Earlier quoted context omitted.
SSNs aren’t unique, and were never intended to be.
I'm not arguing with that at all! I'm saying that the fact that they aren't hasn't actually stopped anyone from using them that way. When this assumption is violated, a psuedo-identifier is assigned. I have worked with multiple systems that work this way and it is the norm in finance and was the norm in higher education until relatively recently. State government information systems also use SSN as primary identifier…
Some had processes that would use an SSN or name and birthday as inputs to an identification procedure. These procedures would invariably include additional steps.
It's perfectly reasonable to ask someone their name and birthday. You can easily use these as search keys to be presented with a list of options. Then, you can select the appropriate record from that list. Sometimes you might need additional information to determine the correct record. If so, you ask the patient.
Each organization also had many reconciliation processes to resolve misidentified patients.
All this to say, they were explicitly not using SSN to identify patients. Sometimes they are put in situations where this is the primary identifying datum for a record, and this is an (unfortunately common) exceptional situation to be resolved.