over a checkbox, reasoning over a conclusion — applies to a threat toward others. A note that shows a defensible process, including the option you considered and did not take, protects the client, the third party, and you.

Get consultation before you decide

These are exactly the decisions not to make alone. A brief consultation with a trusted colleague, and where the legal stakes are high your own attorney or your board's ethics line, both sharpens the judgment and documents that you sought input. Many clinicians build one or two go-to consultants into their crisis protocol in advance, so the call takes minutes rather than hours when a threat lands in the room.

If the same client is also at risk to themselves, the session that becomes a crisis for them runs in parallel with the duty analysis — assess and safety-plan for the client while you manage the risk to the third party. And when danger to anyone is imminent, 911 and, for suicide risk, 988 are the resources you reach for first.

Common questions

It depends on your state. Some states impose a duty to warn an identifiable victim, some a broader duty to protect that can be met other ways, some only permit disclosure, and a few impose no affirmative duty. There is no single national rule, so identify your state's statute and your board's guidance in advance rather than deciding for the first time during the crisis.

Yes, within limits. The Privacy Rule permits — it does not require — a disclosure you believe in good faith is necessary to prevent or lessen a serious and imminent threat, made to someone reasonably able to prevent it, such as the potential victim or law enforcement. Disclose only the minimum necessary. HIPAA permission is separate from whether your state's law requires you to act.

A duty to warn typically means notifying the identifiable victim or the police. A duty to protect is broader — it can be satisfied by a range of steps, such as warning, notifying authorities, arranging hospitalization, or intensifying treatment. Which one your state imposes, and what satisfies it, is defined by state statute and case law, so check your own jurisdiction rather than generalizing.

A credible threat toward a child can trigger mandatory reporting to child protective services regardless of how the duty-to-protect analysis comes out, and many states extend mandatory reporting to dependent or elder adults. Reporter definitions and standards vary, so look up your state's statute; the Child Welfare Information Gateway maintains a state-by-state compilation. The state statute controls what and when you report.

The threat as stated, the structured risk assessment, the factors you weighed, whom you consulted, the decision you reached and why, and any disclosure or report — to whom and when. Write it the same day in the clinical record, not only in your private psychotherapy notes, since you may need to produce it and act on it. Show reasoning, not just a conclusion.

Run your practice on Gale

The software is free. Gale earns one flat 3.5% all-in per paid transaction — only on transactions that actually pay. No subscription, no setup fee, no network cut.

Start or manage a practice →

References

1.Posner K, Brown GK, Stanley B, et al. (2011). The Columbia-Suicide Severity Rating Scale: initial validity and internal consistency findings from three multisite studies with adolescents and adults. American Journal of Psychiatry. link ✓That the C-SSRS is a validated structured risk assessment, cited as the model for the structured, documented assessment a threat requires; suicide and violence risk often co-occur.
2.American Psychological Association (2017). Ethical Principles of Psychologists and Code of Conduct. American Psychological Association. link ✓That the ethics code frames confidentiality and its limits, including disclosure to protect, without replacing state law.
3.HHS Office for Civil Rights (2026). HIPAA Privacy Rule and Sharing Information Related to Mental Health. U.S. Department of Health and Human Services. linkThat HIPAA permits a safety-based disclosure necessary to prevent or lessen a serious and imminent threat, to someone able to prevent it, limited to the minimum necessary.
4.Child Welfare Information Gateway (2023). Mandatory Reporting of Child Abuse and Neglect. Child Welfare Information Gateway (HHS ACF). link ✓That mandatory-reporter statutes vary by state, with a state-by-state compilation as the lookup method; the state statute controls.
5.HHS Office for Civil Rights (2026). Does HIPAA provide extra protections for mental health information compared with other health information?. U.S. Department of Health and Human Services. linkThat psychotherapy notes are kept separate from the general record, so the threat assessment belongs in the clinical record you may need to produce.

https://www.gale.care/for-providers/cs-threats-toward-others-duty · 5 sources. Competitor details are cited to dated public sources and maintained as they change; figures are estimates, not commitments. Synthetic demonstration.

← Back to for providers