Running a threat assessment carries legal obligations on both sides of the ledger. An employer or school that ignores credible warning signs can be cited or sued for failing to prevent foreseeable harm, and an organization that reacts without a disciplined process can be sued by the person it assessed. The legal obligations of a threat assessment sit in that narrow lane: federal workplace safety law and, in some sectors, state statutes require you to act on recognized risks, while the ADA, FERPA, HIPAA, state duty-to-warn rules, and defamation law dictate how you are allowed to act.
The Duty to Conduct a Threat Assessment
The broadest federal mandate for employers is the OSHA General Duty Clause. Every employer must provide a workplace free from recognized hazards that are causing or likely to cause death or serious physical harm.1Office of the Law Revision Counsel. 29 USC 654 – Duties of Employers and Employees The Occupational Safety and Health Review Commission has consistently treated workplace violence as a foreseeable hazard when there is a history of incidents, employee reports, or industry guidance recognizing the risk.
To sustain a General Duty Clause citation tied to workplace violence, OSHA must show four things: the employer recognized or should have recognized the hazard, employees were exposed to it, the hazard could cause serious harm, and feasible measures existed to reduce the risk. Feasible abatement measures that OSHA has endorsed include written violence prevention programs, employee training, communication and reporting protocols, and staffing adjustments. An organization that sits on credible warning signs and takes no preventive action faces liability even though no specific OSHA standard addresses workplace violence directly.
The money is not trivial. Serious violations carry penalties up to $16,550 per violation, and willful or repeated violations can reach $165,514 per violation. These amounts adjust annually for inflation.2Occupational Safety and Health Administration. OSHA Penalties
School-Based Statutory Mandates
Approximately a dozen states now require K-12 schools to establish formal threat assessment teams by statute. The mandates vary, but they generally require a multidisciplinary team, a structured assessment process, and coordination with law enforcement when warranted. The trend toward mandatory school threat assessment teams has accelerated since 2018, so education-sector organizations should track their state legislature for new requirements.
Even in states without a specific school mandate, districts that fail to respond to known threats face potential negligence liability under general duty-of-care principles. The absence of a statute is not the absence of a duty.
The ADA Direct Threat Standard
Once a team starts assessing someone, disability law becomes the single most common source of liability. The Americans with Disabilities Act defines a “direct threat” as a significant risk to the health or safety of others that cannot be eliminated by reasonable accommodation.3Office of the Law Revision Counsel. 42 USC 12111 – Definitions If the person being assessed has a known or perceived disability, including a mental health condition, you cannot simply remove them based on general safety concerns.
The EEOC requires an individualized assessment based on the person’s present ability to safely perform their job, using current medical knowledge and objective evidence rather than speculation or stereotypes. Four factors must guide the determination:
- How long the risk is expected to last
- How severe the potential harm could be
- How likely the harm is to occur
- How imminent the harm is4U.S. Equal Employment Opportunity Commission. Enforcement Guidance on Disability-Related Inquiries and Medical Examinations of Employees under the ADA
When an employer reasonably believes an employee poses a direct threat, it may require a medical examination, but only to determine whether the employee can do the job safely with or without accommodation. The employer, not the employee, pays for that exam.
Skipping this analysis is where liability compounds. An employer who terminates or suspends someone based on a perceived mental health condition without a proper individualized assessment faces a disability discrimination claim on top of whatever safety concern prompted the review.
The Duty to Warn
Clinicians who sit on threat assessment teams, or who treat someone the team is reviewing, carry their own obligations. The California Supreme Court’s decision in Tarasoff v. Regents of the University of California established that a mental health professional’s duty of confidentiality ends where public safety begins. A therapist whose patient communicates a credible threat against an identifiable victim has an obligation to take reasonable steps to protect that person.
Most states have adopted some version of this principle. Roughly 33 states impose a mandatory duty to warn or protect through statute or case law. The remaining states either permit but do not require disclosure, or have not addressed the issue directly. For a threat assessment team that includes mental health professionals, knowing whether your jurisdiction’s rule is mandatory or permissive is essential: in a mandatory state, failure to warn is itself a source of liability.
Privacy Laws and When You Can Share Information
Teams often assume that privacy laws block them from sharing what they know. The federal statutes most frequently invoked, FERPA and HIPAA, both contain safety exceptions that were written for exactly these situations. The exceptions are narrow, and misusing them creates its own liability, so the language matters.
FERPA’s Health or Safety Emergency Exception
Schools conducting threat assessments can disclose personally identifiable student information without parental consent when the disclosure is necessary to protect the health or safety of the student or others. The regulation lets the school consider the totality of the circumstances surrounding a threat. If there is an articulable and significant threat, the school may share records with any person whose knowledge of the information is necessary to address the emergency.5eCFR. 34 CFR 99.36 – What Conditions Apply to Disclosure of Information in Health and Safety Emergencies The Department of Education has stated that it will not second-guess the school’s judgment if the determination had a rational basis at the time it was made.
Two limits apply. The exception covers only the period of the emergency, so it does not authorize a blanket release of a full education record. And disclosures must go to appropriate parties who are in a position to address the specific threat, not to a general audience.
HIPAA’s Serious and Imminent Threat Exception
HIPAA permits covered entities such as hospitals, clinics, and health plans to disclose protected health information without patient authorization when they believe in good faith that the disclosure is necessary to prevent or lessen a serious and imminent threat to a person or the public. The disclosure must go to someone reasonably able to prevent or lessen the threat, which can include the target of the threat or law enforcement.6eCFR. 45 CFR 164.512 – Uses and Disclosures for Which an Authorization or Opportunity to Agree or Object Is Not Required A covered entity that acts on a good-faith belief is presumed to have complied with the regulation, provided the belief was based on actual knowledge or a credible representation from someone with apparent authority.
“Serious and imminent” means more than vaguely concerning. Teams should document, at the time of disclosure, why they believed the threshold was met. The exception protects a defensible judgment call, not a reflexive one.
Defamation Risk and Qualified Privilege
Candid internal discussion is the engine of a threat assessment, and team members sometimes hesitate because they worry about being sued for defamation by the subject. In most jurisdictions, a qualified privilege protects communications made in good faith during internal investigations when the information is shared only with people who have a legitimate interest or duty in the matter. The privilege holds as long as the statements are not made with knowledge of their falsity or reckless disregard for the truth.
You strengthen the privilege by keeping threat assessment communications inside the team, documenting the factual basis for every concern raised, and avoiding speculation that outruns the evidence. You lose it by sharing information with people who have no need to know, or by making statements driven by personal animosity rather than genuine safety concern. Legal counsel on the team should set information-sharing protocols before a situation arises, not during one.
Documentation as a Liability Shield
Every category of liability discussed above turns on whether the team can show what it knew, when it knew it, and why it acted. OSHA citations rise or fall on whether the hazard was recognized and feasible measures were available. ADA direct-threat determinations must rest on objective evidence and the four factors. HIPAA’s good-faith presumption and FERPA’s rational-basis standard both reward contemporaneous reasoning. Qualified privilege survives only when statements have a documented basis.
Standardized documentation does the legal work. Using a consistent template to log behaviors, sources, dates, and the team’s analysis creates a defensible timeline. If a case reaches litigation, a well-maintained file shows that the team acted methodically rather than on gut instinct or bias. Sloppy records, hearsay, and undocumented conversations undermine every defense the law otherwise makes available to you.