Recently I had to make an appointment at a hospital. I got an email with a link with a token in the form of a GUID. This brought me to a page where I had to enter my birth date to see the details.

This detailed page contained sensitive details like my SSN, what department my appointment was for (e.g. surgery, radiology etc.) and my doctor's name.

The email was send through TLS. The link has not expired so far and I am not able to change my password (the concept 'password' does not seem to exist).

Since my birthday is basically public information, is this scheme equivalent to sending me a plaintext password (GUID)? Or is there something that I'm missing?