In 1999, Petitioner Daniel Rubin was convicted in New York Supreme Court, Albany County, of one count of second-degree grand larceny and eight counts of first-degree offering a false instrument for filing, based on evidence that he and his home health care agency knowingly overcharged New York State for Medicaid reimbursements. Now, some nine years later, we are faced with Rubin’s appeal from a decision of the United States District Court for the Northern District of New York (Mordue, Chief Judge) insofar as it denied his petition for habeas corpus as to seven of the nine counts of conviction. He argues that his conviction should be overturned because a regulation underlying both the grand larceny and false instrument counts, the so-called “public charge” regulation, N.Y. Comp.Codes R. & Regs, tit. 18, § 505.14(h)(7)(ii)(a)(l), is unconstitutionally vague. Because we disagree, as explained below, the judgment of the district court is affirmed.
I. BACKGROUND 1
A. Parties and Applicable Regulations Rubin was the founder and president of Allstate Home Care, Inc. (“Allstate”), a provider of home health care services with three offices and about 200 employees in Dutchess County, New York. Medicaid paid for services for the majority of Allstate’s clients.
Medicaid, a program that finances health care for the poor, is jointly funded by the state and federal governments but run by the states individually.
See Conn. Dep’t of Soc. Servs. v. Leavitt,
New York State has promulgated detailed regulations that govern Medicaid. One such regulation, concerning payment rates for providers of personal care services that have cost experience (such as Allstate), states:
(h) Payment.
(7) This paragraph sets forth the methodology by which the department will determine MA [medical assistance] payment rates for personal care services providers that have contracts with social services districts for any rate year that begins on or after January 1,1994.
(ii) Determination of payment rate.
(a) Providers with cost experience.
(2 ) Medical assistance payments to personal care services providers for any rate year beginning on or after January 1, 1994, are made at the lower of the following rates:
(i) the rate the provider charges the general public for personal care services; or
(ii) the rate determined by the department in accordance with [a method that accounts for the provider’s costs].
N.Y. Comp.Codes R. & Regs. tit. 18, § 505.14(h)(7)(ii)(a)(l). We follow the parties in calling this provision the “public charge” regulation. The public charge regulation appears in a section of the Med *464 icaid regulations that governs DSS departmental procedures.
Another provision, which the parties call the “unacceptable practices” regulation, states:
(b) Conduct included. An unacceptable practice is conduct which constitutes fraud or abuse and includes....
(1) False claims.
(i) Submitting, or causing to be submitted, a claim or claims for:
(d) amounts substantially in excess of the customary charges or costs to the general public.
Id. § 515.2(b)(l)(i)(d).
Rubin and Allstate were indicted in March 1998. 3 Rubin was charged with one count of second-degree grand larceny (Count One) and six counts of first-degree filing of a false instrument (Counts Two through Seven), for submitting claims that he falsely certified were in compliance with federal and state laws and regulations; and two more counts of first-degree filing of a false instrument (Counts Eight and Nine), for submitting false cost reports. 4 After Rubin requested a bill of particulars, the state identified two regulations with which it alleged Rubin had falsely certified compliance: the public charge regulation and the unacceptable practices regulation.
Rubin was tried before a jury in Supreme Court, Albany County, in March 1999. The case lasted two weeks and featured 22 witnesses.
B. Evidence at Trial
As part of its participation in Medicaid, Allstate submitted annual reports to DSS detailing various business costs and other figures. Allstate reported to DSS that its charge to the general public for “Level II” personal care services was $13.50 per hour in 1993 and $15.25 per hour in 1994 and 1995. 5 DSS used data provided by Allstate about prior years’ costs to set its Medicaid reimbursement rates for upcoming years: $13.35 per hour for individual Level II clients in 1994, $15.02 in 1995, and $14.79 in 1996. Allstate, like other providers, was told that it could request that its reimbursement rate be adjusted downward if it wanted to charge the public a lower rate. Letters mailed to Rubin in 1994 and 1995 that accompanied DSS’s newly calculated reimbursement rates also stated, “Medicaid regulations preclude payment in excess of the charge made to the general public for personal care services.”
