For the United States, it’s not even just some risk of future harm. The standard is much stricter, it’s if “a provider determines that there is a serious and imminent threat of a patient physically harming self or others.” Has to be something very specific and imminent for confidentiality to be breached.
There are a few more edge cases though, for instance doctors and other healthcare workers are usually mandatory reporters by law, so if they suspect child abuse they are legally obligated to report it. Another one is for infectious disease tracking and reporting, there may also be confidentiality exceptions.