That is a big yikes, but definitely not the norm. Most school districts switched from using SSN as their SIS identifier decades ago.