[pseudalopex]

A couple of people who handled Red Flags compliance for medical practices have told me they're only required to do some kind of identity verification, which can be as simple as checking a driver's license. They store SSNs to make it easier to report and collect on delinquent accounts.