Survey
* Your assessment is very important for improving the workof artificial intelligence, which forms the content of this project
* Your assessment is very important for improving the workof artificial intelligence, which forms the content of this project
TARASOFF DUTIES AFTER NEWTOWN* Mark A. Rothstein After recent tragedies involving mass murders on a college campus in Virginia,1 an Army base in Texas,2 a congressional constituent event at a shopping center in Arizona,3 and a movie theater in Colorado,4 one might have assumed the public had become numb to horrendous and senseless acts of killing. If so, one would have been wrong. The public was not prepared for the brutal and cold-blooded murder of twenty first-grade school children and six teachers and staff at Sandy Hook Elementary School in Newtown, Connecticut, on December 14, 2012.5 Following the all-too-familiar emotional stages of shock, grief, and anger, many members of the public and elected officials turned to the issue of how to prevent such tragedies in the future. Two main questions quickly became the focus of policy makers. First, is it politically feasible and practically effective to restrict access to military-style assault weapons and largecapacity magazines that enable these mass murders? Second, is it possible for mental health professionals, family members, and others to identify serious threats and to intervene with mentally unstable individuals in time to prevent future tragedies? This article is concerned with one aspect of the mental health issue, whether a mental health professional has a duty to protect threatened victims. After reviewing the inconsistent and confusing interpretations of the Tarasoff doctrine and related principles the article proposes a strategy for developing and implementing a unitary, national standard for health care providers’ privilege to disclose confidential information and their duty to protect individuals threatened by potentially violent mental health patients. The facts of Tarasoff Although the basic facts of the Tarasoff case are well known to most readers of this journal, a more complete version may be valuable.6 Tatiana (Tanya) Tarasoff was born in China to Russian parents, grew up in Sao Paolo, Brazil, and moved with her family to Berkeley, California, in 1963, six years before her death. Prosenjit Poddar grew up in a small Bengazi village in northern India as a member of the Harijan or “untouchable” caste. He managed to overcome his modest start in life to graduate from the Indian Institute of Technology in 1961. He came to the United States in 1967 as a graduate student in naval architecture at the University of California at Berkeley and lived at the International Student House (ISH). * This article expands on themes addressed by the author in written, oral, and follow-up testimony presented to the Subcommittee on Investigations and Oversight, House Committee on Energy and Commerce, April 26, 2013. See http://energycommerce.house.gov/hearing/doeshipaa-help-or-hinder-patient-care-and-public-safety (last accessed September 9, 2013). 1 Poddar had a difficult time adjusting from Indian to American culture, particularly relations with women. He had attended all-male schools and had little experience with girls. Poddar met Tanya in the fall of 1968 while she was taking folk dancing classes at the ISH. When Tanya kissed Poddar at the ISH on New Year’s Eve, 1968, he believed Tanya had a romantic interest in him. When he attempted to have a relationship with Tanya, however, he was continually rebuffed. He was especially distressed to learn that she was having sexual relations with other men. Poddar began to deteriorate mentally, missing classes and work, and spending hours alone in his room. He told friends he was going to kill Tanya. Tanya went to Brazil during the summer of 1969 and during her absence, at the suggestion of a friend, Poddar began undergoing counseling at the Cowell Memorial Hospital at the University of California at Berkeley, beginning with an emergency session on June 5, 1969. On August 20, 1969, while in a counseling session with Dr. Lawrence Moore, a clinical psychologist, Poddar confided that he planned to kill Tanya. Dr. Moore diagnosed Poddar as suffering from “paranoid schizophrenic reaction, acute and severe.” Dr. Moore and two colleagues, Dr. Stuart Gold and Dr. James Yandell, believed Poddar presented a danger to himself and others. Dr. Moore called campus police and urged them to commit Poddar to a mental hospital. The campus police detained Poddar and searched his room, but because he seemed rational