Several former Allstate employees testified that Rubin was in charge of day-today operations and decisionmaking at Allstate. In particular, many of these employees said that Rubin was responsible for determining or approving rates for personal care services, and that he had detailed command of the business’s billing and finances. For instance, both Debbie Dubois, who worked in payroll and accounts receivable, and former accounting manager Susan Malavet testified that Rubin reviewed all Medicaid remittance statements and approved payment of all *465 bills. Rubin’s administrative assistant, Elizabeth Fernandes, testified that he could quote Medicaid’s rates off the top of his head.
Employees also testified that Rubin knew about the state’s requirement that the Medicaid reimbursement rate be no higher than the rate charged to the general public. Ina Lynch, Allstate’s director of community relations from 1990 to 1992, testified that she learned about the requirement from Rubin personally, and that Rubin mentioned it on several occasions. Malavet testified that she first learned about the requirement at a seminar in 1993; Rubin confirmed Malavet’s understanding but added that there were “exceptions” to the rule, such as for ongoing contracts or for discounted rates for prompt billing. In 1994, when Allstate was notified of its new Medicaid reimbursement rate for the coming year, Mala-vet told Rubin that the rate for private clients would have to be raised to match the Medicaid rate; Rubin responded only that he would “check into it.”
Despite Rubin’s knowledge of the Medicaid rules, the People’s evidence showed that Allstate billed the overwhelming majority of private, self-paying (i.e., non-Med-ieaid) Level II clients at rates lower than it reported to DSS and lower than its approved Medicaid reimbursement rates. According to employees who worked at Allstate during the mid-1990s, private Level II clients were charged $12 an hour during that time period and were never quoted any higher rate. 6 One employee testified flatly that the rate was never negotiable. A state auditor testified that of 3,500 private payer noncontractual invoices submitted by Allstate between 1994 and 1996, only one invoice was actually billed and paid at a non-holiday hourly rate higher than $12. 7 The auditor also calculated that if Allstate’s Medicaid reimbursement rate had been the same as its charge to the general public, DSS would have saved more than $600,000. 8
Witnesses also testified that Rubin intentionally tried to obscure the discrepancy between the rate charged to the general public and the Medicaid rate. After Mala-vet’s 1994 conversation with Rubin, Rubin directed employees to create two sets of fliers listing the agency’s rates: one stating a “regular” rate of $15.25 an hour, and another stating a “discounted” rate of $12 an hour. The cost reports sent to DSS contained only the higher rate, while Rubin told Fernandes to distribute to the office staff only the flier with the lower rate. He told her to keep the flier with the higher rate in a drawer, “for Medicaid.” A review of Allstate records indicated that no one paid the “regular” rate of $15.25 an hour. In 1997 Rubin instructed Malavet to alter existing billing records to insert the higher rate reported to DSS; she refused, and quit her job shortly afterward.
Allstate transmitted claims to DSS for reimbursement on computer disks, accompanied by paper certificates that Rubin signed. Six of these certificates formed the basis of the first six false instrument charges, Counts Two through Seven. Beginning in February 1995, the certificates contained the following boilerplate language: “I have reviewed these claims: I (or the entity) have furnished or caused to be furnished the care, services and sup *466 plies itemized and done so in accordance with applicable federal and state laws and regulations.” 9 They also stated, “I UNDERSTAND ... THAT I MAY BE PROSECUTED UNDER APPLICABLE FEDERAL AND STATE LAWS FOR ANY FALSE CLAIMS, STATEMENTS OR DOCUMENTS OR CONCEALMENT OF A MATERIAL FACT.”
C. Jury Charge, Conviction, and Post-Trial Proceedings
At the close of trial, defense counsel asked that the jury charge include references to both the public charge regulation and the unacceptable practices regulation. The prosecution argued that mention of the unacceptable practices regulation was redundant. Over Rubin’s objection, the trial court did not mention the unacceptable practices regulation in the jury charge.
The jury convicted Rubin on all nine counts. The trial judge sentenced Rubin to concurrent prison terms of 3% to 10 years on the grand larceny count and 1/é to 10 years on the first seven false instrument counts, along with a consecutive prison term of 1% to 4 years on the last false instrument count, Count Nine. The judge ordered Rubin to pay restitution of $620,237.80 plus $50,000 in fines.
