18 USC 1028A — Aggravated Identity Theft in Health Care Fraud Cases

18 USC 1028A, aggravated identity theft, imposes a mandatory two-year prison term — added on top of, and served consecutively to, the sentence for an underlying felony — when a defendant knowingly uses, transfers, or possesses another person’s means of identification, without lawful authority, during and in relation to that felony. Health care fraud is one of the qualifying offenses. But in 2023, the Supreme Court’s decision in Dubin v. United States dramatically narrowed when this charge can be used in fraud cases.

This page explains how 18 USC 1028A works, what the government must prove after Dubin, the mandatory penalty, and how the charge is defended. It is a plain-English legal reference for anyone facing an aggravated identity theft count alongside a health care fraud case in California. For how we defend these matters, see our federal health care fraud defense page.

Summary of the Statute

18 USC 1028A provides that whoever, during and in relation to certain enumerated felonies, knowingly transfers, possesses, or uses, without lawful authority, a means of identification of another person, shall be sentenced to an additional two years in prison. Health care fraud under 18 USC 1347 is among the qualifying predicate offenses.

Two features make this statute especially serious. First, the two-year term is mandatory — the court has no discretion to reduce it. Second, it must run consecutively, meaning it is stacked on top of whatever sentence the defendant receives for the underlying fraud rather than served at the same time. For years, prosecutors added 1028A counts to health care fraud indictments whenever a patient’s name or Medicare number appeared on a fraudulent claim, using the mandatory two years as powerful leverage to encourage guilty pleas.

How Dubin v. United States Changed the Landscape

That broad use came to an end in June 2023. In Dubin v. United States, a unanimous Supreme Court rejected the government’s expansive reading of the statute. The case itself arose from health care fraud: a defendant had overstated a provider’s qualifications on a Medicaid claim that also happened to include the patient’s reimbursement number. The government argued that because a patient’s identifying number appeared on the fraudulent bill, aggravated identity theft automatically applied.

The Court disagreed. It held that 18 USC 1028A is triggered only when the misuse of another person’s means of identification is “at the crux of what makes the conduct criminal” — not whenever an identity is incidentally used in the course of some other fraud. In a typical overbilling or upcoding case, the fraud is about the service or its price, not about impersonating the patient, so 1028A should not apply. This decision significantly curtailed the government’s ability to bolt the mandatory two-year charge onto ordinary health care fraud cases.

What the Government Must Prove

After Dubin, to convict under 18 USC 1028A in a health care fraud case the government must establish:

1. A qualifying predicate felony — such as health care fraud under 18 USC 1347.
2. Knowing use, transfer, or possession of a means of identification of another person, without lawful authority.
3. That the identity misuse was “at the crux” of the criminality — the identity theft must be central to the fraud, not merely ancillary to it.

The government need not prove that the identification was stolen, or that it was used without the other person’s consent. But after Dubin, the “at the crux” requirement is where many of these charges now fail — and it is the focus of the defense.

The Mandatory Penalty

Because the two years are mandatory and consecutive, a 1028A count can meaningfully increase a sentence regardless of how the underlying fraud is resolved. This is precisely why defeating the charge — often on Dubin grounds — can be one of the most valuable outcomes in a health care fraud defense.

Related Federal Statutes

• 18 USC 1347 (health care fraud) — the predicate offense most often paired with a 1028A count.
• 18 USC 1349 (conspiracy and attempt) — frequently charged together in multi-defendant cases.
• 18 USC 1035 (false statements) — another companion count in fraudulent-submission cases.

How 18 USC 1028A Charges Are Defended

Since Dubin, the leading defense is that the alleged identity misuse was not “at the crux” of the crime — that the case is really about billing or medical-necessity fraud, with patient identifiers used only incidentally. Other defenses challenge whether the defendant acted knowingly, whether the information qualifies as a “means of identification,” and whether the defendant had lawful authority to use it. Because the charge carries a mandatory penalty, attacking it directly is often a priority from the outset of the case.

For a deeper look at how identity-related counts are added to fraud cases, see our discussion of billing for services not rendered. The right approach depends on exactly how the government says identities were used.

Facing an Aggravated Identity Theft Count? Contact Us

An 18 USC 1028A count adds a mandatory two years — but recent Supreme Court law means it cannot simply be attached to every health care fraud case. Whether that charge belongs in your case at all is a question worth fighting. KN Law Firm, APLC defends these matters in the U.S. District Court for the Central District of California and before the Ninth Circuit. Call (888) 950-0011 for a free, confidential consultation with attorney Chris Nalchadjian.