Instead of fretting about every data breach we need companies to start adopting security models that assume all the data is public and not rely on using SSN or address history or such for authentication/ authorization.
There are three reasons that a company wants your SSN. One is for tax-reporting reasons. For those, it's possible to get and provide a taxpayer ID number to use instead of the SSN.
Another is when they're going to need to file reports with Social Security itself. For those, they really do need your SSN.
A third is that they just want an ID number and are being lazy. I've found that in the majority of cases, just telling them that you don't provide your SSN for that purpose works. They'll generate their own number to use instead.
That said, perhaps I should have made it clear that this isn't my field of expertise. I'm assuming the downvotes I got are because someone knows I'm wrong? I very well could be! I'm just reporting what my personal experience has been.
Finally, how does that help the millions of SSN fraud victims who aren't me and have no idea they don't have to give their SSN to get medical care? Like, I can learn self-defense against any number of dangers I might encounter - that doesn't mean I'm ok with those dangers being proliferated by our biggest and most critical institutions. So those are probably the two main reasons people are downvoting.
If you cannot understand why those things are dismissed without question, you have zero business being anywhere around them. Some systems just should not exist. Their mere existence, plus the temptation to abuse them, is basically irresistable to exploit once they do exist. Both of the systems you mention fall into that category.
I don't see how that can be improved without either 1) a national ID system seen in other countries or 2) beaming into average people's brains an understanding of unique cryptographic identities that they are in charge of maintaining and using.