This is absolutely correct. Make a police report NOW. The school is negligent for not calling the police and making a report as soon as they were notified that your son was injured.
I teach kids your son's age. There are violent kids who do this kind of thing every single day and they get away with it because usually parents don't take it seriously. You son was assaulted and injured. The boy who did this will do it over and over and hurt other kids until he gets older and starts beating his girlfriend instead.
It is a sure bet that his parents will whine and holler and threaten to sue the school if their son is held responsible for his actions. They will probably even try to blame this on your son. That is probably why the school did not call police in the first place. Vice principals get tired of the fits thrown by parents of violent bullies, sometimes they avoid dealing with it properly. They have a very stressful job and you could not pay me enough to do it!
You are going to have to be the one to put a stop to this. Ignore anyone who tries to tell you that the kid was "just joking around" or "didn't mean to hurt him". That is a lie that violent people use to avoid taking responsibility for their actions. Don't be fooled. Teach your son the right way to deal with violent people...no need to cower behind a locker or retaliate, just report this assault to the police and press charges. You will be doing the bully a favor. He needs to know that he is not above the law and must suffer the consequences of assault without provocation and assault with bodily injury.
Document everything. Notify the school but deal with the police. Bullies are not deterred one bit by any kind of "punishment " that the school can dish out. They are used to being in "on campus suspension", lunch detention and the principal's office. That is all that the school can do; it's nothing more than a brief time out. Those things have no effect at all on kids who are bullies.
All of this is just MOO!