Duty to Warn vs Duty to Protect

A 16-year-old looks at the floor and says, “I’m going to hurt Jordan after practice.” Jordan is a classmate with a full name. You have eight minutes left in the hour. Sort duty to warn vs duty to protect on the card above, then open your state’s row before you pick up the phone. This card is not the statute.

That split is the whole of duty to warn vs duty to protect as a clinical sorting tool. The left column is a message. The right column is a duty of care, and a message is only one way to meet it. The NCSL mental health professionals’ duty-to-warn chart, archived December 20, 2024, uses four labels, so your row may say mandatory, permissive, no duty, or other. The statute or case in your row is the rule. Chart quotes below are from that archive.

Educational guidance for US mental-health clinicians. Not legal advice. Statutes and cases change. Quoted sentences below were checked against the sources linked in this article.

What Tarasoff requires

Tarasoff v. Regents of the University of California, 17 Cal. 3d 425 (1976), is a California Supreme Court opinion. It is not a federal statute, and it does not travel with you into another state just because your ethics class assigned it.

Justice Tobriner’s opinion states the holding this way: “When a therapist determines, or pursuant to the standards of his profession should determine, that his patient presents a serious danger of violence to another, he incurs an obligation to use reasonable care to protect the intended victim against such danger. The discharge of this duty may require the therapist to take one or more of various steps, depending upon the nature of the case. Thus it may call for him to warn the intended victim or others likely to apprise the victim of the danger, to notify the police, or to take whatever other steps are reasonably necessary under the circumstances.”

Read that twice. The duty named in the holding is to protect. Warning is listed as one possible discharge, next to a police notification and “whatever other steps are reasonably necessary.” A warning script is not the holding.

The same opinion later says: “We conclude that the public policy favoring protection of the confidential character of patient-psychotherapist communications must yield to the extent to which disclosure is essential to avert danger to others. The protective privilege ends where the public peril begins.”

It also limits how much you say. The therapist should “not disclose a confidence unless such disclosure is necessary to avert danger to others, and even then that he do so discreetly, and in a fashion that would preserve the privacy of his patient to the fullest extent compatible with the prevention of the threatened danger.”

So what Tarasoff requires, in the words of that opinion, is reasonable care to protect an intended victim once you determine, or professionally should determine, a serious danger of violence. It does not require you to read the chart aloud. It does not require a perfect prediction. The opinion says the therapist “need only exercise ‘that reasonable degree of skill, knowledge, and care ordinarily possessed and exercised by members of [that professional specialty] under similar circumstances.’” That is the duty to warn vs duty to protect split in the holding itself: protect is the duty, and a warning is one way to discharge it.

Two limits belong in the same breath. First, this is California case law from 1976. Second, the plaintiffs in that case were suing public-employee therapists. The opinion says that, to the extent the claim was a failure to confine Poddar, “the therapists can claim immunity under Government Code section 856.” It then says: “No specific statutory provision, however, shields them from liability based upon failure to warn Tatiana or others likely to apprise her of the danger.” If you are not a California public employee, do not borrow that immunity paragraph as your rule. Borrow the holding’s structure, then open your own citation.

The NCSL introduction, on a page that itself says “Updated March 16, 2022,” describes the case more loosely: “California courts imposed a legal duty on psychotherapists to warn third parties of patients’ threats to their safety in 1976 in Tarasoff v. The Regents of the University of California.” That sentence is useful as a map legend. It is not a substitute for the holding, which says “protect” and treats a warning as one discharge. When a secondary summary and the opinion disagree on the verb, follow the opinion, then follow your statute.

One state renamed the duty, not yours

California later wrote a statute. Civil Code section 43.92, amended by Stats. 2012, Ch. 149, effective January 1, 2013, is a California rule. It is on this page as a worked example of how a legislature can use both labels. It is not your rule unless you are practicing under California law.

Subdivision (a) says there is no monetary liability for failing to protect, or failing to predict and protect, “except if the patient has communicated to the psychotherapist a serious threat of physical violence against a reasonably identifiable victim or victims.”

That trigger is narrower than the 1976 holding. The opinion includes a danger you should have recognized under professional standards. The statute’s exception to immunity, as written, turns on a communicated serious threat against a reasonably identifiable victim. If you practice in California, read both and do not collapse them into one sentence on the consent form.

Subdivision (b) says the duty to protect is discharged, under those limited circumstances, “by making reasonable efforts to communicate the threat to the victim or victims and to a law enforcement agency.” Victim and law enforcement. The statute does not say “call the parent” and it does not say “email the school.” A call to a caregiver is not the discharge that sentence describes.

Subdivision (c) is the sentence that settles the vocabulary fight inside California: “It is the intent of the Legislature that the amendments made by the act adding this subdivision only change the name of the duty referenced in this section from a duty to warn and protect to a duty to protect.” The next sentence says the amendment is not a substantive change. In that state, the two labels were treated as one duty with a new name. Do not export that sentence. If you are not practicing under California law, section 43.92 is not your citation.