they did not attempt to have him committed. They released him after he promised to stay away from Tanya. Dr. Harvey Powelson, Dr. Moore’s superior, then directed that no further action be taken to detain Poddar. After this incident, Poddar did not seek any additional treatment.7 At about the same time, July 1969, Poddar began to room with Alex Tarasoff, Tanya’s brother, with whom he shared some technical interests. Alex warned Poddar to leave his sister alone, although he did not believe that Poddar intended to kill her. When Tanya returned from Brazil in October 1969, she recounted her romantic escapades in Brazil and Poddar learned that she was having relations with other men. On October 27, 1969, through Alex, Poddar learned that Tanya was alone at home. Poddar went to her house, argued with her, shot her with a pellet gun, and stabbed her seventeen times with a kitchen knife. Poddar was arrested and charged with murder. Rejecting his insanity defense, a jury convicted Poddar of second-degree murder. On appeal, the California Court of Appeals reduced his conviction to manslaughter. The Supreme Court of California then ordered a new trial because of the trial judge’s failure to instruct on the issue of diminished capacity. Poddar was never retried. The State of California allowed him to return to India, where he reportedly married a lawyer and lived a normal life. Procedural history Tanya Tarasoff’s parents brought a wrongful death action in Alameda County Circuit Court against the University of California and several individual defendants (campus security personnel and mental health professionals). The court dismissed all of the actions and the plaintiffs appealed. The California Court of Appeals affirmed the dismissal of all the wrongful death actions, holding that the decision not to proceed with a seventy-two hour evaluation of 2 Poddar was an exercise of discretion for which California law provided immunity to public employees.8 The California Supreme Court reversed and remanded the case, holding that even though the defendant-psychotherapists did not have a professional relationship with the victim, they still had a duty to exercise due care to warn her of peril.9 The court held that neither the campus police nor the therapists were statutorily immune for the alleged failure to confine Poddar. The court’s opinion was quite controversial, and the Supreme Court granted a rehearing in the case.10 In its second decision in the case, the California Supreme Court affirmed dismissal of the actions against the campus police on the grounds of immunity, but remanded for trial on the asserted liability of the therapists for their failure to protect a foreseeable victim of a threat. The case was settled one year after the second decision of the California Supreme Court.11 Majority opinion In an opinion by Justice Matthew Tobriner, the California Supreme Court held that the plaintiffs stated a cause of action against the psychotherapists.12 The court held that the special relationship between a patient and his or her doctor or psychotherapist may support affirmative duties for the benefit of third parties. The court rejected the argument that establishing a duty to exercise reasonable care to protect third parties is unworkable because therapists cannot accurately predict whether a patient will resort to violence. The court stated that a therapist need not “render a perfect performance” and that the law only requires a therapist to exercise “`that reasonable degree of skill, knowledge, and care ordinarily possessed and exercised by members of (that professional specialty) under similar circumstances.’”13 The court also pointed out that, in this case, Dr. Moore was accurate in his prediction of violence; the alleged act of negligence was his failure to warn Tanya. The court next rejected the argument that recognizing a cause of action for failure to exercise reasonable care to protect the foreseeable victim of a threat would result in unnecessary warnings. The court said that “[t]he risk that unnecessary warnings may be given is a reasonable price to pay for the lives of possible victims that may be saved.”14 The court also rejected the argument that the possibility of issuing warnings based on information disclosed in psychotherapy would undermine the free and open communications essential to counseling. The court conceded the importance of protecting the patient’s interest in privacy, but noted the public interest in safety from violent assault.15 “The protective privilege ends where the public peril begins.”16 The court reiterated that