Yeah, the situation sucks.
But, it was standard practice for at least every medical insurance company and hospital I encountered.
I of course thought this was a bad idea, and found out about the law. Every time I went to interact with a new insurer or hospital, they'd assk for my SSN. I'd say that my SSN can NOT be my ID number, and invariably get in a 5-15 minute argument with the rep. I'd end up telling them to go check with their higher managers. They always came back saying "yes, we can use a different number, here's yours", or with a form filled in with "Assign ID" in the place of my SSN. Once I had my assigned ID, and just kept telling reps that ID when asked for my SSN, things were mostly fine.
Evidently, the main corporate policy was to break the law until someone called them out. Seems it would have been so much easier to just use the database UniqueID function for everyone...
FWIW mine has been laminated since my childhood and decades after the fact I’ve had no real issues with agencies about its lamination