
582 F.3d 781 (2009)
UNITED STATES of America, Plaintiff-Appellee,
v.
Varnador SUTTON, Defendant-Appellant.
No. 08-3370.
United States Court of Appeals, Seventh Circuit.
Argued May 29, 2009.
Decided September 28, 2009.
*782 Winfield D. Ong, Attorney (argued), Office of the United States Attorney, Indianapolis, IN, for Plaintiff-Appellee.
Juval O. Scott, Attorney (argued), Indiana Federal Community Defenders, Inc., Indianapolis, IN, for Defendant-Appellant.
Before RIPPLE, ROVNER, and SYKES, Circuit Judges.
ROVNER, Circuit Judge.
A jury convicted Varnador Sutton of a single count of violating 18 U.S.C. § 1347 (prohibiting health care fraud) for his role in perpetrating a fraudulent scheme to collect money from Indiana Medicaid. The district court sentenced Sutton to the statutory maximum of ten years' imprisonment to be followed by two years of supervised release. Sutton appeals, challenging the district court's calculation of his sentence.

I.
In May 2005, Sutton created a business called Regenerations, Inc., which purported to provide psychological counseling services reimbursable by Indiana Medicaid. Over the course of the next two years, Sutton billed Medicaid over $9 million for alleged psychological counseling that was never provided. Although many of the claims were denied, Medicaid did pay Sutton approximately $3.2 million for the alleged services provided by Regenerations. Sutton used his millions to buy, among other things, seven properties, several new cars, and $33,000 worth of apparel from Vincent's Furs and Leathers.
Sutton's scheme was relatively straightforward. He created Regenerations, Inc., and enrolled the company as a Medicaid provider in Indianapolis, Indiana. Sutton identified himself on the application as the owner, CEO, and President of Regenerations. By enrolling in the Indiana Medicaid program, Sutton set himself up to be automatically reimbursed for providing eligible services to Medicaid recipients. The enrollment application listed one individual qualified to oversee the counseling servicesDr. Ruth Haggerty, a PhD in clinical psychology. Dr. Haggerty's signature appeared on the application, but she testified at trial that she neither signed the application nor authorized anyone to do so on her behalf.[1]
Despite a nonexistent staff of therapists, on paper Regenerations, Inc. ran an exceedingly brisk counseling business. For instance, in January 2006 alone, Regenerations billed Medicaid for 4749 individual psychotherapy sessions, a figure that would require a staff of twenty-nine therapists to work six days a week, eight hours per day. Although the numbers varied slightly from month-to-month, the general pattern was the same: all twenty counseling sessions allowed under Medicaid in a twelve month period without preauthorization would be exhausted, and when a new twelve-month period began all twenty sessions would again be exhausted. Sutton billed Medicaid for over 84,000 counseling sessions using the Medicaid identification numbers of over 2500 individual Medicaid *783 recipients, unbeknownst to those individuals whose numbers he used.
Eventually this suspicious pattern raised red flags, and an audit was scheduled. In April 2007, a Medicaid auditor called Sutton and arranged to meet him later that month for an audit of Regenerations at its listed place of business in Indianapolis. That very same day, Sutton terminated his Medicaid provider status and closed the bank account where he had been receiving the Medicaid reimbursements via direct deposit. Not surprisingly, when the auditor arrived at the scheduled date and time later that same month, neither Sutton nor his business were anywhere to be found.
Despite its diligent efforts, the government was unable to locate any records to support the 84,000 claims for counseling that Sutton submitted to Medicaid. At trial, the jury heard testimony from ten individuals, selected essentially at random, whose Medicaid numbers had been used by Sutton to bill for counseling services. None of the individuals had received counseling services through Regenerations, nor had they ever heard of Sutton or Dr. Haggerty. The Medicaid numbers for nine of the ten who testified had been used as described above. Twenty counseling sessionsthe maximum allowed in a twelve-month periodhad been billed in just one month, a pattern that was repeated as soon as the first twelve-month period had passed and another twenty sessions could be billed without preauthorization.
Sutton testified at trial on his own behalf. He explained that although he received all of the money in his own accounts, he had contracted out the operation of the business to a woman named Paula Morton. Sutton claimed that he authorized Morton to use his Medicaid number to bill for the counseling services, and that he intended to pay Morton a share of the money when she provided him with records to substantiate the counseling sessions. According to Sutton, Morton never provided him with any records, and so he never bothered to pay her; nor did he ever bother to question the receipt of over $3 million in his personal accounts. At the time of trial, Sutton denied having any idea where Morton was or how she could be contacted.
The jury convicted Sutton on the single count of health care fraud, see 18 U.S.C. § 1347, contained in the indictment. At sentencing, the district court increased Sutton's base offense level of six, see U.S.S.G. § 2B1.1(a)(2), by twenty levels because the total intended loss exceeded $7 million, see U.S.S.G. § 2B1.1(b)(1)(K), and added another six levels based on its conclusion that there were more than 250 victims, see U.S.S.G. § 2B1.1(b)(2)(C). On this point the court accepted the government's argument that each individual whose Medicaid number had been fraudulently used by Sutton should be counted as a victim under the guidelines. The court also concluded that Sutton testified falsely and added two levels for obstruction of justice. See U.S.S.G. § 3C1.1. Although the resulting adjusted offense level of thirty-four combined with Sutton's criminal history of I resulted in a guideline range of 151 to 188 months, the statutory maximum under § 1347 is 120 months. The district court sentenced Sutton to the statutory maximum.