only reasonable care is required. “If the exercise of reasonable care to protect the threatened victim requires the therapist to warn the endangered party or those who can reasonably be expected to notify him, we see no sufficient societal interest that would protect and justify concealment.”17 Although Tarasoff is often regarded as establishing a duty to warn the intended victim of a violent threat, the duty recognized by the court is broader. It requires a mental health professional to take reasonable and necessary action to protect the threatened individual, which could include having the patient confined, notifying law enforcement, warning the intended victim, or other measures to protect the intended victim.18 3 Dissent Justice William Clark, joined by Justice Marshall McComb, dissented. Clark opposed establishing any duty on the part of a mental health professional based on information disclosed in therapy. He asserted that if confidentiality were undermined, the therapist-patient relationship would be irreparably destroyed.19 His argument was essentially in three parts: (1) deterrence – people will not seek mental health treatment if they believe their mental health information will be shared with others; (2) full disclosure – confidentiality allows a patient to provide complete and accurate information essential to treatment; and (3) trust – assurance that that a patient’s communications are confidential is essential to building trust. These same arguments are often made today. State law responses to Tarasoff Tarasoff raised numerous questions about when mental health professionals have a duty to act, what conduct or communications by the patient gives rise to the duty, and what actions by the mental health professional will satisfy the duty.20 Although early adoptions of the Tarasoff rule in other jurisdictions came about through judicial opinions,21 the duty to protect, often expressed as merely the duty to warn, soon became codified by state legislation. In California, a statute enacted in 1986 and amended in 2007 provides that if a duty to protect exists, there is no liability for a therapist who notifies the police and makes a reasonable effort to notify the intended victim.22 In reviewing the state statutes it is clear there is no single Tarasoff duty, but fifty-one jurisdiction-specific duties.23 As of 2013, twenty-nine states have laws mandating the reporting of serious threats,24 sixteen states and the District of Columbia have permissive reporting laws,25 four states have no duty to report,26 and one state (Georgia) has its own unique law.27 Some state statutes apply different standards to different professionals (e.g., psychologists, social workers).28 Other state laws differ on the circumstances when warnings or other actions are appropriate or vary in the individuals or entities that must be protected.29 Finally, some states grant immunity from liability if the mental health professional complies with certain statutory requirements.30 Professional guidelines Groups representing mental health professionals, such as the American Psychiatric Association, submitted amicus curiae briefs in favor of the defendants in Tarasoff and opposing possible liability for failing to protect the objects of threats.31 Therefore, it is not surprising that these professional organizations and many of their members have not embraced the Tarasoff decision or some of the subsequent state statutes. Beyond the general opposition to imposing a duty to protect third parties, there is wide variation in the ethical pronouncements of the professional organizations on the privilege to disclose confidential information and the duty to act on the basis of a threat disclosed in psychotherapy. 4 The American Medical Association (AMA) Code of Medical Ethics applies to all physicians, not merely psychiatrists. Section 5.05 provides in pertinent part: “When a patient threatens to inflict serious physical harm to another person or to himself or herself and there is a reasonable probability that the patient may carry out the threat, the physician should take reasonable precautions for the protection of the intended victim, which may include notification of law enforcement authorities.”32 Of note, there is no specific mention of warning the threatened individual. The codes of ethics of mental health specialists are even less demanding. They simply focus on when it is permissible to breach confidentiality and do not mention a duty to protect or warn at-risk individuals. The American Psychological Association’s Ethical Principles of Psychologists and Code of