Duty to warn is not one rule. It is fifty, and the NCE knows it.
Candidates memorize Tarasoff and assume the answer is "warn the victim." The exam asks a harder question: what do duty-to-warn laws actually require, and the correct answer is that it depends on the state.
By Dr. Andrew Wichterman · September 22, 2026 · 5 min read
Here is a practice item that trips people up. "Which of the following is true of duty-to-warn laws?" The tempting answers are the absolute ones: they are identical in every state, they always require calling the police. The keyed answer is the uncomfortable one: they vary by state; some mandate action, some permit it, and some have no statute at all. This post explains why that is the right answer and what it means for how you practice.
The practice item discussed here was written for this site in the style of the NCE. It is not a question from the actual exam. NBCC does not release its items, and candidates sign a nondisclosure agreement.
Where the idea came from
Tarasoff v. Regents of the University of California is two decisions, not one. In 1974 the California Supreme Court held that a therapist who knows a client poses a serious danger to an identifiable person has a duty to warn that person. In 1976, on rehearing, the court broadened it to a duty to protect: warning is one way to discharge it, but so is notifying police, arranging hospitalization, or taking other reasonable steps. That distinction still shows up on the exam. "Duty to warn" is the popular name; "duty to protect" is the more accurate one.
Tarasoff is a California case. It binds California courts and nobody else. Every other state had to decide for itself whether to follow it, and they did not decide the same way.
Three kinds of states
Mandatory-duty states. Most states have, by statute or court decision, adopted some version of a duty to protect. When a client makes a serious threat against an identifiable person, the counselor must act, and the statute usually says what counts as acting: warning the victim, notifying law enforcement, or both. California codified its own rule this way after Tarasoff.
Permissive states. Some states say a counselor may disclose confidential information to prevent serious harm but is not required to. Texas is the usual example: in Thapar v. Zezulka (1999) the Texas Supreme Court declined to impose a duty to warn, while state law permits disclosure to medical or law enforcement personnel. In a permissive state the counselor who stays silent is not liable for failing to warn, and the counselor who discloses in good faith is protected.
States with no clear rule. A handful of states have neither a statute nor a controlling court decision. Counselors there rely on professional ethics, agency policy and legal consultation, and carry more uncertainty than colleagues elsewhere.
The lines move. Legislatures amend these statutes, and courts extend or narrow them. A rule you learned in graduate school may not be the rule where you practice today.
What the ACA Code says
The Code cannot resolve fifty different laws, so it sets a floor. Standard B.2.a says confidentiality does not apply when disclosure is required to protect clients or identified others from serious and foreseeable harm, and that counselors consult with other professionals when in doubt. Notice two things. The threshold language is "serious and foreseeable," which replaced the older "clear and imminent danger" in the 2014 revision; the exam tests that wording. And the Code says "required to protect," not "required to warn," which matches the Tarasoff II framing.
Standard I.1.c addresses the collision directly: when ethical responsibilities conflict with law, counselors make the conflict known, work to resolve it, and if they cannot, may adhere to the law. In practice, that means your state statute governs the mechanics of what you do, and the Code governs how carefully you think about it.
How this shows up on the exam
Recall items ask what Tarasoff established, what "duty to protect" adds to "duty to warn," and what the Code's threshold language is. Application items give you a vignette: a client describes a specific, credible plan to harm a named person. The correct action is almost always to take reasonable protective steps consistent with state law, which may include warning the intended victim and notifying authorities. The distractors are the extremes: maintain confidentiality and monitor, terminate the client, or document and do nothing else.
The item at the top of this post is a third type: it asks whether you understand that the law itself is variable. Absolute options ("identical in every state," "always require the police") are wrong because they describe a uniformity that does not exist. When you see an absolute claim about state law on the NCE, be suspicious of it.
What to do in your own practice
Look up your state's statute by name and read it. Know whether your state mandates or permits disclosure, what triggers the duty (a threat, an identifiable victim, both), and what actions discharge it. Put the citation in your informed consent so clients know the limit before they need to. Consult when a case is close to the line, and document the consultation. And if you move states or start telehealth across state lines, do it again, because the client's location, not yours, usually determines which law applies.
Check the current handbook. Exam logistics, fees and policies change. Confirm specifics against the NBCC candidate handbook and your state board's current rules. Aligned to the current NCE blueprint, valid for exams through June 30, 2027.
The exam rewards candidates who know that "it depends on the state" is sometimes the most precise answer available. Your clients are better served by a counselor who knows which state, and what it says.