The duty to warn requires therapists to notify identifiable potential victims or law enforcement when a client poses a credible, specific threat of violence, making it one of several narrow, legally defined exceptions to therapist-client confidentiality, alongside mandatory reporting laws, imminent self-harm risk, and court orders, that vary meaningfully by state.
Therapy isn't as confidential as you think - and knowing exactly where the line is can actually make you a braver, more open client. The duty to warn is a legal obligation that compels therapists to act when a credible threat exists, and understanding it puts you in control of your own care from day one.
What is the duty to warn? Definition and legal meaning
When you start therapy, confidentiality is one of the first things your therapist will explain. What you share in sessions stays between you and your therapist. That promise is real, and it matters. Therapist confidentiality is not absolute, though. Specific legal exceptions exist, and one of the most significant is known as the duty to warn.
The duty to warn is a legal obligation that requires your therapist to take action when a client makes a credible, specific threat of violence against an identifiable person. In plain terms: if your therapist has good reason to believe you intend to harm someone, they may be legally required to warn that person, notify law enforcement, or both. This is not a judgment call left entirely to your therapist’s discretion. In many states, it is a defined legal duty with real consequences for therapists who fail to act.
This concept is distinct from other situations where your therapist might share information without your permission. Billing departments, insurance companies, and administrative staff may access certain records as part of routine care. Those disclosures are governed by privacy laws like HIPAA (the Health Insurance Portability and Accountability Act, which sets federal standards for protecting medical information). The duty to warn operates in a different category entirely. It is not about paperwork or payment. It is about preventing serious harm to a third party.
Understanding where confidentiality ends, and why, helps you make sense of the full picture. Your therapist is not free to share what you tell them on a whim. The exceptions are narrow, legally defined, and purposeful. Knowing this upfront means you can approach therapy with a clearer, more accurate sense of what to expect, and what your rights actually are.
Duty to warn vs. duty to protect: what’s the difference?
These two terms are often used interchangeably, but they carry distinct legal meanings that shape what a therapist is actually required to do. Understanding the difference matters, especially if you are a client who has concerns about when and how your private disclosures might leave the therapy room.
Duty to warn is the narrower of the two obligations. When this standard applies, a therapist must take a specific action: directly notify the identifiable potential victim, law enforcement, or both about a credible threat. There is little flexibility here. The requirement is tied to a concrete act of notification.
Duty to protect is broader. As outlined in clinical practice implications of the Tarasoff duty to warn vs. duty to protect, therapists working under this standard can fulfill their obligation through a range of reasonable steps. Those steps might include warning the intended victim, contacting police, pursuing involuntary hospitalization, increasing session frequency, or adjusting the client’s treatment plan altogether. The goal is safety, but the path to get there is more flexible.
Courts and state legislatures have treated these as meaningfully different obligations over time, as shown in research on the legal evolution from duty to warn to duty to protect. Some states mandate duty to warn, some mandate duty to protect, and some require both. A handful of states have no statute on the matter at all, leaving therapists to rely on professional and ethical guidelines.
From a client’s perspective, this distinction is worth knowing. In duty-to-protect states, your therapist has more clinical flexibility to address a safety concern without necessarily disclosing details to outside parties. If you experience anxiety symptoms around privacy and trust in therapy, understanding this distinction can help clarify what confidentiality actually looks like in practice.
Every situation where your therapist can legally break confidentiality
The duty to warn is probably the most well-known exception to therapist-client confidentiality, but it is far from the only one. The law carves out several specific situations where your therapist is either required or permitted to share what you say, with or without your consent. Understanding all of them gives you a clearer picture of what confidentiality actually protects and where its limits are.
Threats to an identifiable person
This is the Tarasoff exception in action. When a client makes a credible, specific threat against a named or otherwise identifiable person, therapists in most states have a legal duty to warn or protect that individual. The key word here is credible. Research on structured clinical risk assessment in threat situations shows that clinicians evaluate threats based on specificity, the client’s history, access to means, and stated intent, not just the words themselves. A vague expression of anger toward an ex-partner is treated very differently from a detailed threat with a stated plan.
Depending on state law, your therapist may be required to warn the potential victim directly, notify law enforcement, or both. In some states, APA guidelines on voluntary and involuntary psychiatric hospitalization also inform decisions about whether hospitalization is an appropriate protective step. The goal is always to use the least disruptive intervention that adequately addresses the risk.