Duty to warn laws by state

Duty to warn laws by state are a lookup, not a table this article is going to reprint. The National Conference of State Legislatures already publishes the orientation chart. Use it. Then open the citation in the row. A second matrix on a therapy site would go stale the week a legislature amends a discharge clause, and it would pretend to be the statute.

On the December 20, 2024 archive of the NCSL page, the introduction says: “Most states have laws that either require or permit mental health professionals to disclose information about patients who may become violent.” The map key on that snapshot uses four labels:

• Duty to protect/warn, mandatory
• Duty to protect/warn, permissive
• No duty to protect/warn
• Other

Those four labels are the only state-level sort you need from this chart before you open the statute. They are not a finding about your client. “Mandatory” does not always mean “call the identifiable victim.” The same NCSL introduction says: “A New York law enacted Jan. 15, 2013, moves that state’s law from a permissive to a mandatory duty for mental health professionals to report when they believe patients may pose a danger to themselves or others but protects therapists from both civil and criminal liability for failure to report if they act ‘in good faith.’” Read the New York row and the statute it cites before you decide that “mandatory” means a Tarasoff-style warning. Sorting duty to warn vs duty to protect does not tell you which label, or which recipient, your statute uses. The mandatory reporting laws by state guide already treats imminent-risk duties as a separate stack from child-abuse reporting, and it points at this same NCSL chart. It does not compare warn and protect. That comparison is the card above.

How to use the chart in the eight minutes you actually have:

1. Name the license on the wall, including associate or intern status. The chart’s Applies To column is profession-specific. On that archive, Alabama lists “Counselors and licensed psychologists and psychiatrists” on one line, and Ala. Code section 34-8A-21 covers “a licensed professional counselor or a certified counselor associate.” Alaska lists a licensed professional counselor under Alaska Stat. section 08.29.200 and a psychologist or psychological associate under Alaska Stat. section 08.86.200. Open the row that names your license.
2. If the client is not in your license state, write both locations in the note. The archived chart does not say which state’s row governs that session. Do not answer it from this page.
3. Open your row. Note whether the label is mandatory, permissive, no duty, or other.
4. Open the statute or case the row cites. Read the trigger and the discharge clause, not the summary sentence.
5. Write the citation and the date you opened it in the chart before you notify anyone.

If the label is permissive, do not read it as a command to disclose. Open the summary and see what that row permits. If the label is no duty, read the confidentiality sentence in that same row before you disclose anything. The chart’s introduction says: “With some exceptions codified in state and federal law, health professionals can be legally liable for breaching confidentiality.” That sentence does not say a no-duty label is permission to disclose. If the label is other, stop skimming and read the note. The same introduction says the American Psychological Association “has advocated allowing mental health workers to exercise professional judgment regarding the duty to warn and not to unnecessarily expand ‘dangerous patient’ exceptions.” That is NCSL’s report of the association’s advocacy. It is not a defense if your statute uses the word “shall.”

HIPAA permits a disclosure without creating the duty

Federal privacy law sits under the state duty. It does not invent one, and it does not answer duty to warn vs duty to protect.

45 CFR § 164.512(j), confirmed in the 2024 Code of Federal Regulations text on GovInfo, is titled “Standard: Uses and disclosures to avert a serious threat to health or safety.” The permitted-disclosures paragraph says a covered entity may, “consistent with applicable law and standards of ethical conduct,” use or disclose protected health information if it, “in good faith, believes the use or disclosure” meets one of the listed tests.

The serious-and-imminent-threat test has two parts. The disclosure “is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public,” and it “is to a person or persons reasonably able to prevent or lessen the threat, including the target of the threat.”

“May” is the verb. HIPAA does not say you must warn. If your state imposes a duty, this permission is what keeps the Privacy Rule from blocking a disclosure that other law allows. If your state imposes no duty, this permission does not create one. Match the disclosure to the permission you are actually using, and do not send the chart.

A different clause in the same subsection is easy to mix up, and mixing it up will make you over-silent. Paragraph (j)(1)(ii)(A) covers a disclosure to law enforcement to identify or apprehend someone because of a statement admitting participation in a violent crime. Paragraph (j)(2)(i) says that crime-admission disclosure may not be made if you learned the information in the course of treatment, counseling, or therapy. That limit is about the crime-admission path. It is not a ban on the serious-and-imminent-threat path in (j)(1)(i). A threat you heard in session can still fall under (j)(1)(i) when the other conditions are met. It does not fall under the crime-admission shortcut.

When the person at risk is family, or the client is a minor

Dana is an LMFT in solo practice. Her Thursday 4:40 is the 16-year-old who named Jordan. Her Tuesday couple is different: one partner says, in the room, “If you leave, I will hurt you,” and the other partner is sitting on the couch. Same card. Different facts. Neither fact tells Dana her state’s rule. Sort duty to warn vs duty to protect first, then open the row.

Start with the card’s trigger row. Did the client communicate a serious threat against a reasonably identifiable person, or are you looking at a danger the 1976 standard would call something you should have recognized? Then open the statute. Those phrases are from the California materials above. They are the trigger only if your row uses them.

