The serious-threat pathway: HIPAA's permission and its edges

When may I call the police about a client?

You may contact law enforcement when you believe, in good faith, that disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of your client or another identifiable person, and the person you tell is someone positioned to prevent or lessen that danger 1Ref 1HHS Office for Civil Rights (2026).HIPAA Privacy Rule and Sharing Information Related to Mental Health.HIPAA's permission to disclose PHI to prevent or lessen a serious and imminent threat to health or safety, judged by a good-faith standard.. HIPAA frames this as a permission, not a command: it lifts the confidentiality barrier so you may act, but it does not by itself order you to make the call.

Because HIPAA permits these disclosures for a covered entity, the pathway assumes the rule reaches your practice in the first place — if you are unsure, that is the covered-entity test, and it is worth settling before a crisis rather than during one. Two bodies of law can operate at once: the federal permission, which is national, and a separate state obligation described below.

Permission is not a duty: HIPAA versus state duty-to-warn

HIPAA's serious-threat provision gives you room to act; it does not create a legal duty to act. That duty, when it exists, comes from state law. Many states impose a Tarasoff-style obligation to warn or protect an identifiable victim when a client voices a credible, serious threat, and states differ sharply — some mandate a warning, some let you choose among protective steps, and a few are silent. Whether you must, may, or may not act is the part that varies.

Treat the two as separate checks. First ask whether your state's tarasoff duties require you to do something; then ask what HIPAA lets you disclose in order to do it. The permission is the tool; the state duty — where it exists — is what decides whether you are obligated to pick the tool up. Because that duty varies, confirm your own state's statute or case law before you rely on any general description of it.

The good-faith, serious-and-imminent standard

Two words carry the weight: 'serious' and 'imminent.' The permission is meant for genuine, near-term danger — a credible plan and means to seriously harm a specific person, or an acute risk to the client's own life — not vague anger or a long-standing grievance with no immediacy. HIPAA measures your decision by a good-faith standard: it presumes good faith and protects a disclosure based on your reasonable professional judgment and what you actually knew at the time 1Ref 1HHS Office for Civil Rights (2026).HIPAA Privacy Rule and Sharing Information Related to Mental Health.HIPAA's permission to disclose PHI to prevent or lessen a serious and imminent threat to health or safety, judged by a good-faith standard..

Practically, that means you are judged on the assessment you made and recorded, not on whether the feared event ultimately occurred. Document the specific statements, the plan, the means, and the timeframe that led you to conclude the danger was both serious and imminent. When the risk is aimed at an identifiable person — threats toward a third party rather than a diffuse population — the case for disclosure is strongest.

Whom you may tell, and how little you may share

Tell only the people who can actually reduce the danger, and tell them only what they need to reduce it. That usually means law enforcement, the identifiable person at risk, or someone able to intervene — a family member, a school, or a crisis team. HIPAA's minimum-necessary principle still governs: disclose the specific facts that let the recipient act, not the client's whole history 2Ref 2HHS Office for Civil Rights (2026).Summary of the HIPAA Privacy Rule.The Privacy Rule's minimum-necessary principle governing how little to disclose in a permitted safety disclosure..

• Law enforcement / a welfare check. When you fear for a client's immediate safety, you can ask police to perform the welfare check — share the address, the risk, and what they may encounter, not the diagnosis or the session content.
• The person threatened. You may warn an identifiable potential victim directly.
• A crisis line. For a client in acute distress, 988 connects to the Suicide and Crisis Lifeline by call, text, or chat, and it publishes materials aimed at clinicians as well as the public 3Ref 3Substance Abuse and Mental Health Services Administration (2026).988 Suicide & Crisis Lifeline.988 as the national Suicide and Crisis Lifeline (call/text/chat) with SAMHSA as federal administrator, offered as a clinician-facing crisis resource.; the Lifeline routes to local crisis and mobile-team resources that can respond 4Ref 4988 Suicide & Crisis Lifeline (2026).988 Lifeline.The 988 Lifeline's services across call, text, and chat and its routing to local crisis resources.. For danger already unfolding, 911 is the faster route.

Keep a short, factual record of what you shared and why. Sharing more than the danger requires converts a lawful safety disclosure into an over-disclosure.

The edges: SUD records, psychotherapy notes, and minors

Three categories carry tighter rules that survive the serious-threat permission. If your program is subject to 42 CFR Part 2, substance-use-disorder records get their own consent and disclosure regime, and Part 2 permits only a narrow medical-emergency disclosure rather than HIPAA's broader safety latitude — so a threat disclosure drawn from SUD records must fit Part 2's own exception, not just HIPAA's 5Ref 5Office of the Federal Register (2026).42 CFR Part 2 — Confidentiality of Substance Use Disorder Patient Records.That 42 CFR Part 2 imposes its own narrower disclosure regime on SUD records, distinct from HIPAA's safety latitude..

• Psychotherapy notes. Your separately kept psychotherapy notes — the process notes analyzed and stored apart from the chart — carry heightened protection; a safety disclosure should draw from the general record, not from those notes, wherever possible.
• Minors and abuse reporting. A threat involving a child can trigger a mandatory report, which is a different duty from the discretionary safety permission. Who must report, and under what standard, is set state by state; use the HHS-maintained state compilation to find your own statute rather than assuming a national rule 6Ref 6Child Welfare Information Gateway (2023).Mandatory Reporting of Child Abuse and Neglect.That mandatory child-abuse reporting is set state by state, with the HHS-maintained compilation as the lookup for one's own statute..
• A subpoena is not this. Volunteering a safety disclosure is not the same as responding to compelled process; when records are demanded through the subpoena, a separate rulebook governs what you produce.

Document the call the same day

Write the disclosure note while the facts are fresh, ideally the same day. Record what you knew, the specific threat, your judgment that it was serious and imminent, whom you told, and exactly what you shared — the good-faith standard is proven by contemporaneous documentation, and your professional ethics code expects you to limit any disclosure to what the danger required 7Ref 7National Association of Social Workers (2021).NASW Code of Ethics.The ethical expectation to limit any confidentiality-breaking disclosure to what the safety situation required.. A tight note both satisfies the minimum-necessary rule and protects you if the decision is later questioned.

If the client afterward asks to see the file — the client wants everything, including the record of what you disclosed — handle it under the usual access rules rather than treating the safety event as a reason to withhold. Calendar any follow-up the situation created: a wellness check to confirm safety, a treatment-plan update, and a note of whether the therapeutic relationship can continue.