This response is in a bit of a grey area, IMO.
Yes, the doctors' hands would be tied. Yes, the University would not really be able to investigate without a HIPAA release.
Then again, I don't think there is anything preventing the University from reporting the allegation to law enforcement officials who, IMO, would be the proper investigating agency anyhow. The police and prosecutors are exempt from HIPAA so long as the information requested falls within the scope of their investigation.
However, shouldn't the decision of reporting or not reporting be on the victim? Go back and read the threads about Jameis Winston and what was said about the girl involved in that case. Whether or not to go through with that is a big decision and maybe that's best left in the hands of the victim?
Much more complicated situation than appears at first blush, IMO.