Child abuse and neglect
Mandatory reporting of suspected child abuse or neglect is the law in all 50 states. This means your therapist is legally required to report to child protective services if they have reasonable suspicion that a child is being abused or neglected, even without your consent and even without proof. The threshold is reasonable suspicion, not certainty. Therapists are not investigators, and they are not expected to confirm abuse before reporting it.
This applies whether the client is the child, a parent, or another adult disclosing information about a child’s situation. If you are working through your own trauma history, including experiences related to PTSD recovery, and you disclose that a child is currently at risk, that disclosure falls under mandatory reporting regardless of the context in which it comes up.
Imminent risk of self-harm
Not every mention of self-harm or suicidal thoughts triggers a confidentiality break. Therapists distinguish carefully between passive ideation, such as wishing you were not here without any plan or intent, and imminent risk, which involves a specific plan, access to means, and clear intent to act. Passive ideation is something therapists work through with clients regularly, and it does not typically require breaking confidentiality.
When risk is assessed as imminent, your therapist will generally try the least restrictive intervention first, such as a safety plan, an emergency contact, or a voluntary crisis evaluation. Involuntary hospitalization, which does involve disclosure to other providers and facilities, is considered when less restrictive options are insufficient to keep you safe. The APA’s guidance on involuntary hospitalization emphasizes that it is a protective measure of last resort, not a routine response to distress.
Elder abuse and dependent adults
Most states have mandatory reporting laws for the abuse, neglect, or exploitation of older adults and dependent adults. A dependent adult is generally defined as someone between 18 and 64 who has a physical or mental disability that limits their ability to protect themselves or carry out normal activities. If your therapist reasonably suspects that an older or dependent adult is being harmed, they are typically required to report it to adult protective services, following a structure similar to child abuse reporting.
Court orders vs. subpoenas
This is one of the most misunderstood areas of therapist confidentiality. A subpoena alone does not compel your therapist to hand over your records or testify about your sessions. A subpoena is a legal request, and therapists can, and often do, challenge it in court to protect your privacy. A court order is different: it is a judge’s directive, and it does compel disclosure. Your therapist’s legal and ethical obligation is to resist disclosure until a court actually orders it, not to comply the moment any legal document arrives.
Other exceptions: communicable disease, insurance, and minors
A few additional situations are worth knowing about, even if they come up less frequently.
- Communicable disease reporting: Some states require or permit therapists to disclose when a client poses a public health risk, for example, if someone is HIV-positive and refuses to inform a partner they are actively putting at risk. The rules vary significantly by state.
- Insurance and billing: When you use insurance to pay for therapy, your therapist shares diagnostic codes and some treatment information with your insurer as part of standard billing practice. This is governed by HIPAA and is not a dramatic breach of confidence, but it is a form of disclosure you should be aware of.
- Minors and parental access: Parents generally have some legal right to access their minor child’s therapy records, since minors cannot typically consent to their own treatment. Many states do provide partial confidentiality protections for minors, particularly around sensitive topics like substance use or reproductive health, but the specifics depend on where you live.
How duty to warn laws vary by state
Not every therapist in the country operates under the same legal rules. Duty to warn laws differ significantly from state to state, which means the obligations your therapist has, and the protections you have as a client, depend largely on where you live. Research on interstate variation in Tarasoff duty to warn and protect statutes confirms that this patchwork of laws creates meaningful differences in how therapists are expected to respond to threats of violence across the country.
The four main categories of state law
States generally fall into one of four groups when it comes to duty to warn laws.
- Mandatory duty to warn: The therapist is legally required to notify the identifiable potential victim, and sometimes law enforcement, when a credible threat is made. The law leaves little room for discretion.
- Mandatory duty to protect: The therapist must take action to protect a potential victim but has some flexibility in how they do it. Notification is one option, but so is hospitalization or other clinical interventions.
- Permissive duty: The therapist is legally allowed to warn or take protective action but is not required to. This gives therapists more discretion while shielding them from liability if they choose to act.
- No statute: The state has not passed a law addressing this situation at all. Therapists in these states rely on court decisions, professional ethics codes, or both to guide their decisions.
California sits in a category of its own as the origin of the entire legal framework. Research on California’s shift from duty to warn to solely a duty to protect shows that the state has actually moved away from the original Tarasoff ruling and now mandates a duty to protect rather than a strict duty to warn. That evolution reflects how even the most influential duty to warn states continue to refine their approach over time. States like Vermont have taken a strictly mandatory stance, while Texas has no statutory duty to warn at all.