I hope all is well with you. This is in response to your question regarding the disclosure of the last four digits of students' social security numbers to the hospital system IT.
FERPA prohibits institutions from designating SSNs or any portion thereof—including truncated or masked SSNs—as "directory information," which means these numbers cannot be disclosed without prior written consent from the eligible student or unless another FERPA exception applies. Additionally, SSNs should not be used to authenticate identity for disclosure purposes because the use of any part of an SSN as an identifier still presents privacy and security risks.
However, based on your inquiry, it sounds like the hospital system IT may be performing an institutional service or function for the institution (i.e., creating students’ email accounts). If so, FERPA’s school official exception may be an option to consider that would permit the non-consensual disclosure of personally identifiable information from education records to IT. Under this exception, an institution is permitted to disclose PII from students’ education records without eligible student consent to contractors and other outside parties performing institutional services or functions. Under this exception, the institution is required to specify in its annual notice of student rights the criteria for who is considered a “school official" and what constitutes a "legitimate educational interest. The institution must maintain direct control over the third party regarding the use and maintenance of the education records. The third party may use PII only for the authorized purposes set by the institution. Also, disclosure to further third parties is prohibited unless specifically authorized by the institution and in line with FERPA. This is typically accomplished via a contractual agreement specifying the third party's responsibilities, limitations on access, data security, and prevention of unauthorized use or redisclosure.
However, such agreements are not required under FERPA. If the school official exception is appropriate in your situation, I agree you should only provide hospital system IT with the limited PII necessary to establish student email accounts on behalf of the institution. It is interesting that IT is now saying they need the last four digits of students' social security number to create student email accounts. You may want to pursue why.
For more information on the school official exception, see Appendix B, page 159 of the 2012 AACRAO FERPA Guide.