The state department has completed its years-long internal investigation into Hillary Clinton’s use of private email and found “no persuasive evidence of systemic, deliberate mishandling of classified information”.

The investigation, launched more than three years ago, did find violations by 38 people, some of whom may face disciplinary action.

Investigators determined that those 38 people were “culpable” in 91 cases of sending classified information that ended up in Clinton’s personal email, according to a letter sent to Republican senator Chuck Grassley this week and released on Friday. The 38 are current and former state department officials but were not identified.

While there were no findings of deliberate mishandling of classified information, the report made clear that Clinton’s use of the private email while serving as the secretary of state in the Obama administration had increased the vulnerability of classified information.

The Associated Press sent an email seeking comment to a Clinton representative.

The investigation covered 33,000 emails that Clinton turned over for review after her use of the private email account became public. The department said it found a total of 588 violations involving information then or now deemed to be classified but could not assign fault in 497 cases.

For current and former officials, culpability means the violations will be noted in their files and will be considered when they apply for or go to renew security clearances. For current officials, there could also be some kind of disciplinary action. But it was not immediately clear what that would be.

The report concluded “that the use of a private email system to conduct official business added an increased degree of risk of compromise as a private system lacks the network monitoring and intrusion detection capabilities of state department networks”.

The department began the review in 2016 after declaring 22 emails from Clinton’s private server to be “top secret”. Clinton was then running for president against Donald Trump, and Trump made the server a major focus of his campaign.

James Comey, the then-FBI director, held a news conference that year in which he criticized Clinton as “extremely careless” in her use of the private email server as secretary of state but said the FBI would not recommend charges.

The justice department’s inspector general said FBI specialists did not find evidence that the server had been hacked, with one forensics agent saying he felt “fairly confident that there wasn’t an intrusion”.

Grassley started investigating Clinton’s email server in 2017, when he was the chair of the Senate judiciary committee. The Iowa Republican has been critical of Clinton’s handling of classified information and urged administrative sanctions.

Clinton has frequently lampooned the Republicans’ ongoing obsession with her email controversy (“lock her up” is still a popular chant at Trump rallies). An exhibit at the Venice Biennale in September saw her sitting behind a replica of the Oval Office’s Resolute Desk and reading from the 62,000 pages of emails.