Guide

Tarasoff duties: mandatory, permissive, and silent states

Summary

Whether you have a duty to warn or protect depends entirely on your state. States fall into three groups: some impose a mandatory duty when a client makes a serious threat against an identifiable victim, some permit but do not require disclosure, and a few have no statute at all. HIPAA separately permits — never requires — disclosure to prevent a serious and imminent threat. Find your state's specific rule; do not assume the Tarasoff standard from one state applies to yours.

By Gale Editorial · Updated 2026-07-26. Every figure cited to a dated source. How we write.

The short answer: it depends on your state

Whether you have a legal duty to warn or protect a third party turns on your state's law, not a single national rule. Since the Tarasoff line of cases, states have gone three separate directions, and the standard where you practice may bear little resemblance to the one you learned in graduate school if it was taught from another state. Start every analysis by identifying your own state's statute or case law 1Ref 1HHS Office for Civil Rights (2026).HIPAA Privacy Rule and Sharing Information Related to Mental Health.That HIPAA permits, but does not require, disclosure to prevent or lessen a serious and imminent threat, with the duty itself set by state law..

HIPAA does not create the duty; it only permits the disclosure. The Privacy Rule lets a clinician disclose protected information when needed to prevent or lessen a serious and imminent threat to a person or the public, but permitting a disclosure is not the same as requiring one — that requirement, if it exists for you, comes from state law 1Ref 1HHS Office for Civil Rights (2026).HIPAA Privacy Rule and Sharing Information Related to Mental Health.That HIPAA permits, but does not require, disclosure to prevent or lessen a serious and imminent threat, with the duty itself set by state law.. Keeping those two layers separate is the whole game: state law tells you whether you must act, and HIPAA tells you that you may.

Three kinds of states

Sorting states into three buckets makes it manageable. Mandatory-duty states require you to take protective action — warning the victim, notifying law enforcement, or initiating hospitalization — when a client communicates a serious threat of violence against a reasonably identifiable victim. Permissive states allow you to disclose in those circumstances but do not compel it, leaving the decision to your clinical judgment. A smaller number have no controlling statute, where the question is governed by case law and professional standards.

To place your own state, look to two sources: the statute your legislature enacted (often in the licensing or mental-health code) and any controlling appellate decision. Your licensing board and professional association usually summarize the current rule, and the summary should name whether the duty is mandatory or permissive and what discharges it. The threats toward a third party question is exactly the kind of rule that differs across a state line, so confirm yours rather than importing a neighbor's.

What typically triggers the duty where one exists

Where a duty exists, several elements recur across statutes, though the exact trigger is always your state's to define. Most mandatory-duty formulations require a serious and imminent threat, an identifiable or reasonably identifiable victim, and a threat communicated to you by the client. Vague anger without a target, or a general statement of distress, usually does not cross the line.

The precise threshold, and what action discharges the duty, is set by your statute or controlling case, not by a rule of thumb. Because the elements are fact-specific, the defensible move is to run and document a structured risk assessment when a client voices a threat, then match the facts to your state's actual language. If your statute is a mandatory-duty type, it usually also tells you how to discharge the duty — warn the victim, notify police, arrange hospitalization — and doing any listed option typically satisfies it. Do not invent a threshold; read the one your state wrote.

HIPAA lets you disclose to prevent serious harm

The permission side is more uniform than the duty side. Under HIPAA, a clinician may disclose the protected information necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public, to someone able to prevent or lessen the threat — including the target and law enforcement 1Ref 1HHS Office for Civil Rights (2026).HIPAA Privacy Rule and Sharing Information Related to Mental Health.That HIPAA permits, but does not require, disclosure to prevent or lessen a serious and imminent threat, with the duty itself set by state law.. This is a permission, not a mandate, and it exists regardless of whether your state imposes a duty.

Two practical points follow. First, if you decide to warn under an imminent threat, HIPAA does not stand in your way, and the serious-threat pathway lets you disclose the minimum necessary to the people who can act. Second, when danger is immediate, protective action can include contacting law enforcement at 911, and clinician consultation lines such as 988's provider-facing resources exist to help you think through a hard call in real time. Match the disclosure to the threat and record your reasoning.

Duty to warn is not mandatory abuse reporting

Do not fold two different obligations into one. Duty to warn concerns a client's threat toward another person; mandatory reporting of child abuse — and, under separate state statutes, elder or dependent-adult abuse — is a distinct legal duty with its own triggers, recipients, and timelines. A state can require abuse reporting while taking a permissive stance on duty to warn, so satisfying one does not resolve the other 2Ref 2Child Welfare Information Gateway (2023).Mandatory Reporting of Child Abuse and Neglect.That mandatory abuse-reporting statutes vary by state with the state statute controlling — the lookup discipline that also applies to a state's duty-to-warn rule — and that it is a distinct duty from duty to warn..

The lookup discipline is the same, though. Just as a state-by-state compilation shows that mandatory-reporter statutes vary in who must report and under what standard, your duty-to-warn rule lives in your own state's law and must be checked there 2Ref 2Child Welfare Information Gateway (2023).Mandatory Reporting of Child Abuse and Neglect.That mandatory abuse-reporting statutes vary by state with the state statute controlling — the lookup discipline that also applies to a state's duty-to-warn rule — and that it is a distinct duty from duty to warn.. Keep a short internal reference for both duties — the statute cite, the trigger, whom you notify, and the deadline — so that a moment of crisis is not the moment you first look them up.

