NCRP Report 114, Maintaining Radiation Protection Records,addresses the issue as follows:

[Joyce Davis <JOYCED@DNFSB.GOV>]

NCRP Report 114, Maintaining Radiation Protection Records, addresses the issue as follows:
"Since it may not be feasible to store at a single location all information that may be useful, it is necessary to have a
small set of unique identification data that can be used to link specific individuals and events with exposures. ...  All
identification data that are used for linkage must be unique without duplication or overlap. For an individual, the
basic set of  identifying information that should be used on all pertinent records is name (first, middle initial, last),
social security number, and date of birth.  In addition, maiden name should be included for women.  It is not
sufficient to store only name or social security number or both.  Transcription errors can occur ... "

This report probably  has found or will find its way into regulatory guidance. 

The report notes that records can be used for program evaluation, regulatory conpliance, epidemiologic studies or
legal claims.  Thus it is important to preserving an employee's legal rights that his records be adequately identified
so they can be retrieved if needed.  Maybe you can appeal to self-interest.
By the way, a driver's license number mightn't be an alternative; some states use the SSN for the license ID.  

J P Davis
joyced@dnfsb.gov