Authentication scheme security: unique link and birth date

Question

Recently I had to make an appointment at a hospital. I got an email with a link with a token in the form of a GUID. This brought me to a page where I had to enter my birth date to see the details.

This detailed page contained sensitive details like my SSN, what department my appointment was for (e.g. surgery, radiology etc.) and my doctor's name.

The email was send through TLS. The link has not expired so far and I am not able to change my password (the concept 'password' does not seem to exist).

Since my birthday is basically public information, is this scheme equivalent to sending me a plaintext password (GUID)? Or is there something that I'm missing?

Answer 1

I would say its secure. The unique link, ensures that nobody that know your birthdate, can just logon and gain access to your information.

And the birthdate login, ensures that somebody that catches the email in transit (for example, on a public wifi), and the email happens not to be encrypted, cannot abuse your link since they don't know your birthdate.

I would say its sufficently secure for sending, not extremely sensitive information, but I would say your SSN, department, doctor's name and appointment time, for a single patient, is not extremely sensitive.

As you know, the rules for security changes in how many patient details you send. For example, sending a stack with 100 journals from one hostpital to a another, is not permitted via snail mail at all, you need to send it with guarded transport. But sending a single journal to a patient, is permitted to be sent in a simple letter, you don't even need to send it traceable or registred.

And its generally similiar when it comes to email. You may send simple information, but not more than that. Sending a link to the journal would not be permitted, but sending the information you got, is OK. However, sending a link to the journal via a GUID link + for example a SMS code to your phone, would be permissible.

So I would say, for the threats that are applicable, I would say its sufficently secure.

I think that they have made so the link expires when your appointment are over. It would ofcourse be dumb to make the link expire earlier, since you might read the appointment on mobile, think "yeah, its 1 week left, I can write the time into the calendar when I come home", and then when you come home, the link is expired/used.