OPINION
Chao Moua was convicted of one count of identity theft in violation of MinmStat. § 609.527, subds. 2, 3(5), and ordered to pay restitution to 15 individuals who sustained economic loss or took remedial action as a result of the theft. Moua appeals, arguing that the identity-theft statute’s $1,000 minimum restitution provision for direct victims violates his right to procedural due process. In a separate appeal, the State of Minnesota argues that the district court erred by requiring individuals to present evidence of resulting loss or harm to qualify as direct victims entitled to minimum restitution. We affirm the district court’s conclusion that the identity-theft statute does not violate a defendant’s right to procedural due process. But because we conclude that an individual does not have to sustain actual economic loss or provide evidence of specific remedial action to show loss or harm and thus qualify as a direct victim entitled to minimum restitution, we reverse and remand for the district court to award restitution to all direct victims.
FACTS
In February 2014, St. Paul police stopped Moua’s vehicle and discovered hundreds of pieces of stolen mail inside. The mail included identifying information of various kinds relating to 422 individuals. Moua was charged with one count of identity theft involving eight or more direct victims in violation of Minn.Stat. § 609.527, subds. 2, 3(5).
*814Moua pleaded guilty, admitting that he stole mail with the intent to fraudulently exploit any personal-identification information the mail contained. The state sought restitution on behalf of all direct victims. The district court directed the state to provide a list of potential direct victims, categorizing them by the nature of their loss or harm, which could be used to determine restitution payment priority. At sentencing, the prosecutor did so, placing the individuals into four categories:
• Category 1 — 14 individuals who sustained out-of-pocket economic losses.
• Category 2 — 287 individuals who were likely to suffer some form of inconvenience or hassle due to the identity theft, but did not experience economic loss.
• Category 3 — 2 individuals who responded to calls from county victim’s advocates, but reported no economic losses or inconvenience.
• Category 4 — 119 individuals who lost items such as “junk mail,” which did not contain private identifying information.
The district court ordered Moua to pay restitution of $1,000 to each of the 422 individuals pursuant to the minimum restitution provision of the identity-theft statute, Minn.Stat. § 609.527, subd. 4(b).
In August 2014, Moua filed a timely challenge to the restitution order, asserting that most of the individuals for whom the state sought restitution were not direct victims as defined by the identity-theft statute, and that the minimum restitution provision of the statute violates his due-process rights. At the restitution hearing, the state conceded that the 119 individuals whose stolen mail did not include private identifying information are not direct victims. The primary dispute was whether the 287 individuals whose names and private identifying information were stolen, but who had not sustained economic loss, are direct victims entitled to restitution.1
Detective Jennifer Engh of the Roseville Police Department testified regarding the nature of the loss or harm individuals in each of the first three categories was likely to experience. She explained that the 287 members of category 2 had, in addition to their names, some form of private identifying information stolen, such as an account number, date of birth, driver’s license number, or passport. Detective Engh noted that once such private identifying information is stolen, “it is always out there, and you don’t know who will have [it] next.” She also explained that these individuals will likely need to take a variety of remedial actions, including “closing accounts, reestablishing new credit cards, reestablishing new checking accounts, ... [and] contacting the Social Security Administration.” Detective Engh testified that one of these individuals spent over 100 hours clearing his or her name.
Following the restitution hearing, the district court amended its original order, awarding restitution only to the 14 individuals in category 1 — those who had incurred economic loss — and the one person in category 2 who spent over 100 hours attempting to clear his or her name. The district court determined that the steps the category 2 individuals would likely have to take in response to the stolen information would constitute loss or harm entitling them to minimum restitution only if and when they took such steps. The district court suggested that, if these individuals experienced loss or harm in the future, they would be able to pursue recovery under the general criminal restitution *815statute, Minn.Stat. § 611A.04, subd. (l)(b) (2014). The district court also rejected Moua’s argument that the minimum restitution provision violates his rights to substantive and procedural due process. Both Moua and the state appeal. This court consolidated the appeals.
