The Tarasoff Duty to Warn: State-by-State Rules for Healthcare Providers

The Tarasoff duty originated in Tarasoff v. Regents of the University of California (17 Cal. 3d 425, 1976) and now exists in some form in roughly two-thirds of states — codified, rejected, or left in common-law limbo. California's codification at Civ. Code § 43.92 limits the duty to credible threats of serious physical harm against reasonably identifiable victims. HIPAA at 45 CFR § 164.512(j) provides the disclosure permission once the state duty triggers.

What triggers the duty to warn

The duty triggers — in states that recognize it — when a patient communicates to a psychotherapist (or in some states, any clinician) a serious threat of physical violence against a reasonably identifiable victim. Three elements must align:

• Credibility of the threat — the threat must be serious, not casual venting. The clinical assessment is contemporaneous; the standard is what a reasonable practitioner would conclude in the moment.
• Identifiability of the victim — the threat must name or otherwise identify a person or limited group. "I want to kill my coworker John Smith" satisfies; "I hate the company" does not.
• Imminence and physical-violence character — the threat must be of physical violence, generally with a temporal proximity that distinguishes it from generalized hostility.

What clinicians most often miss is that California's Tarasoff codification at Civ. Code § 43.92 limits the duty to credible threats of serious physical harm — not all clinical concerns rise to that bar. A patient who expresses violent ideation without a target, without means, and without a plan does not generally trigger Tarasoff. The clinical safety planning is required by the standard of care; the third-party warning is not.

Who must report

Tarasoff most squarely applies to "psychotherapists" — psychologists, psychiatrists, LCSWs, LMFTs, LPCs, and psychiatric mental health nurse practitioners. California's Evidence Code § 1010 defines "psychotherapist" broadly enough to capture most mental health roles.

Several states extend the duty beyond mental health to any healthcare practitioner who learns of a credible threat in their professional capacity. The American Medical Association's Ethics Code Opinion 5.7 supports breaking confidentiality to protect identifiable third parties from imminent harm regardless of specialty.

Primary care physicians, EMS personnel, and emergency department staff who receive a threat communication during care should treat themselves as potentially within the duty in any state and document accordingly.

State-by-state framework

The Tarasoff landscape sorts into four buckets:

| State | Posture | Statute / Case | Trigger | |---|---|---|---| | California | Duty (codified) | Cal. Civ. Code § 43.92 | Serious threat against reasonably identifiable victim | | New Jersey | Duty (codified) | N.J.S.A. 2A:62A-16 | Serious threat against readily identifiable victim | | Massachusetts | Duty (codified) | M.G.L. c. 123, § 36B | Explicit threat against clearly identified or reasonably identifiable victim | | Nebraska | Duty (codified) | Neb. Rev. Stat. § 71-1,206.30 | Serious threat against reasonably identifiable victim | | Indiana | Duty (codified) | Ind. Code § 34-30-16-1 | Serious imminent threat against reasonably identifiable victim | | Michigan | Duty (codified) | MCL 330.1946 | Serious threat against reasonably identifiable third party | | Minnesota | Duty (codified) | Minn. Stat. § 148.975 | Specific serious threat against specific clearly identified person | | New Hampshire | Duty (codified) | N.H. Rev. Stat. § 329:31 | Serious threat against clearly identified victim | | Ohio | Duty (codified) | ORC § 5122.34 | Explicit threat against reasonably identifiable victim | | Washington | Duty (case law) | Volk v. DeMeerleer (2016) | Foreseeable harm to foreseeable victim — broader than CA | | Florida | Duty (case law / permissive) | Boynton v. Burglass (1991); F.S. § 491.0147 permits disclosure | Permissive disclosure for imminent threat | | Illinois | Permissive (codified) | 740 ILCS 110/11 | Disclosure permitted; not statutorily required | | Texas | No duty (case law) | Thapar v. Zezulka (1999); H&S Code § 611.004 permissive | No common-law duty; disclosure permitted but not required | | Virginia | No duty (case law) | Nasser v. Parker (1995) | Common-law duty narrowly construed | | Maryland | No duty (case law) | Boynton-following — no broad duty | Disclosure permitted under specific statutes | | North Carolina | No duty (case law) | Currie v. United States (1986) | Federal precedent declining duty |

A majority of states either codify the Tarasoff duty or recognize it through case law, but the contours vary materially. Washington's Volk v. DeMeerleer reads the duty more broadly than California's statutory cabin. Texas, Virginia, and a small group of states have declined to recognize a common-law third-party warning duty entirely.