II.
On appeal, Sutton maintains that the district court erred in its loss calculation under U.S.S.G. § 2B1.1(b)(1)(K) and also erred by concluding that his offense had more than 250 victims under U.S.S.G. § 2B1.1(b)(2)(C). We review the district court's interpretation and application of the guidelines de novo and its findings of *784 fact for clear error. E.g., United States v. Hill, 563 F.3d 572, 577 (7th Cir.2009).
Sutton claims that the government failed to adequately prove the amount of loss. The government maintained in the district court that because Sutton's entire business was a fraud, he should be accountable for the full $9 million he billed to Medicaid. Sutton argues that such a loss calculation is unreliable because the government failed to review all of the claims and prove that they were fraudulent. He also claims that some "legitimate services" were performed, and thus the district court erred by treating the entire amount as fraudulent. We review the district court's loss calculation, which need only be "a reasonable estimate of the loss," U.S.S.G. § 2B1.1 cmt. 3(C), for clear error. See, e.g., United States v. Watts, 535 F.3d 650, 658 (7th Cir.2008).
The district court's conclusion that Sutton bore responsibility for the entire $9 million is not clearly erroneous. Sutton suggests that the loss calculation should be based only on those services that the government individually "verified" as fraudulenta number that he estimates at 400 of the 84,000 claims. Such an approach would yield a loss of either $32,000 (the amount Regenerations actually received for those 400 claims) or $42,700 (the amount Regenerations billed for those 400 claims). But Sutton's argument ignores the compelling evidence presented at trial that Regenerations' entire existence was fraudulent. Despite fairly exhaustive efforts to uncover any records or patients associated with the claims, the government came up empty-handed. All of the enrollment documents filed with Medicaid list Sutton as the only owner or manager of Regenerations. Sutton received all of the money himself. The only individual listed to supervise counseling services was Dr. Ruth Haggerty, and she testified that she had never overseen such services and that she had not signed the enrollment form. Finally, the implausibility of the claims Sutton submitted buttresses the district court's conclusion. For example, from November 2005 through January 2006 alone, Sutton billed for over 11,000 individual counseling services per month. It strains reason to believe that a business with no business records, no physical location, and no employees provided services that could not be completed without an entire staff of therapists consistently working eight hours a day for six days a week.
Nor are we persuaded by Sutton's claim that Regenerations provided some legitimate services. Sutton claims in his brief that the evidence at trial established that "some services were provided by Darren Green under the supervision [of] Dr. Ruth Haggerty," and that the loss calculation should be offset by these legitimate services. But the services Sutton refers to were provided in conjunction with an entirely different business. Darren Green provided "coping skills" for between ten and twelve individuals and Sutton received $34,000 from Medicaid as a result, but this business was unrelated to his fraud through Regenerations. Moreover, deducting that $34,000 would leave Sutton with a total loss calculation of just under $9 million, still well over the $7 million needed to trigger the 20-level adjustment under § 2B1.1(b)(1)(K). Given the convincing evidence that all of the claims billed were fraudulent, the $9 million loss calculation was not "outside the realm of permissible computations." United States v. Wheeler, 540 F.3d 683, 694 (7th Cir. 2008) (quoting United States v. Radziszewski, 474 F.3d 480, 486 (7th Cir.2007)).
Sutton also argues in passing that even assuming all of the claims were fraudulent, the loss calculation should be 25% lower. Sutton points out that although he billed Medicaid $2135 per twenty counseling sessions, *785 Medicaid never paid more than $1600 for the claimsa 25% reduction from the amount he billed. This argument goes nowhere. There is nothing in the record to suggest that Sutton did not hope to recover the full amount that he billed. The fact that Medicaid denied some claims or that he overbilled for the "services" provided sheds no light on his intention to bilk Medicaid for the full amounts billed. See United States v. Mikos, 539 F.3d 706, 714 (7th Cir.2008) (Whether Medicaid paid all (or any) of claims billed by defendant irrelevant to loss calculation under § 2B1.1 "because that section deals with intended loss") (emphasis in original).
That leaves Sutton's challenge to the upward adjustment based on the number of victims. At sentencing, the government argued that Sutton's crime had over 250 victims. It reached this figure by treating all of the 2000-plus individuals whose Medicaid numbers had been used by Sutton as victims of his fraud. Sutton maintained, however, that the only victims were the two entities that sustained monetary lossIndiana Medicaid and the Centers for Medicare and Medicaid Services. As relevant here, the application note to § 2B1.1(b)(2)(C) defines a "victim" as "any person who sustained any part of the actual loss determined under subsection (b)(1)." U.S.S.G. § 2B1.1 cmt. n. 1. Subsection (b)(1), in turn, refers exclusively to the monetary loss occasioned by the crime, and the relevant application notes explain that the actual loss must be "pecuniary harm ... that is monetary or that otherwise is readily measurable in money." Id. at cmt. n. 3(A)(i), (iii).