ISSUES
I. Does the minimum restitution provi-sion of Minnesota’s identity-theft statute violate a defendant’s right to procedural due process?
II. Must individuals whose names and private identifying information were stolen sustain economic loss of provide evidence of remedial action to show loss or harm for purposes of obtaining minimum restitution?
ANALYSIS
I. The minimum restitution provision of Minnesota’s identity-theft statute does not violate a defendant’s right to procedural due process.
The Due Process Clauses in the United States and Minnesota Constitutions state that a person shall not be deprived of life, liberty, or property “without due process of law.” U.S. Const, amends. V, XIV; Minn. Const, art. I, § 7. Procedural due process requires the government to “provide an individual with notice and an opportunity to be heard at a meaningful time and in a meaningful manner.” Sawh v. City of Lino Lakes, 823 N.W.2d 627, 632 (Minn.2012) (quotation omitted).
We conduct a “two-step analysis to determine whether the government has violated an individual’s procedural due process rights,” Id. First, we “must identify whether the government has deprived the individual of a protected life, liberty, or property interest.” Id. -If the government has deprived a person of a protected interest, we then.“determine whether the procedures followed by the [government] were constitutionally sufficient.” Id. (alteration in original) (quotation omitted). . Whether an individual’s due-process rights have been violated is a question of law, which we review de novo. Id.
Minnesota’s identity-theft statute provides that “[t]he court shall order a person convicted of [identity theft] to pay restitution of not less than $1,000 to each direct victim of the offense.” Minn.Stat. § 609.627, subd. 4(b). Moua challenged this provision on both substantive and procedural due-process grounds in the district court. On appeal, Moua argues only that the provision violates his procedural due-process rights. Specifically, he contends that the $1,000 minimum restitution obligation denies him procedural due process because he is unable to contest the amount of restitution awarded to each direct victim. We are not persuaded.
First, it is undisputed that Moua received notice and had multiple opportunities to challenge the restitution award. At the plea hearing, Moua acknowledged that the state intended to seek as .much as $612,000 in restitution, and while he would have the opportunity to challenge restitution, the court had the authority to order him to pay $1,000 per direct victim. Moua’s counsel argued at sentencing that the state was obligated to show that every claimed victim experienced loss or harm. And the district court conducted a restitution hearing in which Moua presented legal arguments and challenged the state’s evidence as to who qualified as a direct victim. Indeed, counsel persuaded the district court to limit the number of restitution recipients to 15 individuals. In short, Moua’s numerous • opportunities to be heard on the issue of restitution demonstrate that application of the minimum res*816titution provision did not impermissibly deprive him of his procedural due-process rights.
Second, it appears to us that Moua’s constitutional argument, at its core, implicates the substance of the statute — that the statute is unfair because it, in effect, levies an arbitrary fíne that is untethered to a victim’s actual loss. To the extent the minimum restitution provision raises due-process concerns, then, it does so with respect to substantive due process. See State v. Wiseman, 816 N.W.2d 689, 692 (Minn.App.2012) (stating that the right to substantive due process “protects individuals from certain arbitrary, wrongful government actions regardless of the fairness of the procedures used to implement them” (quotations omitted)), review denied (Minn. Sept. 25, 2012), cert. denied — U.S. -, 133 S.Ct. 1585, 185 L.Ed.2d 578 (2013), abrogated in part by Missouri v. McNeely, — U.S. -, 133 S.Ct. 1552, 185 L.Ed.2d 696 (2013). But Moua has not raised or briefed this issue on appeal.
In sum, we conclude that the minimum restitution provision does not violate Moua’s procedural due-process rights. And we decline to consider the merits of a possible substantive due-process challenge because Moua did not raise the issue on appeal.
II. The 287 individuals whose names and private identifying information were stolen incurred loss or harm as a result of identity theft and are entitled to minimum restitution.