Conduct section 4.05(b)(3) provides that disclosure of confidential information is permitted to “protect the client/patient, psychologist, or others from harm.”33 Although the purpose of disclosure is protection, there is no indication of the specifics of disclosure. Also, the psychologist is expressly included within the group of persons whose safety would justify the disclosure of confidential information. The American Psychiatric Association’s Principles of Medical Ethics also addresses the privilege to disclose confidential information. Section 4, point 8 provides: “When, in the clinical judgment of the treating psychiatrist, the risk of danger is deemed to be significant, the psychiatrist may reveal confidential information disclosed by the patient.”34 The statement is noteworthy for its vagueness. Disclosures under the HIPAA Privacy Rule The Health Insurance Portability and Accountability Act (HIPAA)35 provides for the Secretary of Health and Human Services (HHS) to issue regulations establishing standards for the privacy of individually identifiable health information. Because HIPAA and its Privacy Rule36 are applicable only to those entities in the health care payment chain, there are only three types of entities covered by the Privacy Rule: health care providers, health plans, and health clearinghouses (and, after a 2013 amendment, their business associates).37 Although it was not intended by Congress in the HIPAA statute or HHS in its rulemaking, the HIPAA Privacy Rule has become the de facto legal standard for health privacy issues involving both covered and noncovered entities in the United States. Therefore, what the Privacy Rule prescribes about health information uses and disclosures is exceedingly important. One provision of the Privacy Rule permits a covered entity to disclose twelve types of health information of importance to the public (e.g., for public health) without the need for the patient’s consent or authorization so long as the disclosures are described in the entity’s notice of privacy practices.38 One of these exceptions, disclosures “to avert a serious threat to health or safety,” provides in pertinent part: (j) Standard: Uses and disclosures to avert a serious threat to health or safety. (1) Permitted disclosures. A covered entity may, consistent with applicable law and standards of ethical conduct, use or disclose 5 protected health information, if the covered entity, in good faith, believes the use or disclosure: (i)(A) Is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public; and (B) Is to a person or persons reasonably able to prevent or lessen the threat, including the target of the threat . . .39 There are two main problems with this regulation. First, the requirement of “imminence” sets the bar too high for disclosure. Imminence implies such immediacy that many mental health professionals might believe that even a deeply troubled and dangerous person who made credible threats did not expressly indicate that he or she was planning to take imminent action to carry out the threats. In Tarasoff, Poddar did not kill Tanya until ten weeks after he disclosed to Dr. Moore his intent to do so. Perhaps that is why the Tarasoff decision does not use the word “imminent” to describe the type of threat giving rise to a mental health provider’s duty to protect or warn. Nevertheless, eighteen states and the District of Columbia require that to establish a duty to act a threat must be “imminent” or “immediate.”40 Although the imminence requirement likely was intended to limit the duties of mental health professionals, it is equally likely to result in confusion and a reluctance to take action to prevent harms. The drafters of the Privacy Rule erred by including the requirement of “imminence,” and it should be removed as soon as possible. The second problem with the regulation is that it defers to “applicable law and standards of ethical conduct.” As noted above, the legal standards differ significantly among the states and the professional standards are vague and permissive. Consequently, the Privacy Rule, by specifically referencing these standards, contributes to the confusion about both when it is permissible to breach confidentiality and when it is necessary to take action to protect the intended victims of violent threats. Because of this confusion some uninformed and risk-averse mental health providers may be reluctant to invoke their privilege to breach confidentiality and to exercise their duty to act. Such reticence could result in the failure to prevent a life-threatening situation. Toward a unitary, national