I've worked with several large healthcare organizations in a consulting capacity. You would be laughed out of a room for suggesting SSN or name and birthday as

I've worked with several large healthcare organizations in a consulting capacity. You would be laughed out of a room for suggesting SSN or name and birthday as the primary identifier for an individual. All used an internal patient ID. Some had processes that would use an SSN or name and birthday as inputs to an identification procedure. These procedures would invariably include additional steps. It's perfectly reasonable to ask someone their name and birthday. You can easily use these as search keys to be presented with a list of options. Then, you can select the appropriate record from that list. Sometimes you might need additional information to determine the correct record. If so, you ask the patient. Each organization also had many reconciliation processes to resolve misidentified patients. All this to say, they were explicitly not using SSN to identify patients. Sometimes they are put in situations where this is the primary identifying datum for a record, and this is an (unfortunately common) exceptional situation to be resolved.