A district court has broad discretion to award restitution. State v. Tenerelli, 598 N.W.2d 668, 671 (Minn.1999). But whether a statute authorizes restitution is a matter of statutory construction, which we review de novo. In re Welfare of J.A.D., 603 N.W.2d 844, 846 (Minn.App.1999). The object of all statutory interpretation “is to ascertain and effectuate the intention of the legislature.” Minn. Stat. § 645.16 (2014). When interpreting a statute, we first determine whether its language is clear or ambiguous. Am. Family Ins. Grp. v. Schroedl, 616 N.W.2d 273, 277 (Minn.2000). Statutory language is ambiguous if it is subject to more than one reasonable interpretation. Amaral v. St. Cloud Hosp., 598 N.W.2d 379, 384 (Minn.1999). If statutory language is clear, we apply its plain meaning. Hans Hagen Homes, Inc. v. City of Minnetrista, 728 N.W.2d 536, 539 (Minn.2007). We consider a statute as a whole and analyze statutory language in the context of surrounding provisions to determine its plain meaning. Schroedl, 616 N.W.2d at 277-78. A statute should be interpreted to give effect to all of its provisions, with no word or phrase deemed superfluous, and to avoid absurd or unjust results. Minn.Stat. § 645.17 (2014); Schroedl, 616 N.W.2d at 277-78.
Minnesota’s identity-theft statute makes it a crime to “transferí ], possess[], or use[ ] an identity that is not the person’s own, with the intent to commit, aid, or abet any unlawful activity.” Minn.Stat. § 609.527, subd. 2. The statute broadly defines “identity” as “any name, number, or data transmission that may be used, alone or in conjunction with any other information, to identify a specific individual or entity,” and includes the following:
(1) a name, Social Security number, date of birth, official government-issued driver’s license or identification number, government passport number, or employer or taxpayer identification number;
(2) unique electronic identification number, address, account number, or routing code; or
(3) telecommunication identification information or access device.
*817Id., subd. 1(d). The statute entitles each “direct victim” of identity theft to minimum restitution “of not less than $1,000.” Id., subd. 4(b). A “direct victim” is “any person or entity described in section 611A.01, paragraph (b), whose identity has been transferred, used, or possessed in violation of this section.” Id., subd. 1(b). In its relevant part, Minn.Stat. § 611A.01, paragraph (b) (2012), defines “victim” as “a natural person who incurs loss or harm as a result of a crime.” (Emphasis added.) Accordingly, our analysis turns on whether the claimed victims who had their names and private identifying information stolen but did not sustain economic loss, incurred “loss or harm.”
The state argues that an individual incurs loss or harm when an offender possesses, transfers or uses the individual’s identifying information with the intent to commit criminal activity and that individual has either: (1) suffered economic loss or (2) had the type of private identifying information stolen — i.e., birthdate, Social Security number, passport, account numbers, and the like — that will or has required some kind of remedial action. Examples of such remedial actions include cancelling accounts, obtaining new forms of identification and changing passwords or privacy settings. Moua asserts that general restitution principles apply, so actual economic loss must be demonstrated to prove loss or harm. See Minn.Stat. § 611A.04, subd. 1 (2014). Alternatively, he contends that even if non-economic loss or harm is sufficient, individuals must present evidence of specific remedial action to obtain minimum restitution. We find the state’s argument more persuasive for three reasons.
First, we do not read the identity-theft statute to require a showing of economic loss to establish loss or harm. The statute defines “loss” as “value obtained ... and expenses incurred by a direct or indirect victim.” Minn,Stat. § 609.527, subd. 1(f). But the statute does not define “harm.” Accordingly, we consider the plain meaning of the term. Harm generally means “physical or psychological damage” or “immoral or unjust effects.” The American Heritage Dictionary 802 (5th ed.2011). Black’s Law Dictionary further defines harm as a “material or tangible detriment.” Black’s Law Dictionary (10th ed.2014), Thus, the plain meaning of harm includes any detrimental effects of another’s wrongful actions, and is not limited to measurable economic loss.
