If the doctor was not using a gmail account, the UI probably recomended to share it "with anyone that has the link" that is like public but protected by oscurity.
Most people don't realize that it is 99% like posting it on Facebook.
Most people don't realize that it is 99% like posting it on Facebook.
It's not impossible that someone sees the URL, and if it's stored in an email the backups or local clients could store it plaintext, but I don't see how the URL is any more likely than the password to be sniffed during the connection itself
Its a random link someone would have to guess.