Duty to Warn in Arizona: Triggers, Discharge, and Immunity

Arizona’s duty to warn is narrow. Under ARS 36-517.02, a mental health provider is not liable for harm a patient causes unless two things are both true: the patient made an explicit threat of imminent serious physical harm or death against a clearly identified or identifiable victim, and the patient appeared to have both the intent and the ability to carry it out. When those conditions are present, the provider has to act. When they are not, the statute’s default is protection.¹

That framing is unusual. Most people assume the law begins with an affirmative “you must warn.” Arizona’s statute begins by saying no cause of action exists against a provider for failing to prevent a patient’s harm, and then carves out the exception. Everything else follows from that structure.

The Two Conditions That Trigger the Duty

Both of the following have to be present at the same time before any obligation arises:¹

An explicit threat against an identifiable victim. The patient has to communicate a direct threat of imminent serious physical harm or death aimed at a specific person you can identify. Vague hostility, generalized anger, or threats against unnamed groups do not qualify.
Apparent intent and ability to carry it out. The patient has to look like someone who both means to act and can act. A threat without any realistic means of follow-through is clinically different from a threat by a patient who has access to weapons or proximity to the victim.

A threat without apparent ability does not trigger the duty. Apparent ability without an explicit threat does not either. Clinical judgment is doing the work in the middle: you are assessing not just what the patient said but whether the patient can realistically do it.

What Counts as an Identifiable Victim

The statute says “clearly identified or identifiable.” It does not require a full legal name. If a patient says “I’m going to hurt my ex-wife’s new boyfriend” and you can reasonably figure out who that is, the victim is identifiable. The American Psychiatric Association describes the standard as “a specific (or at least a reasonably identified victim).”² Threats aimed at a category of people, or at someone the provider has no way to locate, sit in harder territory. The statute does not resolve every scenario, which is one reason the discharge checklist ends with a general reasonableness clause.

The Four Steps That Discharge the Duty

When the trigger is met, the statute spells out exactly what fully discharges the obligation. You have to do all of the following:¹

Notify every identifiable victim when possible. Reach out to each person you can identify as a target. The statute acknowledges some victims may not be reachable, but a genuine effort is required.
Notify a law enforcement agency. Contact a department in the area where the patient or the potential victim lives. This gives police the chance to intervene and documents that you acted.
Pursue voluntary or involuntary hospitalization if appropriate. Take reasonable steps when the clinical picture calls for it. Arizona’s involuntary evaluation process under ARS 36-520 allows any responsible person to apply for a court-ordered evaluation of someone who is a danger to others because of a mental disorder.
Take any other reasonable precautions. This covers whatever else a reasonable provider would do: adjusting the treatment plan, increasing session frequency, coordinating with other providers on the patient’s care.

The word “all” matters. Warning the victim alone does not discharge the duty. Calling the police alone does not either. The statute contemplates a provider working through every applicable step, with the hospitalization element qualified by “if appropriate” because inpatient care is not always warranted or available.

Who the Statute Applies To

Arizona defines “mental health provider” broadly under ARS 36-501. It covers any physician or provider of mental health or behavioral health services who is involved in evaluating, caring for, treating, or rehabilitating a patient.³ That includes psychiatrists, psychologists, licensed clinical social workers, licensed professional counselors, marriage and family therapists, and psychiatric nurse practitioners. If you deliver mental health or behavioral health services in a treatment or evaluation role, you are inside the statute.

Disclosure Immunity Is Broader Than the Duty

The immunity side of ARS 36-517.02 is deliberately wider than the liability trigger. A provider is immune from liability for disclosing confidential patient communications in either of two situations: when the patient has explicitly threatened serious harm to a person, or when the provider reasonably concludes that the patient is likely to cause serious harm. In either case the disclosure has to be made to reduce the risk of harm.¹

The two standards are not the same. Liability requires an explicit threat to an identifiable victim plus apparent intent and ability. Immunity kicks in at a lower bar. Even without an explicit threat, if you reasonably believe the patient is likely to seriously harm someone and you disclose information to prevent it, you are protected. The gap gives providers room to act on clinical judgment without waiting for a textbook threat.

How Confidentiality Rules Fit In

Arizona’s mental health confidentiality statute, ARS 36-509, generally requires health care entities to keep patient records and communications confidential. It also carves out exceptions, one of which permits disclosure to law enforcement when necessary to “avert a serious and imminent threat to an individual or the public.”⁴

The two statutes line up. When the duty under ARS 36-517.02 is triggered, ARS 36-509 independently authorizes the disclosure you need to make. Providers sometimes hold back out of fear that warning a victim or calling police will expose them to a lawsuit from the patient for breach of confidentiality. A provider who acts in good faith under these provisions is protected on both fronts.

What Happens If You Don’t Act

When both triggering conditions are present and the provider fails to take reasonable precautions, the default protection in Section A falls away. A cause of action can then proceed against the provider for failing to prevent the patient’s harm.¹ The victim or the victim’s family can sue for damages. The case will turn on whether the provider knew of the explicit threat, whether the victim was identifiable, and whether the response fell short of what a reasonable provider would have done.

Documentation is where cases are won or lost. A provider who assessed the threat and worked through the discharge checklist has a strong defense. A provider with no record of either has a much harder one. Write down what the patient said, how you weighed intent and ability, who you contacted, when, and what you did next.

1
Arizona Legislature. Arizona Revised Statutes 36-517.02 – Limitation of Liability; Exception; Discharge of Duty; Immunity for Disclosure
2
NCBI Bookshelf. Duty to Warn
3
Arizona Legislature. Arizona Code 36-501 – Definitions
4
Arizona Legislature. Arizona Code 36-509 – Confidential Records; Immunity; Definition