Given this, Sutton insists that those individuals whose Medicaid numbers were used to bill for counseling services were not "victims" under § 2B1.1. Although he used their Medicaid numbers to dupe Indiana Medicaid and the Centers for Medicare and Medicare Services into paying for services that were never rendered, none of the individuals actually paid for a service they did not receive. Instead, Sutton simply appropriated their Medicaid numbers in order to bill Indiana Medicaid for services that were never rendered. Indeed, until the government began investigating the fraud, presumably the victims had no reason to know that their Medicaid numbers had been used.
The government insists that the six-level adjustment should apply because the Medicaid recipients suffered "real, tangible harm" in that their benefits were exhausted and their identities were stolen. But it is not immediately apparent how either of these harms translates to the monetary harm clearly required under § 2B1.1. The application note further clarifies that pecuniary harm "does not include emotional distress, harm to reputation, or other non-economic harm." U.S.S.G. § 2B1.1 cmt. n. 3(A)(iii) (emphasis added). At oral argument, counsel for the government conceded that the government never identified a single victim who had attempted to use her benefits and been denied. Government counsel also acknowledged that a system had been put in place to allow those individuals whose Medicaid numbers had been used by Sutton to go through a process that would waive the limits on their benefits so that Sutton's exhaustion of their benefits would not affect their eligibility for services. Thus, so far as the government's evidence shows, the inchoate harm of having their benefits wrongfully depleted never materialized into an actual monetary loss such as having to pay for benefits that would otherwise have been covered. Given the government's failure to demonstrate that any of the individuals suffered pecuniary harm, we are hard-pressed to see why we should treat all of those individuals as victims under § 2B1.1.
*786 The case cited by the government, United States v. Curran, 525 F.3d 74 (1st Cir. 2008), does not convince us otherwise. The defendant in Curran falsely presented himself as a medical doctor and then proceeded to diagnose patients with alarming illnesses that required expensive (and bogus) "cures." Curran, 525 F.3d at 77-78. The government contends that in treating all of the defendant's patients as victims, the First Circuit relied heavily on the fact that the defendant's charges for the tests and medications were "inextricably linked to his misrepresentations, malpractice, and fear-mongering." Id. at 81. It argues that by the same token, the funds Sutton received from the Medicaid programs were inextricably linked to the victimization of those individuals whose Medicaid numbers he used. But the analogy is unhelpful, because in Curran the victims paid for the bogus tests and medications, and therefore suffered precisely the sort of pecuniary harm envisioned under § 2B1.1. Because the guidelines are clear that monetary loss (or the intent of such loss) is required, and no such loss was suffered by the 2000-plus individuals whose identities were used by Sutton to perpetuate his fraud, the district court erred by imposing the six-level adjustment. Because there were in fact only two victimsIndiana Medicaid and Centers for Medicare and Medicaid Services no additional upward victim adjustment was warranted. See U.S.S.G. § 2B1.1(b)(2); United States v. Icaza, 492 F.3d 967, 969-70 (8th Cir.2007) (district court erred by treating many individual Walgreens stores as victims when all pecuniary harm could be traced to single parent corporation).
Finally, the government claims for the first time on appeal that if the six-level increase for the number of victims is inapplicable, Sutton's guidelines calculation should nonetheless be increased by two under U.S.S.G. § 2B1.1(b)(10), which applies when the offense involves the "possession or use of an authentication feature." That two-level increase would put Sutton's adjusted guideline range at twenty-eight to thirty, a range that would include the 120-month statutory maximum the district court imposed. But the government neither advocated imposing that adjustment in the district court nor cross-appealed on that issue. Thus, it has waived the argument that § 2B1.1(b)(10) applies. See United States v. Wilson, 131 F.3d 1250, 1253 (7th Cir.1997). Nor are we convinced from the record that a remand is unnecessary because the district court would have sentenced Sutton to the statutory maximum regardless of the advisory guidelines range. Although the district court intimated that Sutton's crime warranted the statutory maximum, it did so in the context of the higher guideline range (which exceeded the statutory maximum). The district court may still conclude that the § 3553(a) factors support sentencing Sutton to the statutory maximum (which would be outside the properly calculated range of seventy-eight to ninety-seven months), but such a determination should be made only after the district court properly calculates the guideline range. See United States v. Willis, 523 F.3d 762, 770 (7th Cir.2008) (noting that district court "must first properly calculate the advisory Guidelines range" before exercising its "substantial discretion" to choose a reasonable sentence).

III.
For the foregoing reasons, we AFFIRM Sutton's conviction, but VACATE his sentence and REMAND for resentencing.
NOTES
[1]  Dr. Haggerty did work with Sutton in an unrelated capacity for a Medicaid "waiver" program providing behavior management services for individuals who would otherwise be ineligible for Medicaid.
