I wouldn't use anything like the SS number in something like this ...........
just me being paranoid ............ BUT.

couldn't you generate numbers based on their names / DOB / payroll # - WHEN THEY JOINED ?

what's wrong with having to change a few names once in a while ?
Just call EVERYONE [L]user, with password as the password.

problem solved

NEXT