RICHMOND, Va. - Virginia Tech could be fined as much as $55,000 because it broke the law by waiting too long to notify students during a 2007 shooting rampage, according to a federal report issued Thursday.

The U.S Department of Education had found in January that the school violated federal law with its response during the deadliest mass shooting in modern U.S. history, but gave Tech a chance to respond to the finding in its preliminary report. In Thursday's final report, federal officials rejected Tech's arguments that it met standards in place at the time.

"While Virginia Tech failed to adequately warn students that day, we recognize that the university has put far-reaching changes in place since that time to help improve campus safety and better protect its students and community," U.S. Department of Education Secretary Arne Duncan said.

School officials won't face criminal charges for breaking the law, the department said.

The university disputed the findings, and spokesman Larry Hincker said the school likely will appeal if it is punished.

The school could be fined up to $55,000 and could face the loss of federal student financial aid.

However, an expert on the law that requires notification of danger - known as the Clery Act - said loss of federal aid is unlikely.

S. Daniel Carter, director of public policy for Security On Campus, said Clery Act reviews are relatively rare: The Tech review was the 35th in 20 years. No school has ever lost federal funding, and the largest fine was $350,000, levied against Eastern Michigan University for failing to report the killing of a student in a dormitory in 2006.

The department found that the university violated the Clery Act because it failed to issue a timely warning after a gunman killed two students in a dorm early on April 16, 2007. The school sent out an e-mail about the shootings about two hours later, but by that time student gunman Seung-Hui Cho was chaining shut the doors to a classroom building where he killed 30 students and faculty, then himself.

Tech argues that the department didn't define "timely" until 2009, when it added regulations to require immediate notification upon confirmation of a dangerous situation or immediate threat to people on campus.