Timeline

Where the duty applies, "immediate" is the operative timeline — the warning must be made in time to allow the third party (or law enforcement) to take protective action. There is no statutory hours-and-minutes window; the clinical judgment of imminence drives the response.

The discharge of the duty under CA Civ. Code § 43.92(b) requires "reasonable efforts to communicate the threat to the victim or victims and to a law enforcement agency." Reasonable efforts means good-faith attempts — leaving a voicemail when the victim does not answer plus a call to the relevant law enforcement agency typically satisfies. Some state statutes (NJ, MA) require warning to the victim, law enforcement, or both depending on circumstances.

What to report and how

The warning communication to the identifiable victim should include the existence of a threat and enough information to enable protective action — the warning need not include diagnosis or treatment history. The communication to law enforcement should include the patient identity, the nature of the threat, the identified target, and the basis for the clinical judgment of credibility.

The chart entry should document the threat as communicated by the patient (quoted), the clinical assessment of credibility, the identifiable victim or target group, the warning attempts (date, time, method, recipient), the law enforcement contact (date, time, agency, officer name), the patient's response when informed of the disclosure where applicable, and any safety planning or hospitalization assessment.

Federal vs state framework

There is no federal Tarasoff statute. The duty is entirely a state-law construct, anchored to the original California Supreme Court decision and the codifications and case law that followed in other jurisdictions.

The federal HIPAA layer permits the disclosure where the state duty triggers; it does not create the duty. 45 CFR § 164.512(j)'s "serious and imminent threat" carve-out is the federal harmonization that ensures HIPAA does not block a Tarasoff warning.

42 CFR Part 2 substance use disorder records require a separate analysis. The Part 2 medical-emergency disclosure rule at 42 CFR § 2.51 permits a Part 2 program to disclose patient identifying information to medical personnel to the extent necessary to meet a bona fide medical emergency. (Section 2.12 governs applicability of the Part 2 framework rather than the emergency carve-out itself.) Disclosure to a non-medical third-party victim from a Part 2 program generally requires patient consent or a court order — the medical-emergency exception does not, by its terms, authorize warnings to non-medical third parties.

Penalties for failure to warn

Tarasoff failure exposure is primarily civil — wrongful death and personal injury lawsuits by the victim's estate or surviving family. The original Tarasoff case itself resulted in liability against the Regents of the University of California after the murder of Tatiana Tarasoff. Recent settlements in CA, MA, and WA have run into seven figures.

Several states impose professional license discipline for failure to warn through the medical, psychology, or social work board. Criminal exposure is rare but possible in extreme cases where the failure rises to gross negligence.

In states that have rejected the duty (Texas, Virginia), the failure-to-warn case does not lie — but a malpractice case can still proceed on standard-of-care theory if the clinician's overall management of the threatening patient deviated from professional norms.

HIPAA permissible disclosure

The dispositive HIPAA carve-out for Tarasoff warnings:

• 45 CFR § 164.512(j)(1)(i) — disclosure consistent with applicable law and ethical standards to avert a serious and imminent threat to the health or safety of a person or the public, where the disclosure is to a person reasonably able to prevent or lessen the threat (including the target of the threat).
• 45 CFR § 164.512(f)(6) — disclosure to law enforcement about an individual who is suspected of being a perpetrator of a violent crime, or in connection with the apprehension of an individual.
• 45 CFR § 164.512(j)(4) — presumed-good-faith for disclosures made on the basis of actual knowledge or reasonable reliance.

The minimum-necessary standard at 45 CFR § 164.502(b) applies — disclose the threat and the necessary identifying information, not the entire treatment history.

OCR guidance on the "serious and imminent threat" carve-out confirms that the provider's good-faith determination of seriousness and imminence controls, even if subsequent events prove the threat was not carried out. The disclosure is permissible at the time the clinical judgment is made.

How d3rx fits

The d3rx compliance binder maintains the Tarasoff workflow inside the disclosure module: state-by-state duty matrix with statute and case citations, the credibility-assessment documentation template, the warning-script template for victim and law enforcement contact, the safety-planning checklist, the accounting-of-disclosures entry, and the 42 CFR Part 2 substance use disorder analysis where applicable. d3rx is an administrative documentation aid. It does not assess the clinical credibility of any threat and does not replace counsel.

D3rx compliance guides are administrative documentation aids. They do not certify compliance, provide legal advice, replace counsel, or guarantee an audit outcome. The practice remains responsible for reviewing, adopting, and maintaining its compliance program.