A school owes its minor students a duty to take reasonable measures to protect them against foreseeable harm from third parties. So, while the school cannot be held vicariously liable for an employee’s sexual abuse of a student (because sexual abuse is outside the course and scope of employment), the school may be held liable for negligent hiring, supervision, and retention of the offending employee. On the negligent hiring and retention claim, the plaintiff need not show that the school had actual knowledge of the employee’s propensity to commit sexual abuse–knew or should have known is the proper scienter standard. Here, plaintiffs alleged facts (such as 30 minute absences of 6-year-olds from class) which should have alerted the school to the possibility of wrongdoing and spurred an investigation. Plaintiffs also alleged a viable claim for negligence per se and violation of the Child Abuse and Neglect Reporting Act (Pen, Code 11164) based on the school’s failure to report its teachers’ observations that the abusive employee was repeatedly having the children sit on his lap and taking them to otherwise vacant rooms at the school.