This broad definition of harm is consistent with other portions of the identity-theft statute. By generally defining a direct victim as someone who incurs either “loss or harm,” and specifically defining “loss” in economic terms, the legislature implied that “harm” encompasses an alternative array of non-economic damages and harmful effects. If this were not so, the inclusion of harm in the definition of direct victim would be superfluous; its scope would simply duplicate the term loss. See Amaral, 598 N.W.2d at 384 (stating that “[wjhenever it is possible, no word, phrase, or sentence should be deemed superfluous, void, or insignificant.”). Moreover, the legislature’s decision to tie the severity of sentencing to either the number of direct victims or the total, combined economic loss sustained supports our broad interpretation of harm. See Minn.Stat. § 609.527, subd. 3. These alternative bases for sentencing recognize that culpability flows from both the amount of economic loss and the number of direct victims involved, regardless of the extent of their loss or harm. This implies that real harm occurs even in the absence of economic loss, and it follows that the legislature intended direct victims to include those who incur such non-economic harm.
*818Second, we are not persuaded that an individual whose name and private identifying information has been stolen, must have already taken remedial steps to demonstrate harm. Detective Engh testified that individuals whose names, account numbers, birth dates, and license and passport numbers.have been compromised by an identity thief will “absolutely” have to take remedial actions at some point to protect themselves. As Detective Engh explained, such an individual’s private identifying information “is always out there,” and thus these individuals face a fingering threat even if they take remedial action. In other words, individuals incur harm when their security is compromised by the initial theft of their name and private identifying information, and the harm may continue indefinitely, despite restorative measures. The subsequent time and effort individuals may expend on actions such as closing accounts, changing passport, Social Security, and other identifying numbers, and alerting creditors do not represent the first realization of harm. Rather, it is additional detriment to the harm occasioned by the initial theft.
Third, our interpretation of harm is consistent with the broad, remedial purpose of 'the identity-theft statute. The minimum restitution provision reflects the legislature’s recognition that while it is difficult to quantify loss or harm occasioned by identity theft, victims nonetheless experience material detriment. In Anderson v. State, this court rejected the contention that an identity-theft victim must submit a loss affidavit to recover under the minimum restitution provision. 794 N.W.2d 137, 140-41 (Minn.App.2011), review denied (Minn. Apr. 27, 2011). We reasoned that the specific provisions of the" identity-theft statute control over the general restitution procedures embodied in Minn.Stat. § 611A.04, subd. 1, and that the more specific identity-theft provisions do not require proof of loss. Id. at 140. In so doing, we implicitly recognized the legislature’s intention to forego the procedural requirements contained in the general restitution statutes to make restitution broadly available to those affected by identity theft.
Likewise, requiring individuals whose names and private identifying information have been stolen to show what remedial action they have taken before receiving restitution would be inconsistent with the legislature’s intent. By interpreting harm to be incurred when private identifying information is stolen, identity-theft victims may efficiently resolve restitution claims that could otherwise finger as they attempt to uncover the extent of their exposure, which as Detective Engh suggested, may be indeterminable. And our construction of the statute ensures that individuals who are only dispossessed of publicly available information like their name and address on a piece of junk mail, are not entitled to minimum restitution because such information on its own would be of little use to an identity thief.
In sum, we hold that when a defendant possesses an individual’s name and private identifying information with the intent to commit a crime, the individual has incurred loss or harm and is thus entitled to $1,000 minimum restitution under the identity-theft statute.
DECISION
The identity-theft statute’s minimum restitution provision does not violate a defendant’s right to procedural due process. We also conclude that where a defendant criminally possesses, uses, or transfers an individual’s name and private identifying information, that individual has sustained loss or harm and is thus a direct victim who is entitled to the mandatory minimum *819restitution payment. Accordingly, we reverse and remand for the district court to award restitution to all direct victims, consistent with this opinion.
Affirmed in part, reversed in part, and remanded.