The telehealth wrinkle: which state's rule when the client is elsewhere

Telehealth scrambles the analysis, because practice generally occurs where the client is located, not where you sit. If you treat a client physically in another state, that state's duty-to-warn law can govern the encounter — which means you may be bound by a rule different from your home state's. The interstate compacts that let you practice across lines carry this consequence with them: they grant the privilege to practice in the remote state, and with it the remote state's standards.

Which compact applies depends on your license. PSYPACT authorizes qualifying psychologists to practice telepsychology across member states 3Ref 3PSYPACT Commission (2026).PSYPACT.That PSYPACT authorizes qualifying psychologists to practice telepsychology across member states, so a remote client's state standards can apply.. The Counseling Compact grants licensed professional counselors a privilege to practice, including telehealth, in member states 4Ref 4Counseling Compact Commission (2026).Counseling Compact.That the Counseling Compact grants licensed professional counselors a privilege to practice, including telehealth, in member states.. The Social Work Licensure Compact creates comparable multistate practice privileges for eligible social workers as states implement it 5Ref 5Social Work Licensure Compact (2026).Social Work Licensure Compact.That the Social Work Licensure Compact creates multistate practice privileges for eligible social workers as states implement it.. Compact membership changes as states join, so confirm the current status before relying on it; the rosters as of mid-2026 continue to expand. Under any of them, the working assumption is that you follow the law of the state where your client is sitting — so for a cross-state client, look up that state's duty-to-warn rule, not only your own.

Document the assessment and the decision

Whatever you decide, the record is your protection. When a client voices a threat, document the structured risk assessment you performed, the facts you weighed, the option you chose under your state's rule, and — if you disclosed — to whom and what minimum information you shared. A contemporaneous note showing a reasoned process is far more defensible than a perfect outcome reconstructed later.

Build the infrastructure before you need it: a one-page reference for your state's duty-to-warn and mandatory-reporting rules, a risk-assessment template, and a standing plan for who you would notify and how. Consultation is a normal part of a hard call, not a sign of weakness — a documented consult with a colleague or your professional association's ethics line strengthens the record. The goal is that a crisis meets a prepared clinician, not a scramble.

Common questions

No. It varies by state. Some states impose a mandatory duty to warn or protect when a client makes a serious threat against an identifiable victim, others permit disclosure without requiring it, and a few have no controlling statute. The famous Tarasoff standard came from one state's courts and does not automatically apply to yours, so identify your own state's statute or case law.

No. HIPAA permits, but never requires, disclosure to prevent or lessen a serious and imminent threat to a person or the public. Any requirement to act comes from your state's duty-to-warn law, not from HIPAA. Keep the two layers separate: state law tells you whether you must act, and HIPAA confirms you may share the minimum necessary if you choose to.

Common elements are a serious and imminent threat, a reasonably identifiable victim, and a threat the client communicated to you. Vague anger with no target often does not meet the standard. But the exact threshold and what discharges the duty are defined by your state's statute or case law, so match the facts to your state's actual language rather than a general rule.

Generally the state where the client is physically located, because practice is deemed to occur there. If a compact or license lets you treat that client, you are usually bound by that state's standards, including its duty-to-warn rule. For any cross-state client, look up the destination state's law, not only your home state's, before a threat ever arises.

No. They are distinct duties. Mandatory reporting of child abuse — and, under separate statutes, elder or dependent-adult abuse — has its own triggers, recipients, and deadlines, and a state-by-state compilation shows how widely those vary. A state may require abuse reporting yet take a permissive stance on duty to warn, so satisfying one obligation does not resolve the other.

Run your practice on Gale

The software is free. Gale earns one flat 3.5% all-in per paid transaction — only on transactions that actually pay. No subscription, no setup fee, no network cut.

Start or manage a practice →

References

1.HHS Office for Civil Rights (2026). HIPAA Privacy Rule and Sharing Information Related to Mental Health. U.S. Department of Health and Human Services. linkThat HIPAA permits, but does not require, disclosure to prevent or lessen a serious and imminent threat, with the duty itself set by state law.
2.Child Welfare Information Gateway (2023). Mandatory Reporting of Child Abuse and Neglect. Child Welfare Information Gateway (HHS ACF). link ✓That mandatory abuse-reporting statutes vary by state with the state statute controlling — the lookup discipline that also applies to a state's duty-to-warn rule — and that it is a distinct duty from duty to warn.
3.PSYPACT Commission (2026). PSYPACT. PSYPACT Commission. linkThat PSYPACT authorizes qualifying psychologists to practice telepsychology across member states, so a remote client's state standards can apply.
4.Counseling Compact Commission (2026). Counseling Compact. Counseling Compact Commission. link ✓That the Counseling Compact grants licensed professional counselors a privilege to practice, including telehealth, in member states.
5.Social Work Licensure Compact (2026). Social Work Licensure Compact. Social Work Licensure Compact. link ✓That the Social Work Licensure Compact creates multistate practice privileges for eligible social workers as states implement it.

https://www.gale.care/for-providers/pr-duty-to-warn-state · 5 sources. Competitor details are cited to dated public sources and maintained as they change; figures are estimates, not commitments. Synthetic demonstration.

← Back to for providers