How can I create a derivation of PersonSSNIdentification that references a type that enforces these additional constraints?

The PersonSSNIdentification element is of type IdentificationType, which in turn has an element IdentificationID of type string. Clearly IdentificationID needs to accept arbitrary strings. However, in the context of PersonSSNIdentification, the IdentificationID needs to be nine characters, the first three digits of which cannot be 000 or 666 (plus a bunch of other rules enforceable using regex).  Here is a simple  business rules for SSN to be enforced by the XML schema that you can define a PersonSSNIdentificationID in your own namespace and use xsd:pattern:

<xsd:simpleType name="PersonSSNIdentificationID">
<xsd:restriction base="xsd:token">
<xsd:pattern value="[0-9]{3}-[0-9]{2}-[0-9]{4}"/>
[additional pattern facets to specify remaining business rules]
</xsd:restriction>
</xsd:simpleType>

Or, you can use the substitution method as below:

<nc:Person>
<nc:PersonSSNIdentification>
<nc:IdentificationID>123-45-6789</nc:IdentificationID>
</nc:PersonSSNIdentification>
</nc:Person>

<nc:Person>
<nc:PersonSSNIdentification>
<your:SSNIdentificationID>123-45-6789</your:SSNIdentificationID>
</your:PersonSSNIdentification>
</nc:Person>


It highly recommend to use the simple method before going into the substitution method. In case of using the substitution method, you have to ensure that the IEPD documentation is clear that your:SSNIdentificationID is to be used for SSN (as a substitution for nc:IdentificationID), and nc:IdentificationID is not to be used for SSN. If you need to enforce that, the receiver will have to use a means other than XML schema validation, as is the case with many business rules that cannot be represented using XML schema validation as is or constrained by the NIEM NDR.