The Supreme Court, Appellate Division reversed Rubin’s conviction as to Counts One through Seven.
People v. Rubin,
The Court of Appeals reversed and remanded. It reasoned that the vagueness challenge should have been addressed to the particular facts of Rubin’s case,
People v. Rubin,
Rubin filed a timely petition for habeas corpus in the Northern District of New York. Magistrate Judge Peebles recommended that the petition be granted as to Counts Two and Three — the first two false statement counts — because the certificates on which those counts were based lacked the boilerplate statement that the signer had furnished services “in accordance with applicable federal and state laws and regulations.”
Rubin v. Garvin,
No. 02-CV-0639 (NAM/DEP),
Rubin was released from prison while his habeas petition was under consideration by the district court, and is currently on parole.
II. DISCUSSION
A. Standards of Review
We review a district court’s grant or denial of habeas corpus
de novo,
and the underlying findings of fact for clear error.
Clark v. Perez,
B. Vagueness
The sole issue on which the district court granted Rubin a certificate of ap-pealability (“COA”) is his claim that the public charge regulation, as it was used in his criminal prosecution for grand larceny and filling of false instruments, is void for vagueness. 10
The doctrine of vagueness provides that a conviction is invalid under the Due Process Clause “if the statute under which it is obtained fails to provide a person of ordinary intelligence fair notice of what is prohibited, or is so standardless that it authorizes or encourages seriously discriminatory enforcement.”
United States v. Williams,
— U.S. -,
*468
Rubin claims that the public charge regulation, as an element of a criminal prosecution, is unconstitutionally vague both as applied to his ease and on its face. Because we must “examine the complainant’s conduct before analyzing other hypothetical applications of the law,”
Farrell v. Burke,
1. Vagueness as applied
We examine as-applied vagueness claims in two steps: “ ‘a court must first determine whether the statute gives the person of ordinary intelligence a reasonable opportunity to know what is prohibited and then consider whether the law provides explicit standards for those who apply it.’”
Id.
at 486,
The main thrust of Rubin’s vagueness challenge is that the public charge regulation gave him no opportunity to know his conduct was prohibited, because it is addressed exclusively to DSS, not to service providers like Allstate. The public charge regulation states that payments “are made at the lower of’ the rate charged to the general public and a DSS-computed rate; it does not state that service providers themselves shall not bill DSS at a rate higher than that charged to the public. Thus, Rubin argues, the regulation is vague “not in the sense that it requires a person to conform his conduct to an imprecise but comprehensible normative standard, but rather in the sense that no standard of conduct is specified at all.”
Coates v. City of Cincinnati,
The Court of Appeals — to whose opinion we must defer unless it was contrary to or involved an unreasonable application of clearly established federal law— disagreed. It wrote, “[P]laintiffs were not subject to prosecution because they allegedly violated the public charge regulation. Rather, the intended charges were grand larceny and offering false instruments for filing. The alleged violation of the regulation was only an element of proof of these crimes and violation of the regulation alone, without a knowing attempt to deceive or defraud, could not support criminal liability.”
Ulster Home Care,
We agree. Rubin is right that he could not have been charged with violating the public charge regulation standing alone. But he was charged instead with grand larceny and offering a false instrument for filing. Second-degree grand larceny has only two elements: there must be “proof that a person stole property,” and the value of that property must exceed
*469
$50,000.
In re Virag,
The public charge regulation is not a criminal statute that required Rubin to adhere to a specific standard of conduct; it was a factor that the jury considered in deciding whether Rubin took state property “wrongfully” (an element of the grand larceny count) and whether he knew that his certification of compliance with state regulations was “false” (an element of the false instrument counts). The public charge regulation helps establish the wrongfulness of Rubin’s conduct even though its wording was not expressly directed to him: as the People proved at trial, Rubin knew that DSS was not supposed to reimburse Allstate at rates higher than those Allstate charged to the public, and because of that knowledge, intentionally manipulated the agency’s rate sheets and cost reports to deceive DSS about Allstate’s true rates. Similarly, Rubin’s knowledge of the public charge regulation showed that his statement that Allstate’s claims were “in accordance” with state regulations was false, because Rubin knew that his Medicaid reimbursement rate did not accord with DSS’s calculation methods as stated in its regulations.
