Threat Assessment Team: Process, Privacy Laws, and Due Process

A threat assessment team is a multidisciplinary group inside a school, workplace, agency, or other organization that works to prevent targeted violence by identifying people whose behavior suggests they may be moving toward an attack, evaluating how serious the risk is, and intervening to change that trajectory before anyone is harmed. The approach is proactive rather than reactive. Instead of waiting for an incident and responding after the fact, the team pulls together professionals from different fields to spot concerning behavior early and connect the person of concern with support, supervision, or — when necessary — law enforcement.

Who Sits on the Team

No one discipline sees the whole picture. A teacher notices what a principal never hears about. A clinician reads behavior a security officer would miss. A lawyer catches a privacy issue the HR director didn’t flag. Federal guidance consistently recommends drawing team members from education, mental health, social services, law enforcement, faith communities, and other relevant institutions.¹

Most teams include some version of the following roles:

A team leader, usually a senior administrator, who directs the process and makes final decisions on case management. In schools this is typically a principal or district-level administrator.²
A mental health professional — psychologist, counselor, or social worker — who can evaluate behavior patterns, identify stressors, and recommend therapeutic responses.
A law enforcement or security representative, such as a school resource officer or corporate security director, who can run records, coordinate protective measures, and respond if the situation escalates.
In workplaces, a human resources representative who knows the applicable policies, administrative leave options, and the organization’s history with the individual.
Legal counsel to advise on privacy restrictions, liability, and whether proposed interventions comply with applicable law.

In schools, the Secret Service’s National Threat Assessment Center also recommends including teachers, guidance counselors, and coaches, because they see behavior that rarely reaches an administrator’s desk.² Teams should settle roles and protocols before a case lands, not during one.

What the Team Looks For

Threat assessment teams do not try to profile who might become violent. Research has not produced a reliable profile of a school shooter or workplace attacker, and demographics are not the lens. The focus is behavioral: observable actions that research has linked to people moving along a path toward targeted violence.

Practitioners watch for eight categories of warning behaviors: pathway behavior (researching or planning an attack), fixation (obsessive preoccupation with a person or cause), identification (associating with previous attackers or adopting a warrior mentality), leakage (telling a third party about intent), energy burst (a sudden spike in activity related to a target), novel aggression (an unrelated act of violence that crosses a new threshold), last resort (desperation, a sense of being cornered), and directly communicated threats. No single behavior is proof that someone will act, and the categories do not carry equal weight. The team’s job is to read the full pattern.

The distinction between a threat and threatening behavior matters here. Someone can shout a direct threat and never intend to follow through. Someone else may never utter a word but quietly acquire weapons, conduct surveillance, and rehearse. Effective threat assessment is designed to catch the second person, not just the first.

How Concerns Reach the Team

None of this works if people stay silent. Most organizations that implement threat assessment route all concerns to a single reporting point so that fragments from different observers end up in the same place.³ Common channels include anonymous tip lines, direct reports to supervisors, and standardized reporting forms. Schools often add anonymous options so students and community members can share concerns without social fallout.⁴ Peers tend to be the first to hear leakage or notice a change in someone’s behavior, and if reporting feels risky, they stay quiet.

In workplaces, federal whistleblower protections prohibit employers from retaliating against employees who raise safety concerns. OSHA enforces these protections, and prohibited retaliation includes anything that would discourage a reasonable employee from reporting — termination, demotion, schedule changes, or informal management freeze-outs.⁵ Many organizations write anti-retaliation language directly into their threat assessment policies, protecting good-faith reports even when the concern turns out to be unfounded.

How the Team Works a Case

The Secret Service describes the process in three phases: identify concerning behavior, assess the level of risk, and manage that risk through intervention.³ Terminology varies between organizations, but the arc is consistent.