standard for a privilege to disclose and a duty to protect The first goal for reforming mental health disclosures and actions to protect third parties should be to provide clarity, certainty, and predictability. Ultimately, the objective should be to harmonize disparate state laws and federal regulations. From a legal standpoint, the problem of harmonization is complex, but not insoluble. One potential strategy is to begin by amending the HIPAA Privacy Rule. For reasons of federalism, Congress is unlikely to enact legislation establishing a national standard for the duty to protect threatened victims because it involves matters traditionally within the purview of state law (e.g., regulation of health care providers; tort law). Similarly, because the statutory language of HIPAA only grants HHS limited regulatory powers, HHS would be unable to set a national standard for the duty to protect through HIPAA-based rulemaking. Nevertheless, it may be possible to achieve the goal of substantial national uniformity for both the privilege to breach confidentiality and the duty to protect indirectly by utilizing existing legislation and a two-step process of harmonization. 6 First, HHS has the statutory authority to establish rules for when it is permissible under the Privacy Rule for a covered entity to breach confidentiality to avert a serious threat to health or safety. Indeed, HHS already has promulgated such a rule, but, as described above, it should be amended. After considering the views of all stakeholders, HHS should amend the current regulation and promulgate an explicit and detailed new regulation. For example, such a regulation could provide that when a psychotherapist or other provider of mental health services makes a reasonable determination that a patient constitutes a threat to cause death or serious harm to one’s self or another, the provider is permitted, under the Privacy Rule, to disclose protected health information to law enforcement personnel, any intended victim or victims, or others who are in a position to avert the harm. HHS should delete the “imminence” requirement as well as the reference to “applicable law and standards of ethical conduct.” Amendment of the Privacy Rule should be accompanied by comprehensive guidance and specific examples. HHS also should work with professional associations, state and local governments, nongovernmental organizations, and consumer groups to provide meaningful notice and information about the amended regulation. The second step involves the states. As noted, the amended HIPAA Privacy Rule provision would not expressly address the issue of when a health care provider has an affirmative duty to act. At least initially, the duty to protect third parties would remain a matter of state law, especially with regard to tort liability. However, after a new, well considered Privacy Rule provision is promulgated with widespread input, it is foreseeable that many states would move to harmonize their laws with the new federal regulation. State legislative initiatives to coordinate with the federal regulation are likely to receive strong support from consumer groups, the public, and perhaps even mental health professionals because having reasonable and uniform federal and state laws is not only easier for all affected individuals to understand, it is likely to prevent serious risks to safety and thereby save lives. Even if amending state laws is a difficult or a drawn-out process, amending the Privacy Rule privilege to disclose confidential information will be a major improvement. While the Privacy Rule is being amended, all other federal laws and regulations dealing with the disclosure of mental health information and the duty to protect third parties should be reviewed and, as needed, amended to achieve consistency. Of particular importance are the Family and Educational Rights and Privacy Act (FERPA)41 and the implementing regulations of the Department of Education.42 FERPA applies to most public and private postsecondary institutions and to the health records of students at campus health clinics, where some of the perpetrators of mass murders had been patients.43 The FERPA regulations provide: “An educational agency or institution may disclose personally identifiable information from an education record to appropriate parties, including parents of an eligible student, in connection with an emergency if knowledge of the information is necessary to protect the health or safety of the student or other individuals.”44 This permissive provision is broadly worded and, unlike the analogous HIPAA