An Oklahoma State University spokesman said administrators declined to notify police about allegations that a fraternity member had sexually assaulted nearly a dozen new members because it believed the alleged perpetrator was protected under the Family Educational Rights and Protection Act, Oklahoma’s News On 6 reported. The university waited nearly three weeks to go to police, handling the allegations through its own disciplinary procedures at first. FERPA, which explicitly states that the rule should not prevent institutions from approaching police with personally identifiable information about a possible crime, prohibits colleges from releasing identifying information in students’ private educational records. Further, as Frank LoMonte, executive director of the Student Press Law Center, pointed out on the FERPA Fact blog, universities are required under the Clery Act to issue timely warnings to campus whenever criminal behavior “represents a threat” to people there. Oklahoma State said it found a male student responsible for four sexual misconduct violations; the student has been suspended for three years. Local police are investigating the case.