Triage

When a report comes in, the first question is whether there is an imminent threat to life. If so, law enforcement handles the emergency before any assessment process begins.³ If there is no emergency, the team decides whether the reported behavior falls within its mission and warrants a closer look. Someone venting after a bad meeting is not someone researching their supervisor’s home address.

Inquiry and Full Assessment

Cases that pass triage move into an inquiry: enough fact-gathering to decide whether the behavior is credible and the case should be elevated. A full assessment goes deeper, gathering information from the person of concern, people who know them, and relevant institutional records. The Secret Service recommends looking across every system the individual interacts with — school, work, family, social services, law enforcement, and online activity — to build a comprehensive picture.³ Throughout, the team documents when reports came in, what was gathered, who was interviewed, and what was observed.²

Risk Determination

After gathering information, the team decides whether the person poses a risk of violence. Some teams use tiered classifications such as low, moderate, and high; others frame it more broadly as whether the person currently poses a risk and what intervention would move them toward a better outcome.³ The analysis looks at dynamic factors — current stressors, access to weapons, emotional state, social support, and whether the person has taken concrete steps toward an attack. Risk is not treated as a fixed trait. Someone assessed as high risk today can be low risk months later if the drivers are addressed.

What Intervention Looks Like

The point of intervention is to change the conditions pushing someone toward violence, not to punish. The DHS describes the primary aim as providing individuals with support services before a situation escalates to a point requiring law enforcement action.⁶ Threat assessment is built around off-ramps.

Interventions scale with the level of concern. Lower-risk situations may call for counseling, mentoring, conflict resolution, or addressing a practical problem — a housing crisis, a workplace grievance — that is fueling the behavior. In workplaces, a fitness-for-duty evaluation may be used to decide whether the person can safely continue in their role. Higher-risk cases call for more intensive measures: increased monitoring, environmental changes (relocating the individual or the potential target), administrative leave, or coordination with law enforcement for protective orders. If the assessment uncovers criminal activity or an immediate threat of serious harm, the team coordinates directly with law enforcement for an emergency response. Those cases are the exception.

Case management continues after the first intervention. The team re-evaluates periodically because circumstances change: a person who was stabilizing may hit a new crisis, and a person initially rated high risk may respond well to support. The Secret Service recommends that management planning address both factors of concern and positive factors, actively promoting stabilizing influences rather than only suppressing dangerous ones.³

Privacy Laws That Control Information Sharing

Teams need information from medical records, education files, and law enforcement databases, and federal law restricts when that information can move. Share too freely, and the organization has liability. Share nothing, and the team misses warning signs. Both failures can be catastrophic.

FERPA in Schools

The Family Educational Rights and Privacy Act generally bars schools from disclosing student education records without consent, but it carries a health or safety emergency exception that is central to school-based threat assessment. Under 34 CFR 99.36, a school may disclose personally identifiable information from education records without consent when knowledge of that information is necessary to protect the health or safety of the student or others.⁷

The standard is an “articulable and significant threat,” considered against the totality of the circumstances. The Department of Education has said it will not second-guess a school’s judgment if there was a rational basis for the decision at the time it was made.⁷ The exception is limited to the period of the emergency; it does not authorize a blanket release of records.⁸

HIPAA for Health Information

When a team needs mental health or medical records, HIPAA governs. Under 45 CFR 164.512(j), a healthcare provider may disclose protected health information without the patient’s authorization when, in good faith, the provider believes disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public, and the disclosure goes to someone reasonably able to prevent or lessen that threat.⁹

HHS has said it defers to the professional judgment of health providers in assessing the severity of a threat and will not second-guess a good-faith determination. Providers may share information with anyone in a position to prevent the harm, including family members, caregivers, and law enforcement.¹⁰ Good faith is presumed when the belief rests on actual knowledge or a credible representation from someone with apparent knowledge of the situation.⁹

Two points worth holding onto. The HIPAA exception is permissive, not mandatory; it allows but does not require disclosure. And it does not override stricter state privacy laws — if state law prohibits the disclosure, HIPAA does not create an independent right to share.