provision, does not require an imminent threat, although it requires an “emergency.” Other issues 7 This article is concerned with only one aspect of the Tarasoff doctrine. The duty to protect is far more complicated than presented here, and various issues remain, including the following: Does the duty to protect arise from general threats of violence or does the patient need to identify an individual victim? How severe (e.g., assault vs. murder), likely (e.g., possible vs. definite), and imminent (e.g., tomorrow vs. next year) does the threat need to be to trigger the duty to protect? Does the duty apply to all health professionals (e.g., primary care physicians) or only mental health professionals (e.g., psychiatrists, clinical psychologists)? These issues should be addressed through amended, harmonizing state statutes and developing case law. Conclusion Individual mental health as well as public health and safety are advanced by maintaining strong protections for the privacy and confidentiality of mental health information, including information disclosed in psychotherapy. At the same time, for the small number of individuals with severe mental illness who constitute a serious threat to self or others, it is essential to have legal standards for the duty to protect victims of threats that are reasonable, uniform, well understood, and consistently followed. The current legal situation is inconsistent and confusing, thereby likely contributing to a reluctance to act by mental health professionals. The first step in remedying the situation is to amend the HIPAA Privacy Rule. This should be followed by efforts to harmonize relevant federal statutes and regulations dealing with the disclosure of mental health information. Finally, consistent state laws should clarify the duty of mental health professionals to protect individuals who are the object of violent threats, including, as appropriate, notifying law enforcement and warning the individual. These measures will reduce the risk of violence by severely disturbed mental health patients while preserving the confidentiality upon which timely and effective treatment depends. Acknowledgment: Nicholas Craddock, J.D. 2014, contributed excellent research assistance. 1 Seung-Hui Cho, a 23-year-old student at Virginia Tech with a long history of mental illness, killed 32 students and faculty and wounded 17 others on campus in Blacksburg, Virginia, on April 16, 2007. He also killed himself after the attack. 2 Major Nidal Malik Hassan, a 39-year-old Army psychiatrist who was described as increasingly isolated and under pressure, killed 13 and wounded 32 at Fort Hood, Killeen, Texas, on November 5, 2009. He was convicted of murder by a military court in 2013. 3 Jared Lee Loughner, a 22-year-old exhibiting symptoms of mental illness, killed six and wounded 13 (including then-Rep. Gabrielle Giffords) outside a Safeway supermarket in Tucson, Arizona, on January 8, 2011. He pled guilty to 19 counts of murder or attempted murder. 4 James Eagan Holmes, a 24-year-old with a history of mental illness, killed 12 and wounded 70 at a movie theater in Aurora, Colorado, on July 20, 2012. He is awaiting trial. 8 5 Adam Lanza, a 20-year-old who had Asperger’s syndrome, but no diagnosed mental illness, killed 20 children and six adults, not counting his mother and later himself, in Newtown, Connecticut, on December 14, 2012. 6 See Fillmore Buckner and Marvin Firestone, “‘Where the Public Peril Begins’: 25 Years After Tarasoff,” Journal of Legal Medicine 21, no. 2 (2000): 187-222. 7 It has been asserted that reporting Poddar’s threat to the campus police actually made matters worse because he stopped counseling. Buckner and Firestone, supra note 6, at 194. It is unclear whether additional counseling would have prevented the attack on Tanya, and a jury could well have determined that more effective steps to protect Tanya, including warning her of Poddar’s threats, would have prevented her murder. 8 Tarasoff v. Regents of Univ. of Cal., 108 Cal. Rptr. 878 (Cal. Ct. App. 1973). 9 Tarasoff v. Regents of Univ. of Cal., 529 P.2d 553 (Cal. 1974). 10 Buckner & Firestone, supra note 6, at 196. 11 Vanessa Merton, “’Dangerous‘ Patient: Implications of Tarasoff for Psychiatrists and Lawyers.” Emory Law Journal 31, no. 2 (1982): 263-343, 295. 12 Tarasoff v. Regents of Univ. of Cal., 551 P.2d 334 (Cal. 1976). 13 Id. at 345. 14 Id. at 346. 15 Id. at. 16 Id. at 347. 17 Id. 18 See Charles E. Cantu & Margaret H. Jones, “Bitter Medicine: A Critical Look at the Mental Health Care Provider’s Duty to Warn in Texas,” St. Mary’s Law Journal 31, no. 2 (2000): 359-403, 377-78. 