Is there a duty to warn in Australia?
Australia has no settled general legal duty to warn a third party, unlike the Tarasoff rule in the United States. Instead, health practitioners owe a duty of confidentiality with recognised exceptions. Privacy law permits disclosure to lessen or prevent a serious threat to life, health or safety, mandatory child protection reporting applies in every state and territory, and professional codes allow disclosure in those situations.
Privacy Act 1988 (Cth), Australian Privacy Principle 6 and section 16A
OAIC, Australian Privacy Principles guidelines, Chapter 6
Psychology Board of Australia, Code of conduct
Health Practitioner Regulation National Law, mandatory notifications
No Tarasoff rule, but real exceptions
In the United States the Tarasoff decision established that a therapist may have to warn or protect an identifiable person their client threatens. No Australian court has adopted that rule as a general duty, and Australian courts have been cautious about imposing liability on clinicians for the acts of patients. That does not mean a practitioner must stay silent. Australian law works the other way around. Confidentiality is the default, and the law then permits, and sometimes requires, disclosure in defined circumstances. Practitioners are usually protected when they disclose in good faith under one of those exceptions, and can face complaints or claims when they disclose outside them.
The privacy law serious threat exception
For private sector health providers, Australian Privacy Principle 6 in the Privacy Act 1988 (Cth) permits use or disclosure of personal information where a permitted general situation exists. Section 16A of the Act describes one such situation: the entity reasonably believes the disclosure is necessary to lessen or prevent a serious threat to the life, health or safety of any individual, or to public health or safety, and it is unreasonable or impracticable to obtain the person's consent. The threat no longer has to be imminent, but it must be serious. State health records laws, such as the Health Records and Information Privacy Act 2002 in New South Wales and the Health Records Act 2001 in Victoria, contain similar exceptions for public health services.
Duties that do require a report
Some situations go beyond permission and impose a duty. Every state and territory has mandatory reporting laws for suspected child abuse and neglect, and the list of mandated professions and the threshold for reporting differ by jurisdiction. Registered practitioners also have mandatory notification obligations about other practitioners under the Health Practitioner Regulation National Law where there is a risk of substantial harm to the public. Professional codes reinforce this. The Psychology Board of Australia's Code of conduct, which took effect in December 2025, and the shared Code of conduct for other registered health professions both allow disclosure without consent where required by law or to prevent serious harm.
What to do in practice
When a client discloses an intention to harm someone, the practitioner should assess the seriousness of the threat, consult a supervisor or colleague where time allows, and document the reasoning. If disclosure is warranted, share only what is necessary, with the people who can act, such as emergency services, a mental health crisis team or the person at risk. Where it is safe, tell the client what you are doing and why. Professional indemnity insurers and professional associations run advice lines for exactly these situations, and workers in care organisations should follow their organisation's policy and escalate to a manager. Legal advice may be needed in complex cases.
Ask Mandy this, and thousands more.
Get instant, cited answers on the NDIS, aged care, health and more, in plain English.
Try Ask Mandy