The ADA and Direct Threat

If the person being assessed has a known disability, the Americans with Disabilities Act adds requirements. Under 29 CFR 1630.2(r), an employer may treat someone as a “direct threat” only when there is a significant risk of substantial harm that cannot be eliminated or reduced through reasonable accommodation.¹¹ The determination has to be an individualized assessment grounded in current medical knowledge and objective evidence, not generalizations about a disability. Four factors drive the analysis:

The duration of the risk — ongoing or temporary.
The nature and severity of the potential harm.
The likelihood that harm will actually occur.
The imminence of the potential harm.¹¹

Removing or disciplining an employee based on a perceived threat tied to a disability, without that individualized analysis and without considering reasonable accommodations, creates significant ADA exposure.

Due Process When Consequences Follow

Threat assessment interventions can carry real consequences for the person being assessed: suspension, mandatory psychological evaluation, administrative leave, termination, or involuntary commitment. When a government institution — a public university, a government agency, a public school — imposes those consequences, constitutional due process applies. At minimum, the individual is entitled to notice of the action and the grounds for it, and an opportunity to respond before a neutral decision-maker.¹²

How much process is required depends on the severity of the action. An emergency removal when someone is actively threatening violence requires less process upfront than a long-term suspension or expulsion, but the person still needs a hearing afterward. Courts balance the private interest at stake, the government’s public safety interest, and the risk of an erroneous deprivation.¹² Private employers have more flexibility, but collective bargaining agreements, employee handbooks, and state laws often create enforceable procedural requirements even in the private sector.

This is where documentation pays off. A team that has recorded every report, interview, assessment factor, and rationale is in a far stronger position to defend its decisions than one working from informal impressions.

Why Organizations Stand Up These Teams

There is no federal OSHA standard specifically for workplace violence. OSHA’s General Duty Clause, however, requires employers to maintain a workplace free from recognized hazards that could cause death or serious harm, and OSHA has used that clause to cite employers who failed to address known workplace violence risks. OSHA recommends that every employer establish a zero-tolerance workplace violence policy and a written prevention program.¹³

In schools, a growing number of states now require formal threat assessment teams by statute, and federal agencies including the Secret Service, DHS, and the Department of Education publish guidance encouraging the practice even where it is not legally required.

Organizations that know about concerning behavior and do nothing can face negligence liability if that behavior turns into violence. If an institution was aware of warning signs, had the capacity to intervene, and chose not to, it may be held responsible for the harm that follows. A functioning threat assessment program is both a violence prevention tool and a legal risk management function, and the documentation it generates is often what shows, in hindsight, whether reasonable steps were taken.

1
U.S. Department of Homeland Security. Behavioral Threat Assessment and Management in Practice
2
United States Secret Service. Enhancing School Safety Using a Threat Assessment Model
3
United States Secret Service. Behavioral Threat Assessment Units: A Guide for State and Local Law Enforcement to Prevent Targeted Violence
4
SchoolSafety.gov. Threat Assessment and Reporting
5
U.S. Department of Labor. Whistleblower Protections
6
Department of Homeland Security. Threat Assessment and Management Teams Overview
7
eCFR. 34 CFR 99.36 – Conditions for Disclosure in Health and Safety Emergencies
8
Protecting Student Privacy (U.S. Department of Education). When Is It Permissible to Utilize FERPA’s Health or Safety Emergency Exception for Disclosures
9
eCFR. 45 CFR 164.512 – Uses and Disclosures for Which an Authorization or Opportunity to Agree or Object Is Not Required
10
U.S. Department of Health and Human Services. What Constitutes a Serious and Imminent Threat
11
eCFR. 29 CFR 1630.2 – Definitions
12
Legal Information Institute. Procedural Due Process
13
Occupational Safety and Health Administration. Workplace Violence