More than four months have passed since the Virginia Tech tragedy, and the state of Virginia and university officials have released their findings on the April 16 massacre. From their reports, briefly summarized below, other campuses can glean valuable information that they hopefully will be able to apply to their own communities.

Cho Slipped Through the Cracks

Seung Hui Cho, the mentally deranged student responsible for the attack that left 32 students and faculty dead, and 17 others injured, had a social anxiety disorder. Selective mutism, a symptom of his disorder, hindered him from speaking in social settings. While attending middle school and high school, he received individualized special education and therapy — which was said to have been effective — for his underlying anxiety.

According to Virginia Gov. Tim Kaine, however, Virginia Tech officials were not told of Cho's illness. "Despite serious concerns about whether he would be able to continue to succeed at Virginia Tech, the university never received any information about his challenges and the strategies that had enabled him to succeed up to that point in his life," the governor said in a statement. When Cho began attending college, he no longer received any support for coping with his condition.

The Virginia Tech Review Panel, which was commissioned by Kaine, says that during Cho's junior year at Virginia Tech, several incidents occurred that were clear warnings of his instability. The school did not intervene effectively despite various persons and departments knowing of these incidents.

Officials from judicial affairs, the counseling center, campus police and the dean of students did not communicate with each other about their concerns because they believed such communications were prohibited by law. According to the Kaine report, however, "federal laws and their state counterparts afford ample leeway to share information in potentially dangerous situations." The report did acknowledge that Virginia's mental health laws are flawed and that there is widespread confusion about what federal and state privacy laws allow. How to apply the Health Insurance Portability and Accountability Act (HIPAA) in educational settings is also a challenge and "not entirely compatible with those governing other health records."

The report goes on to state that resources for helping at-risk individuals are inadequate, leading to gaps in mental health services.

Virginia Tech's own internal reviews recommended an increase in the number of case workers capable of identifying and handling students with mental health issues, and a threat assessment team be created to evaluate complex at-risk student cases. Case management capacity should be expanded so the dean's office and the counseling center can improve their follow-up with students and improve the flow of information. Additionally, the university should provide education to staff on privacy laws and clarify communications policies pertaining to external agencies.

Mass Notification Procedures 'Cumbersome'

Another issue receiving significant public attention is the timeliness and way Virginia Tech notified campus constituents after the initial dorm shootings. It took administrators more than two hours to send out an E-mail warning students and staff about the threat. According to the Kaine report, "the protocol for sending an emergency message in use on April 16 was cumbersome, untimely and problematic when a decision was needed as soon as possible." It also faulted Virginia Tech's police department for assuming its initial lead in the dorm shooting was good. "They did not take sufficient action to deal with what might happen if the initial lead proved erroneous," the report concluded.

The report says universities must comply with the Clery Act, which requires timely public warnings of imminent threats. It also recommends that campus emergency communications systems have multiple means of sharing information and that during an emergency, immediate messages be sent to the community that provide clear information on the nature of the emergency and the actions to be taken. It was also recommended that the head of campus police or security be a member of a threat assessment team as well as the emergency response team. Campus police should also report directly to the senior operations officer responsible for emergency decisions making.

Virginia Tech's internal reviews said enhancements should be made to the emergency alert system. (This change has been implemented since the tragedy. The new mass notification system enables the school to contact staff and students via text messages, cell phones, E-mail and online instant messages.) Additionally, message boards in classrooms and hallways should be installed to alert students during emergencies.

Despite all of these recommendations, the Kaine report indicates that the experts it interviewed urged the state not to impose required levels of security on all institutions. Rather, schools should be allowed to choose the solutions that are most appropriate for their communities.

Campus Lockdown Not Feasible

Immediately after the Virginia Tech tragedy, many in the public expressed concerns that the entire campus wasn't locked down immediately after the dorm shooting. The Kaine report, however, indicates this would have been very difficult to achieve. "The size of the police force and absence of a guard force, the lack of electronic controls on doors of most buildings other than residence halls, and the many unguarded roadways pose special problems for a large rural or suburban university," the report says.

The report goes on to claim that it would haven taken 400-500 security officers to lock all of the doors and close down the campus. At 8 a.m. on a normal school day, only 14 of Virginia Tech's 41 officers were on duty. It would be more feasible to cancel classes and ask everyone to stay home, although getting that message to everyone would have been difficult considering the type of technology in use at that time.

Considering that Cho was a member of the campus community with an access card to his dorm and able to receive emergency messages, it is highly doubtful the tragedy could have been avoided completely. "From what we know of his mental state and commitment to action that day, it was likely that he would have acted out his fantasy somewhere on campus or outside it that same day," the report says.

Recommendations Are Wide Ranging

Some of the other recommendations of both the state and internal reviews include:

• Virginia Tech's emergency response plan should be in compliance with federal and state guidelines, and include provisions for a shooting scenario. It should also place police high in the emergency decision-making hierarchy

• Threat assessments should be conducted, and the teams should include law enforcement, human resources, students and academic affairs

• Virginia Tech campus police and fire departments should be located in one building so operations can be centralized

• The door hardware should be replaced so doors cannot be chained, preventing police from entering a premises. (This change has already been implemented at Virginia Tech.)

• A "people locator system" should be created so campus constituents can inform others of their status and whereabouts

• Locks inside the classrooms should be added so students and faculty in classrooms can shut the doors, preventing shooters from entering (it should be noted that this item is being debated)

• Virginia Tech officials should evaluate a centrally controlled electronic card access system for academic and administrative facilities

• University officials should review the potential effectiveness of a centrally monitored video surveillance system

• Virginia Tech should conduct more emergency drills, including those involving active shooter scenarios

• Emergency responder radio communication interoperability issues were experienced during the crisis, and radios did not work in some areas of Norris Hall. In light of the interoperability issues, the school's Information and Communication Infrastructure group recommended a new fully integrated digital campus architecture for all telecommunications functions based on Internet protocol be installed

• Selected research and administrative IT capabilities should be available to local first responders to improve radio interoperability

• The university should train administrators, faculty and staff on violence prevention

• Virginia's own HIPAA-type statutes should be amended to provide a safe harbor provision to protect health providers from liability or loss of funding when they disclose information relating to evaluations and commitment hearings

• The Family Education Rights and Privacy Act (FERPA) should be amended so it is clear how it applies to medical records. An exception regarding treatment records is another recommended revision

It should also be noted that the report acknowledges many things that were done properly by Virginia Tech, including the fact that campus officials have excellent working relationships with the regional offices of the state police, FBI and ATF. Additionally, Virginia Tech's campus police and the Blacksburg Police Department were well-trained and had conducted exercises together, including active shooter training. Without these and other attributes, undoubtedly the Virginia Tech tragedy could have been much worse.

The official report commissioned by Gov. Kaine can be found online at http://www.governor.virginia.gov/TempContent/techPanelReport.cfm .

Virginia Tech's internal reviews can be found online at:

• https://news.vt.edu/content/dam/news_vt_edu/documents/2007-08-22_security_infrastructure.pdf

• https://news.vt.edu/content/dam/news_vt_edu/documents/2007-08-22_communications_infrastructure.pdf

• https://news.vt.edu/content/dam/news_vt_edu/documents/2007-08-22_internal_communications.pdf