If the named person is in the room, do not assume a duty has already been met because they heard the sentence. The Kansas row on the archived chart says: “Duty does not arise if the victim already knows of the danger.” That sentence is on the Kansas row. Do not copy it onto another state’s note. It does not define “already knows.” Read your own row. If you are unsure, call a supervisor or your carrier’s risk line before you treat silence as the answer.

If the client is a minor, keep two lookups apart. A threat to hurt a classmate is the warn-or-protect question. This page does not answer suspected abuse or neglect. The Alaska licensed-professional-counselor summary on the archived chart states a violence exception and then, separately, says counselors “are also exempted from confidentiality as mandatory reporters of child abuse or neglect.” That summary does not name the agency, and it does not say a caregiver call is the report. Open the child-abuse statute for the agency and the clock. The mandatory reporting laws by state guide is the other stack.

You want the parent to pick the child up. If California is your law, the discharge clause names the victim and a law enforcement agency, not the parent. Read the discharge clause in your row before you treat a parent call as the step that clause names. Write whether the call is that discharge or a separate safety step.

Couples work adds a charting question this page cannot answer for you. Look at the intake and write the threatened partner’s role as your chart already has it. The documentation line on the card still asks what you disclosed, to whom, and under which citation. Do not drop the threat into a shared portal note the threatening partner can open on the way to the car. The Tarasoff opinion, quoted above, says the therapist should “not disclose a confidence unless such disclosure is necessary to avert danger to others,” and even then should do so “discreetly, and in a fashion that would preserve the privacy of his patient to the fullest extent compatible with the prevention of the threatened danger.” Document that the note does not paste the rest of the chart.

Limits of confidentiality belong in the intake conversation, before this session exists. If your consent form collapses child-abuse reporting, elder reporting, and a Tarasoff-style duty into one sentence, fix the form on a calm day. The compliance guides are the map for that paperwork. The form is not a substitute for the lookup you do at 4:48 p.m.

Write the line before you leave the room

The documentation line on the card is the part you can use even when the legal answer is still “I am opening the statute.” Write facts. Write the citation you actually opened. Write who you told and what you did not tell. Leave the legal conclusion in the citation, not in an adjective.

Dana’s chart, if she is still in the room with the 16-year-old, can look like this. Brackets are hers to fill. Nothing in the brackets is a suggestion that a particular call is required.

4:42 p.m. Client stated, “I’m going to hurt Jordan after practice.” Jordan is a named classmate. I opened [statute or case citation] and the NCSL duty-to-warn chart (page updated March 16, 2022). Action taken: [called caregiver / notified police / warned the named person or their parent / no third-party disclosure / other]. Person contacted: [name, role, time]. Facts disclosed: the threat and Jordan’s name only. Citation relied on: [full citation]. Supervisor or counsel: [name, or not consulted]. Child-abuse stack reviewed separately: [yes, no report indicated / report made to (agency) / not this fact pattern].

That is duty to warn vs duty to protect in the note: one line for the communication step, one line for the protective steps, and a citation that is not “Tarasoff” unless Tarasoff is actually the law you practiced under.

A few habits keep the note usable if a board, a carrier, or a frightened parent asks later.

• Quote the threat. Paraphrase is how “hurt” becomes “kill” in someone else’s memory, or the reverse.
• Name the person, or write “no identifiable person named.” A vague “they” is not a discharge analysis.
• Time-stamp the decision and the call. “Later that evening” is not a record.
• List what you disclosed. The opinion’s discretion language is a reason to keep the list short, not a reason to skip the list.
• Separate the child-abuse decision from the violence decision, even if both answers are “no report.”
• If you consulted, name the person. If you did not, write that too.

Do not write “I complied with Tarasoff” as the whole note. That sentence hides the citation, the recipient, and the facts. Do not write a prediction you cannot support (“client will not act”) to talk yourself out of the lookup. And do not wait for a perfect citation if someone is in immediate danger. Protect safety first, then fill the citation line as soon as you are back at a desk. The card’s right column is reasonable care, not a research project that outruns the risk.

The checklist attached here is the same jurisdiction worksheet used with the mandatory-reporting guide: license match, child-abuse stack, vulnerable-adult stack, imminent-risk or duty-to-warn stack, and the post-action fields. It does not tell you your state’s trigger. It gives you boxes so the lookup has a place to land.

If you want that documentation line in the same chart as the session, rather than in a side document you will lose, you can keep the note in Emosapien. The legal lookup still happens in the statute. The note just has to hold what you did. The security page is the product-side version of the same limit: record what you disclosed, and don’t leave a second copy in a channel the statute did not name.

Confidentiality limits belong in the intake conversation, not only in the crisis note. The habits in maintaining client confidentiality are the ordinary-week version of the same problem: say the exception before you need it, and write down that you said it. When the exception is a violence risk rather than a subpoena, the card at the top of this page is the sort, and the NCSL row is the next click.