19 The term physician-patient relationship is normally used to characterize an individual’s relationship with a medical doctor, and psychotherapists may be clinical psychologists, social workers, or individuals with other training. The nonphysician therapists commonly refer to the individuals they counsel as “clients.” For the sake of consistency, the term therapist-patient relationship is used in this article to apply to all psychotherapists and those they counsel. 20 See generally Peter F. Lake, “Revisiting Tarasoff,” Albany Law Review 58, no. 1 (1994): 97-173. 21 See, e.g., Bardoni v. Kim, 390 N.W.2d 218 (Mich. Ct. App. 1986); McIntosh v. Milano, 403 A.2d 500 (N.J. 1979); Wofford v. Eastern State Hosp., 795 P.2d 516 (Okla. 1990); Emerich v. Phila. Ctr. For Human Dev., Inc., 720 A.2d 1032 (Pa. 1998); Peck v. Counseling Serv., Inc., 499 A.2d 422 (Vt. 1985); Petersen v. State, 671 P.2d 230 (Wash. 1983). 22 Cal. Civ. Code § 43.92. 23 See National Conference of State Legislatures, Mental Health Professionals’ Duty to Warn, available at www.ncsl.org/issues-research/health/mental-health-professionals-duty-to-warn.aspx (last accessed August 17, 2013). 24 The 29 states with mandatory reporting laws: Alabama, Arizona (duties vary for different professions), California, Colorado, Delaware (duties vary for different professions), Idaho, Illinois (duties vary for different professions), Indiana, Iowa, Kentucky, Louisiana, Maryland, Massachusetts, Michigan, Missouri, Montana, Nebraska, New Hampshire, New Jersey, New York, Ohio, Pennsylvania, Tennessee, Utah, Vermont, Virginia, Washington, and Wisconsin. 25 The 16 states and the District of Columbia with permissive reporting laws: Alaska, Arkansas, Connecticut, District of Columbia, Florida, Hawaii, Kansas, Mississippi, New Mexico, Oklahoma, Oregon, Rhode Island, South Carolina, South Dakota, Texas, West Virginia, and Wyoming. 26 The four states with no duty to report: Maine, Nevada, North Carolina, and North Dakota. 27 The Georgia Code of Ethics of the State Board of Examiners of Psychologists, ch. 510-4-.02 § 4.05 allows discretionary disclosure of confidential information to protect the client, psychologist, or others from harm. Despite Georgia’s lack of statutory authority, it is important to note that Georgia case law has established that “where the course of treatment of a mental patient involves an exercise of ‘control’ over him by a physician who knows or should know that the patient is likely to cause bodily harm to others, an independent duty arises from that relationship and falls upon the physician to exercise that control with such reasonable care as to prevent harm to others at the hands of the patient.” Bradley Ctr., Inc. v. Wessner, 287 S.E.2d 716, 721 (Ga. Ct. App. 1982). 28 Arizona, Delaware, and Illinois. 29 For example, the Delaware law provides that mental health providers must warn against threats to clearly identified victims as well as clearly identified property. By contrast, Maryland law provides that mental health 9 providers only must warn against threats against specific victims or groups, but may do so regardless of whether the patient’s intent to harm was expressed in speech, conduct, or writing. 30 The states granting immunity if the mental health professional complies with certain statutory requirements are Alabama, Arizona, California, Colorado, Delaware, Louisiana, Maryland, Michigan, Minnesota, Nebraska, New Hampshire, Tennessee, Virginia, and Washington. 31 Tarasoff v. Regents of Univ. of Cal., 551 P.2d 334, 344 (Cal. 1976). 32 American Medical Association, Code of Medical Ethics § 5.05 (2010). 33 American Psychological Association, Ethical Principles of Psychologists and Code of Conduct § 4.05(b)(3) (2010). 34 American Psychiatric Association, Principles of Medical Ethics § 4, point 8 (2013). 35 Pub. L. No. 104-191, 110 Stat. 1936 (codified in scattered sections of 18, 26, 29, 42 U.S.C. (2012). 36 45 C.F.R. Parts 160, 164 (2013). 37 45 C.F.R. § 160.102 (2013). 38 45 C.F.R. § 164.512 (2013). 39 45 C.F.R. § 164.512(j) (2013). 40 Alaska, Arizona, Colorado, Connecticut, Delaware, District of Columbia, Florida, Idaho, Indiana, Maryland, New Jersey, New York, Ohio, Oklahoma, Oregon, Texas, Virginia, West Virginia, and Wyoming. 41 20 U.S.C. § 1232g (2008). 42 34 C.F.R. Part 99 (2012). 43 See, e.g., Office of the Governor of Virginia, Virginia Tech Review Panel: Mass Shootings at Virginia Tech, available at http://www.governor.virginia.gov/TempContent/techPanelReport.cfm (last accessed August 17, 2013). 44 34 C.F.R. § 99.36(a) (2013). 10