COLUMBIA, S.C. (AP) – A federal report says South Carolina’s Medicaid agency exposed roughly 1 million residents’ personal health information to risk of cyber theft because of poor safeguards and a four-decade-old computer system.

The U.S. Department of Health and Human Services’ findings released Friday include that the agency had no security plan for its computer system, had no encryption for laptops and had not properly trained employees. It notes inspectors found no evidence that any hacking of Medicaid data had occurred.

Medicaid agency Director Christian Soura agrees with the report’s recommendations based on its 2013 evaluation. He says the agency has already taken action on all of the findings.

Soura says the state is in the process of replacing its aged computer system for paying Medicaid providers.