I would say its secure.
The unique link, ensures that nobody that know your birthdate, can just logon and gain access to your information.
And the birthdate login, ensures that somebody that catches the email in transit (for example, on a public wifi), and the email happens not to be encrypted, cannot abuse your link since they don't know your birthdate.
I would say its sufficently secure for sending, not extremely sensitive information, but I would say your SSN, department, doctor's name and appointment time, for a single patient, is not extremely sensitive.
As you know, the rules for security changes in how many patient details you send. For example, sending a stack with 100 journals from one hostpital to a another, is not permitted via snail mail at all, you need to send it with guarded transport.
But sending a single journal to a patient, is permitted to be sent in a simple letter, you don't even need to send it traceable or registred.
And its generally similiar when it comes to email. You may send simple information, but not more than that. Sending a link to the journal would not be permitted, but sending the information you got, is OK.
However, sending a link to the journal via a GUID link + for example a SMS code to your phone, would be permissible.
So I would say, for the threats that are applicable, I would say its sufficently secure.
I think that they have made so the link expires when your appointment are over. It would ofcourse be dumb to make the link expire earlier, since you might read the appointment on mobile, think "yeah, its 1 week left, I can write the time into the calendar when I come home", and then when you come home, the link is expired/used.