Catalonia’s public health app La Meva Salut will drop passwords and require idCAT Mòbil for access. The change aims to improve security and make logins easier. Delegated access for family members is also coming.
Catalonia is preparing to remove passwords from its public health portal, La Meva Salut. The Department of Health has confirmed that by early 2027, users will only be able to log in with idCAT Mòbil, a digital ID system. The change affects millions of residents and is meant to close security gaps and meet EU data protection rules. The shift follows both regulatory pressure and recent security incidents, according to ARA and official statements from the AOC consortium.
Until now, users could choose between a personal password or idCAT Mòbil to access their health records. But after a series of credential thefts in 2024, authorities tightened security and added two-factor authentication. Even so, passwords are being phased out: starting January 2025, new passwords will only be issued until the end of that year. After that, the phase-out speeds up. The last day to create a new password is September 15, 2026. By January 2027, password access will be fully disabled for everyone, as confirmed by several official sources.
"From the last quarter of 2026, users will no longer be able to create, recover, or change passwords for La Meva Salut; only idCAT Mòbil will remain as the authentication method."
ARA
idCAT Mòbil is a digital authentication tool that sends one-time codes to registered phones. It is not an app and does not require a download. Users register online by linking their ID and mobile number. Each login triggers an SMS with a unique code, which must be entered to access the portal. The process is free and designed to be simple, but it does require a mobile phone and some digital skills. The AOC describes idCAT Mòbil as a simpler and more secure way to log in, and it is being adopted across Catalan digital services.
Another major change is the expansion of delegated access. Soon, adults will be able to authorize trusted relatives or caregivers to manage their health profiles from the authorized person’s own account. This feature was previously limited to parents and legal guardians of minors or dependents. The update is meant to help elderly users and those who struggle with digital tools. The change comes after complaints, including one from the Síndica de Greuges, about the difficulties families faced when stricter authentication was introduced. Local media, including El Periódico, have reported more complaints from older citizens and people with limited digital skills, prompting authorities to speed up support features.
The Department of Health has set a gradual timeline for these changes, with full implementation expected by early 2027. Until then, both passwords and idCAT Mòbil will work, but the window for requesting new passwords closes in January. The shift is a direct response to security incidents and regulatory demands from Brussels. According to La Vanguardia, existing passwords will remain valid until they expire, but after September 2026, no new or recovered passwords will be possible.
"The expansion of delegated access will allow adults to manage multiple health profiles, a feature previously reserved mainly for minors and dependents. This change is intended to help families and caregivers support elderly or digitally challenged users as password access is phased out."
El Periódico
To register for idCAT Mòbil, users need to provide their ID, a mobile number, and an email address. The system verifies the phone via SMS before activating the account. Once set up, logging in to La Meva Salut means entering the ID and phone number, then confirming the one-time code sent by SMS. No app installation is needed, and the process is designed to be straightforward for those familiar with basic digital tools.
While the main focus is on security and compliance, the practical impact is clear: Catalans who use La Meva Salut for appointments, prescriptions, and test results will need to adapt. Those without mobile phones or digital skills may face difficulties, though the new delegated access feature is meant to help vulnerable groups. The situation reflects broader challenges in Spain’s digital transformation, where technical upgrades often run up against the realities of an aging population and uneven access to technology. As seen in other areas—such as the environmental oversight issues reported earlier—the gap between policy and practical access remains a recurring problem.
Catalonia’s decision to retire passwords from La Meva Salut is a response to security failures and regulatory demands, but it also highlights the ongoing digital divide. By expanding delegated access, authorities recognize that not everyone can manage digital bureaucracy alone. The real question is whether these changes will make the system both secure and accessible, or simply shift the burden to families and caregivers. For now, users will need to switch to idCAT Mòbil or risk losing access to their health records.
