Duty to Warn in Colorado: Triggers, Immunity, and Liability

The duty to warn in Colorado requires mental health providers to break patient confidentiality and alert potential victims when a patient communicates a serious threat of imminent physical violence against a specific person or identifiable group. The rule lives in C.R.S. 13-21-117, and it cuts both ways: providers who warn in good faith are immune from suit, and providers who fail to warn after a qualifying threat can be sued, disciplined by their licensing board, or both.¹

Who the Statute Applies To

The statute’s definition of “mental health provider” is broad. It covers physicians, social workers, psychiatric nurses, psychologists, and any other mental health professional. It also reaches mental health hospitals, behavioral health entities, other institutions, and their staff.¹

That institutional coverage matters. The duty isn’t limited to the treating therapist. It can reach an intake worker who hears a threat during screening, a nurse on a psychiatric unit, or any other staff member to whom a patient directly communicates something that meets the statutory threshold.

What Triggers the Duty

The trigger is narrow and specific. A provider’s duty to warn arises only when a patient communicates a serious threat of imminent physical violence against a specific person or persons. The statute also reaches threats against people identifiable by association with a specific location or entity, such as employees at a named workplace or students at a named school.¹

Each element does work:

The threat must be communicated. The patient has to actually express it to the provider.
It must be serious, not offhand or clearly rhetorical.
It must involve imminent physical violence, not some vague future possibility.
It must target a specific person, group, or identifiable location.

Miss any element and the statute does not impose a duty, and the provider cannot be held civilly liable for failing to predict violence.¹

Clinical judgment lives in the gray zone. “I’m going to kill my neighbor tonight” clears the bar easily. “Sometimes I think about hurting people” probably does not. Between those two, the provider has to weigh the patient’s history, tone, context, and other relevant factors to decide whether the statutory threshold has been crossed.

What You Have to Do Once the Duty Is Triggered

When a patient does communicate a qualifying threat, the statute requires reasonable and timely steps. The provider must notify the threatened person (or, for threats against a location or entity, the person responsible for that location) and notify an appropriate law enforcement agency. The statute allows other appropriate actions as well and specifically names hospitalizing the patient as an option.¹

The hospitalization option connects to Colorado’s emergency mental health hold under C.R.S. 27-65-106, which allows a person to be held for up to 72 hours if an intervening professional reasonably believes the person has a mental health disorder and is an imminent danger to themselves or others.² In practice, a provider facing an imminent threat may pursue both paths at once: initiate a hold to contain the immediate danger and notify the intended victim and law enforcement.

Timing is part of the standard. The statute says “reasonable and timely efforts,” and a threat of imminent violence leaves no room for deliberation stretched over days. A provider who identifies a credible threat Friday afternoon and waits until Monday to contact police has probably failed the statutory standard.

Immunity for Providers Who Warn

A provider who warns a specific person or group, or who warns the person responsible for a threatened location, cannot be held civilly liable for making the disclosure or for predicting violent behavior.¹ Without that immunity, providers would face liability on both sides: sued for disclosing if the threat turned out to be empty, sued for not disclosing if someone got hurt. The statute resolves that tension by shielding good-faith warnings.

The practical implication: in a genuinely ambiguous case, the legal risk of warning is essentially zero, while the legal risk of staying silent could be substantial if the threat is real. The statute’s structure pushes providers toward action in close calls.

Civil Liability When a Provider Fails to Warn

C.R.S. 13-21-117 is built as an immunity statute with an exception. It starts by declaring that mental health providers are not liable for failing to warn or protect against a patient’s violence, then carves out the situations where the patient has communicated a serious, imminent, specific threat.¹ Once that exception applies, the provider can be sued by the victim or the victim’s family.

Litigation usually turns on two questions. First, did the patient actually communicate a threat that met the statutory threshold? If the statement was vague, non-specific, or lacked immediacy, the provider may still fall within the statute’s general immunity. Second, did the provider take reasonable and timely action? A provider who recognized the threat, documented it, and contacted law enforcement within hours stands in a far stronger position than one who noted it in a chart and did nothing else.

The financial exposure can be significant. Damages can include medical costs, lost income, pain and suffering, and in wrongful death cases, the full range of wrongful death damages available under Colorado law. Beyond the lawsuit itself, a finding of liability can trigger malpractice premium increases and affect future coverage.

Licensing Board Consequences

Civil liability isn’t the only risk. Colorado’s Department of Regulatory Agencies oversees licensing for mental health professionals, and a failure to fulfill the duty to warn can trigger administrative discipline separate from any lawsuit. Under C.R.S. 12-245-226, a licensing board may impose probation with conditions for continued practice, require examinations, mandate additional training, restrict the scope of practice, or issue confidential letters of concern. In serious cases, the board can suspend or revoke a license.³

These administrative actions can end a career even without a civil judgment. A provider placed on probation with practice restrictions may lose institutional affiliations. A revocation effectively ends a Colorado practice. Board proceedings are usually public, creating reputational harm that persists regardless of outcome.

How Courts Have Drawn the Line

The most instructive case interpreting Colorado’s statute is Fredericks v. Jonsson, decided by the Tenth Circuit in 2010. Dr. Mary Margaret Jonsson, a psychologist, conducted a mental health evaluation of Troy Wellington for the Colorado probation department. During the evaluation, Wellington told Dr. Jonsson that he “used to have frequent violent fantasies involving members of the Fredericks family, but that he no longer had violent thoughts directed at them.” Dr. Jonsson did not warn the Fredericks family or the probation department. Two weeks later, Wellington attempted to break into the Fredericks’ home.⁴

The court ruled for Dr. Jonsson. The key distinction was that Wellington described past violent fantasies but did not communicate a present threat. The Tenth Circuit held that a Colorado provider’s duty to warn is triggered only when “the patient himself predicts his violent behavior” by expressing a current threat to the provider. A patient’s disclosure of past violent thoughts, without a present statement of intent, does not cross the statutory line, even if the patient later acts violently.⁴

HIPAA Does Not Block a Warning

Providers covered by HIPAA sometimes worry that warning a potential victim will violate federal privacy rules. It won’t, as long as the disclosure is handled correctly. HIPAA’s privacy rule at 45 CFR 164.512(j) explicitly allows covered entities to disclose protected health information when the provider, in good faith, believes the disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public, and the disclosure is directed to someone reasonably able to prevent or lessen the threat, including the target.⁵ The federal rule and the Colorado statute line up: Colorado requires disclosure in these situations, and HIPAA permits it.

The catch is scope. HIPAA’s minimum necessary standard still applies. When you notify law enforcement or a potential victim, share only what’s needed to address the danger. Telling police that your patient threatened to harm a named individual, with identifying details sufficient for them to act, is appropriate. Forwarding the patient’s entire treatment history is not. Over-disclosure can produce HIPAA penalties even though the underlying warning was lawful.⁶

Documentation Is Your Defense

If a duty-to-warn case ends up in litigation, the provider’s contemporaneous notes will be the primary evidence of what the patient said, how the provider assessed the threat, and what steps the provider took. Charts completed days later or reconstructed from memory carry far less weight.

Useful documentation captures the patient’s specific statements as close to verbatim as possible, the provider’s assessment of whether those statements met the statutory threshold, the risk factors considered in reaching that assessment, and the actions taken as a result. If the provider concluded that the threat did not meet the statutory standard, the reasoning behind that conclusion deserves the same careful write-up as any warning given. A systematic, documented assessment process holds up far better under legal scrutiny than an unstructured gut call.