Viewed in this context, Rubin’s vagueness claim fails the test of common sense. It should have been apparent to anyone operating in the field of Medicaid that a service provider was not allowed to overcharge the state and conceal that he was doing so. The Due Process Clause requires only that “the law give sufficient warning that men may conduct themselves so as to avoid that which is forbidden, and thus not lull the potential defendant into a false sense of security, giving him no reason even to suspect that his conduct might be within its scope.”
United States v. Herrera,
This conclusion is not altered by Rubin’s related argument that the public charge regulation was rendered vague by the existence of the unacceptable practices regulation. Rubin argues that even if the former regulation describes a standard of conduct for service providers, it is contradicted by the latter, which (1) bars service providers only from charging DSS “substantially” in excess of the general public’s rates, and (2) refers to the “customary charges or costs” charged to the public, not the “rate.” N.Y. Comp. Codes R. & Regs. tit. 18, § 515.2(b)(l)(i)(d). The second variation is trivial. The first is not a “conflicting command[],”
United States v. Cardiff,
As for Rubin’s remaining arguments, we agree fully with the Court of Appeals that “[njeither the term ‘general public’ nor ‘rate’ as used in the regulation is so vague that it could not be understood by a person of ordinary intelligence or could be arbitrarily enforced.”
Ulster Home Care,
Turning to the second step of an as-applied vagueness challenge,
see Nadi,
2. Facial vagueness
Rubin also argues that the Court of Appeals erred in reviewing his claim of vagueness as applied to the facts of his particular case rather than facially, thereby “invalidat[ing] the public charge regulation as a basis for criminal prosecution.” The Supreme Court has provided for facial vagueness review only where the challenged statute (1) lacks standards to the degree that it invites selective or arbitrary enforcement,
see City of Chicago v. Morales,
III. CONCLUSION
We conclude that the decision of the New York Court of Appeals determining that the public charge regulation is not unconstitutionally vague was neither contrary to nor involved an unreasonable application of clearly established federal law. Judgment affirmed.
Notes
. A more extensive summary of the facts of this case can be found in the report and recommendation of Magistrate Judge Peebles.
Rubin v. Garvin,
No. 02-CV-0639 (NAM/ DEP),
. For simplicity, we refer to the agencies together as "DSS.”
. Rubin does not contest his conviction on Counts Eight (related to a 1996 cost report’s false statement of the rate Allstate charged the public) and Nine (relating to a 1997 cost report’s false designation of expenses for an outside catering company as patient care costs). Two additional false instrument counts were dropped by the prosecution before trial.
."Level II” personal care services include laundry, cleaning, shopping, running errands, and help with bathing, dressing, and using the toilet. Most reimbursements for personal care services in New York are for Level II services.
. One witness, Malavet, said she thought the rate was around $13 an hour in 1994, but expressed uncertainty.
. Work on holidays was billed at one-and-a-half times the ordinary hourly rate.
.Expressed another way, Allstate's Medicaid reimbursement rate was 11% higher than its charge to the general public in 1994, 25% higher in 1995, and 23% higher in 1996.
. Because the two certificates corresponding to Counts Two and Three, which dated from 1994, had different boilerplate language that made no reference to "federal and state laws and regulations,” the district court granted Rubin’s petition for habeas corpus with respect to those two counts on grounds of actual innocence. The State has not appealed the district court’s decision on Counts Two and Three, and we express no opinion about it.
. We decline Rubin’s invitation to expand the COA and examine his claim of insufficiency of the evidence. The district court rejected Rubin’s application for a COA with respect to that claim, as well as his claims of denial of a fair trial and ineffective assistance of counsel. Rubin did not move this Court for a COA on those issues. Although he correctly notes that we may expand the COA,
see Love v. McCray,
. We note that on this point — the function of a state regulation in the framework of state criminal statutes — we owe particular deference to the New York Court of Appeals. "A State’s highest court is unquestionably 'the ultimate exposito[r] of state law.' ”
Riley v.
Kennedy, - U.S. -,
. Three justices in
Morales
would also have facially invalidated the law on the more general ground that “vagueness permeate[d] the text” and thus that the law "fail[ed] to provide the kind of notice that will enable ordinary people to understand what conduct it prohibits.”
