18 USC 1028A — Aggravated Identity Theft in Health Care Fraud Cases

18 USC 1028A, aggravated identity theft, imposes a mandatory two-year prison term — added on top of, and served consecutively to, the sentence for an underlying felony — when a defendant knowingly uses, transfers, or possesses another person’s means of identification, without lawful authority, during and in relation to that felony. Health care fraud is one of the qualifying offenses. But in 2023, the Supreme Court’s decision in Dubin v. United States dramatically narrowed when this charge can be used in fraud cases, and that decision is now central to defending against it.

This page explains how 18 USC 1028A works, what the government must prove after Dubin, the mandatory penalty, the statutes it accompanies, and how the charge is defended. It is a plain-English legal reference for anyone facing an aggravated identity theft count alongside a health care fraud case in California. For how we defend these matters, see our federal health care fraud defense page.

Summary of the Statute

18 USC 1028A provides that whoever, during and in relation to certain enumerated felonies, knowingly transfers, possesses, or uses, without lawful authority, a means of identification of another person, shall be sentenced to an additional two years in prison. Health care fraud under 18 USC 1347 is among the qualifying predicate offenses, which is why this charge appears so often in health care cases.

Two features make this statute especially serious. First, the two-year term is mandatory — the court has no discretion to reduce it for a single count, no matter how sympathetic the defendant or how minor their role. Second, it must run consecutively, meaning it is stacked on top of whatever sentence the defendant receives for the underlying fraud rather than served at the same time. A defendant who might otherwise have received a short sentence, or even probation, faces a guaranteed additional two years behind bars.

For years, prosecutors took advantage of those features by adding 1028A counts to health care fraud indictments almost reflexively — whenever a patient’s name or Medicare number appeared on a fraudulent claim. Because the mandatory two years could be offered up or taken off the table in plea negotiations, the charge became a powerful lever to pressure defendants into pleading guilty. That practice is what the Supreme Court reined in.

How Dubin v. United States Changed the Landscape

In June 2023, in Dubin v. United States, a unanimous Supreme Court rejected the government’s expansive reading of the statute. The case itself arose from health care fraud: a defendant had overstated a patient’s qualifications on a Medicaid claim that also happened to include the patient’s reimbursement number. The government argued that because a patient’s identifying number appeared on the fraudulent bill, aggravated identity theft automatically applied — an interpretation that would have attached the mandatory two-year charge to virtually every health care fraud case involving a billed patient.

The Court disagreed, and decisively. It held that 18 USC 1028A is triggered only when the misuse of another person’s means of identification is “at the crux of what makes the conduct criminal” — not whenever an identity is incidentally used in the course of some other fraud. In the Court’s framing, the defendant’s use of the identity must be central to the criminality of the conduct, the thing that makes the fraud a fraud, rather than an ancillary detail. In a typical overbilling, upcoding, or medical-necessity case, the fraud is about the service or its price, and the patient’s identity is merely part of how any legitimate bill would be submitted. In those cases, after Dubin, 1028A should not apply at all.

This decision significantly curtailed the government’s ability to bolt the mandatory two-year charge onto ordinary health care fraud cases, and it has become one of the most important tools for defending against the charge.

What the Government Must Prove

After Dubin, to convict under 18 USC 1028A in a health care fraud case, the government must establish:

1. A qualifying predicate felony — such as health care fraud under 18 USC 1347.
2. Knowing use, transfer, or possession of a means of identification of another person, without lawful authority.
3. That the identity misuse was “at the crux” of the criminality — the identity theft must be central to the fraud, the heart of what makes the conduct illegal, not merely ancillary to it.

Notably, the government does not have to prove that the identification was stolen, or that it was used without the other person’s consent — even a patient who willingly provided their information can be the basis for the charge. But after Dubin, the “at the crux” requirement is the decisive question, and it is where many of these charges now fail. The defense’s task is to show that the case is really about the billing or the service, with patient identifiers used only as they would be in any ordinary claim.

The Mandatory Penalty

Because the two years are mandatory and consecutive, a 1028A count can meaningfully increase a sentence regardless of how the underlying fraud is resolved — it is, in effect, a floor that sits on top of everything else. This is precisely why defeating the charge, often on Dubin grounds, can be one of the most valuable outcomes in a health care fraud defense, sometimes mattering more to the ultimate sentence than the resolution of the fraud counts themselves.

Related Federal Statutes

• 18 USC 1347 (health care fraud) — the predicate offense most often paired with a 1028A count.
• 18 USC 1349 (conspiracy and attempt) — frequently charged together in multi-defendant cases.
• 18 USC 1035 (false statements) — another companion count in fraudulent-submission cases.

How 18 USC 1028A Charges Are Defended

Since Dubin, the leading defense is that the alleged identity misuse was not “at the crux” of the crime — that the case is really about billing fraud, medical-necessity disputes, or upcoding, with patient identifiers used only as any legitimate claim would use them. Where the identity is incidental to the fraud rather than central to it, the charge should not stand, and a well-framed motion can lead the government to drop the count or a court to dismiss it.

Other defenses challenge whether the defendant acted knowingly, whether the information at issue even qualifies as a “means of identification” under the statute, and whether the defendant lacked lawful authority to use it. Because the charge carries a mandatory penalty that can dominate the sentence, attacking it directly — and early — is often a priority from the very start of the case. For a deeper look at how identity-related counts get added to fraud cases, see our discussion of billing for services not rendered. The right approach depends on exactly how the government says identities were used.

Facing an Aggravated Identity Theft Count? Contact Us

An 18 USC 1028A count adds a mandatory two years — but recent Supreme Court law means it cannot simply be attached to every health care fraud case, and whether that charge belongs in your case at all is a question worth fighting hard. KN Law Firm, APLC defends these matters in the U.S. District Court for the Central District of California and before the Ninth Circuit. Call (888) 950-0011 for a free, confidential consultation with attorney Chris Nalchadjian, available 24/7 in English and Spanish.