It's fine to use them for disambiguation purposes. It's not fine to assume that just because I know someone's SSN (and maybe their DOB) I am that person.

Medicare replace SSNs with a Medicare-specific ID, seems like a move in the right direction.